Recent posts

#1

26.1, 26,4 Series / Re: OPNWAF: Optional binding o...

Last post by Monviech (Cedrik) - Today at 04:37:09 PM

No problem, the DNAT rule is the currently supported approach. It keeps policy in the firewall and your service will survive any change of ip addresses (also missing ones during boot or dynamic ones in case of ipv6) transparently.

#2

26.1, 26,4 Series / Re: OPNWAF: Optional binding o...

Last post by Zwiebelhacker - Today at 04:21:40 PM

I think the issue also applies to a single organization with multiple services.

For example, I might have a public website that should be accessible worldwide, while an ownCloud instance should only be accessible, for example, from Germany. If they use different public IPs, I can apply different firewall policies to those IPs.

So for me, the main issue isn't really multi-tenancy, but having different security policies for different services.

At the moment, I actually only have two web servers where different policies apply, so I tried the workaround with DNAT rules and separate ports for these. So far, this seems to work quite well. Thanks for that!

#3

26.7 Series / Re: Interfaces: Virtual IPs: S...

Last post by lmoore - Today at 04:09:35 PM

It means that for IPFW dummynet shaping it needs an additional tunable.

A little more is required.

I suspect I know the reason why fudging of ARP was initially used in @MK4L's environment.

I'm including the steps required to set up a Transparent Traffic Shaper based upon @MK4L's description of their environment.

Code Select Expand

Overview:

    Guide to build a Transparent Traffic Shaper using OPNsense.
   
    The configuration steps described here is based upon @MK4L's description of their environment.

    Some points for the keen observer;
     - The bridge interface has not been assigned in Interfaces -> Assignments and is not required.
     - This configuration can work without any PF rules applied to the WAN & LAN interfaces by adjusting one setting.

    These instructions were performed on bare-metal hardware which included the following NIC's and their assignments:
     - em0         -> [OPT1]
     - igb0        -> [LAN]
     - igb1        -> [WAN]
   
    The version of OPNsense used when creating this configuration: OPNsense 26.7.2_2 (amd64)
   
    With exception to the interface names, follow the steps verbatim and in order as listed.

Requirements:

 - Computer meets OPNsense system requirements
 - Computer has a minumum of 3 x NIC's

Assumptions:

 - The reader is familiar with configuring OPNsense
 - The computer being used for this installation is a test machine

Disclaimer:

    There may be errors or omissions in the steps below.


Priot to perfoming the following instructions, prepare your system using one of these two options.

 1) Perform a fresh installation and at the end shut down and power off the computer.
 2) Reset OPNsense settings to factory defaults.
 
First time start-up and initial configuration using LAN interface:

 - Remove all network cables from the computer
 - Power on computer
 - Wait for the computer to display the login prompt on the console.
 - Plug a network cable into the LAN port
 - Login on the console as root
 - Select option 2 - Set interface IP address
 - Enter 1 - LAN listed under 'Available interfaces'
 - Enter 'y' to assign an IPv4 address using DHCP
 - Enter 'n' to disable IPv6 WAN tracking
 - Enter 'N' to not use DHCP6
 - Press Enter to skip entering an IPv6 address
 - Press Enter to skip GUI protocol
 - Press Enter to skip GUI certificate
 - Press Enter to skip GUI access defaults
 - Log on to the WebGUI
 - Interfaces -> Neighbors -> Automatic Discovery
    - Enabled: untick
    - Click 'Apply'
 - Interfaces -> Assignments
    - Add
    - Select device from drop-down list: em0
    - Click 'Save'
    - Click 'Apply'
 - Refresh browser page (F5)
 - Interfaces -> [OPT1]
     - Enable: tick to enable the interface
    - IPv4 Configuration Type: DHCP
    - IPV6 Configuration Type: <optional>
    - Click 'Save'
    - Click 'Apply changes'
 - Firewall -> Rules
    - Edit Interface rule Default allow LAN to any rule
        - Enable 'adavanced mode'
        - Description: <optional>
        - Interface: Include 'OPT1'
        - Source: Include 'OPT1 network'
        - Disable reply-to: tick
        - Click 'Save'
    - Edit Interface rule Default allow LAN IPv6 to any rule
        - Enable 'adavanced mode'
        - Description: <optional>
        - Interface: Include 'OPT1'
        - Source: Include 'OPT1 network'
        - Disable reply-to: tick
        - Click 'Save'
        - Click 'Apply'
 - Lobby -> Logout
 - Close the browser
 - Unplug the network cable from the LAN port
 - Plug the network cable in to the OPT1 port
 - On the console select 0 to logout
 - Log back in on the console as root
 - Open a new browser to the address listed on the console for OPT1
 - Log on to the WebGUI

