Recent posts

#1

Virtual private networks / Re: Issue with multiple wiregu...

Last post by Unsocial_Firewall - Today at 10:48:39 PM

Thanks a lot! Yup, everything seems to work for now, and I'll do some more testing.

Sure, why not, if it is working.

Well, I barely know anything about WireGuard, so I don't know all the ramifications of changing the provided subnet from /32 to /30.


The ipv6 works now aswell but there still is no static route for 10.2.0.1... (Even though it's the monitor ip)

[Broadcasts]

#2

Development and Code Review / Re: netflector available as pl...

Last post by UnicronHD - Today at 10:44:10 PM

Thanks for the detailed answer! The diretions are right, I have now made the changes you suggest and will report back after a while of testing. For now the Sonos app doesn't see the speakers, but I will give it a while before the changes become active.

To mention, I didnt make any specific firewall rules for it.

Edit: Aaaand bam, there are the speakers again in the app. Started to work after the change in Netflector! :D
One thing, do I also need to tick "Broadcasts"?

For now, thanks for this!

Good to hear. Leave Broadcasts off: SSDP goes to the multicast group, and changing one thing at a time tells us what fixed it. Your old setup only