Complete System Configuration Wizard

 - Welcome tab
    - Click 'Next'

 - General Information tab
     - Hostname: TTS-IPFW
    - Timezone: <optional>
    - DNS servers: Enter address of internal DNS server
    - Click 'Next'

 - Network [WAN] tab
    - Disable LAN: tick
    - Block RFC1918 Private Networks: untick
    - Block bogon networks: untick
    - Click 'Next'

 - Network [LAN] tab
    - Disable LAN: tick
    - Configure IP address: clear text in field 'dhcp/'
    - Configure DHCP server: untick
    - Click 'Next'

 - Deployment type tab
    - Optimize for Multiwan: untick
    - Automatic DHCP/DNS registration: untick
    - Click 'Next'

 - Set initial password tab
    If not already changed from its default, change the Root Password.
    - Click 'Next'

 - Finish tab
    - Click 'Apply'

Configure LAN & WAN interfaces

 - Interfaces -> LAN
    - Enable: tick
    - IPv4 Configuration Type: None
    - IPV6 Configuration Type: None
    - Click 'Save'
    - Click 'Apply changes'
 - Interfaces -> WAN
    - Enable: tick
    - Block private networks: untick
    - Block bogon networks: untick
    - IPv4 Configuration Type: None
    - IPV6 Configuration Type: None
    - Click 'Save'
    - Click 'Apply changes'

Update firewall settings

 - Firewall -> NAT -> Source NAT
    - Mode: Disable Source NAT rule generation
    - Click 'Apply'
 - Firewall -> Rules
    - Edit Interface rule Default allow LAN to any rule
        - Description: <optional>
        - Interface: Deselect 'LAN'
        - Source: Deselect 'LAN network'
        - Click 'Save'
    - Edit Interface rule Default allow LAN IPv6 to any rule
        - Description: <optional>
        - Interface: Deselect 'LAN'
        - Source: Deselect 'LAN network'
        - Click 'Save'
        - Click 'Apply'

Enable sysctl options required for this configuration.

 - System -> Settings -> Tunables
    - Add
    - Tuneable: net.link.bridge.ipfw
    - Value: 1
    - Description: Layer2 filter with IPFW
    - Click 'Save'
 - System -> Settings -> Tunables
    - Add
    - Tuneable: net.link.ether.ipfw
    - Value: 1
    - Description: Pass ether pkts through firewall
    - Click 'Save'

 - Services -> Unbound -> Query Forwarding
    - Use System Nameservers: tick
    - Click 'Apply'

Add a Bridge device with description 'Traffic Shaper' and include the EGRESS and INGRESS interfaces as members and click on Save

  - Interfaces -> Devices -> Bridge
    - Add
    - Member interfaces: WAN, LAN
    - Description: Traffic Shaper
    - Click 'Save'
    - Click 'Apply'

Create firewall rule for the bridge.

 - Firewall -> Rules
    - Add
    - Enable 'advanced mode'
    - Description: Traffic Shaper
    - Interface: LAN, WAN
    - Direction: Both
    - State type: no state
    - Click Save
    - Click Apply

Create shaping pipes

 - Firewall -> Shaper -> Pipes
    - Create Download pipe
        - Add
        - Bandwidth: 4
        - Bandwidth Metric: Mbit/s
        - Description: Pipe_4Mbps
        - Click 'Save'
    - Create Upload pipe
        - Add
        - Bandwidth: 2
        - Bandwidth Metric: Mbit/s
        - Description: Pipe_2MBps
        - Click 'Save'
        - Click 'Apply'

Create shaping rules

 - Firewall -> Shaper -> Rules
    - Create Download rule for subnet 10.200.128.0/24
        - Add
        - Enable 'advanced mode'
        - Enabled: ticked
        - Interface: WAN
        - Interface 2: LAN
        - Source: any
        - Destination: 10.200.128.0/24
        - Direction: In
        - Target: Pipe_4MBps
        - Description: Shape traffic for subnet 10.200.128.0/24
        - Click 'Save'
    - Create Upload rule for subnet 10.200.128.0/24
        - Add
        - Enable 'advanced mode'
        - Enabled: ticked
        - Interface: WAN
        - Interface 2: LAN
        - Source: 10.200.128.0/24
        - Destination: any
        - Direction: Out
        - Target: Pipe_4MBps
        - Description: Shape traffic from subnet 10.200.128.0/24
        - Click 'Save'
        - Click 'Apply'

Check for updates

 - Check for OPNSense updates and install if available

Final reboot
 - Power -> Reboot
    - Click 'Yes'


Plug appropriate network cables in to the LAN & WAN ports and commence testing. Enjoy!

#4

26.7 Series / Re: Bug? firewall widget has a...

Last post by franco - Today at 04:07:24 PM

It depends on the logging settings (both the defaults set under firewall: settings: advanced or individual logging rules).


Cheers,
Franco

#5

26.7 Series / Re: os-upnp plugin not working...

Last post by franco - Today at 04:06:46 PM

Well to answer the other question first: the plugin is in community support mode and the code is still based on the static PHP pages. It's not going to get a lot of maintenance, but if patches exist like here we can do something about it.

About the NAT rule I'm not sure.  The built-in automatic rule no longer works?  Why?  This wasn't changed so it may be a FreeBSD change.  But it's also possible for people who still have a 26.1.x to test to compare the /tmp/rules.debug file to see if anything shifted between versions, which I doubt a bit, but not impossible.


Cheers,
Franco

#6

26.7 Series / Re: Bug? firewall widget has a...

Last post by hansdampf - Today at 04:03:53 PM

No, if you make the widget wider or on mouse-over you see the difference: Let out and let out (force GW). Different things. Hope that helps.

[REFUSES]

#7

26.1, 26,4 Series / How to delete a stale alias?

Last post by SmokeyJoe - Today at 03:38:35 PM

(OPNsense 26.1.11; yes, I know. It's on my todo list.)

I have a host, foo. It has a MAC alias for use in firewalls, and an IP allocated by DNSMasq. Its IP address used to be 192.168.1.250, but I recently moved it to a VLAN, and its new address is 192.168.30.254.

OPNSense refuses - REFUSES - to let go of the old address.

I've been debugging a strange connection problem - users' connections have a failure rate of about ⅓ to ½. Sometimes the connection is flawless, sometimes it fails with 'No route to host'. Watching the firewall logs, I see that sometimes the firewall will route the connection to the old IP. There's nothing there, so the connection fails.


I have tried :

• Deleting entries individually via Firewall: Diagnostics: Aliases
• Flushing via Firewall: Diagnostics: Aliases
• Exporting, editing and reloading config.xml
• Disabling and re-enabling the alias via Firewall: Aliases
• Editing or deleting /var/db/aliastables/foo.* and then rebooting

And none of these will remove the old IP. Every time I visit the Firewall: Aliases page, the stale alias is recovered from... somewhere.


My last option is to try deleting the alias entirely and recreating it, but I'm reluctant to do that since it's involved in dozens of LAN and WAN rules.


Can anyone suggest anything else?

#8

26.7 Series / Re: os-upnp plugin not working...

Last post by AlpAne - Today at 03:37:36 PM

Wow, nice find!  Took the liberty to fold this into the ports tree for tomorrow's 26.7.3:

https://github.com/opnsense/ports/commit/2616876aaa


Cheers,
Franco

Will this solve the original problem with UPnP plugin with 26.7 or do we still need to manually configure the NAT mode from automatic to hybrid and add a source NAT rule as described as a fix earlier in this thread?

#9

German - Deutsch / Re: Frage zum Domain Namens-Ma...

Last post by Tuxtom007 - Today at 03:18:25 PM

1. Also ist das normal, dass man nur eine Subdomain anlegt?
Z.B.:
IP - Hostname -> FQDN
192.168.10.68 -> pihole -> pihole.alexanderb.de

Es macht also keinen Sinn intern und extern zu trennen, indem ich für intern sowas mache:
IP - Hostname -> FQDN
192.168.10.68 -> pihole -> pihole.home.alexanderb.de

Machen kannst beides, wie die lustig bist.

Ich habs mal überlegt in der Anfangszeit auch pro VLAN eine Subdomain zu erstellen es aber dann verworfen, weil ich da wenig Sinn drin gesehen habe.
Ich nutze auch meine eigene Domain, die bei Hetzner registriert ist und das funktioniert mit der OPNSense hervorragend.
Namensauflösung mit hostname oder hostname.domain gehen beide.
Auch über VPN von aussen druaf kein Problem, wobei ich das aber selten nutze.

#10

26.7 Series / Re: UDP Broadcast Relay – Bloc...

Last post by Tinus - Today at 03:04:46 PM

I misread your question and mistakenly assumed you were using the os-mdns-repeater plugin while you are using the os-udpbroadcastrelay plugin.

That doesn't really change the story though.

This plugin does have the source IP option which appears to be a hack intended for a different purpose. I don't know how it interacts with what you are seeing from the firewall side.

But again, it doesn't change the story because even if you change the source IP address, you're still changing the address of both the queries and responses and that would not allow you to block queries while allowing responses and vice versa.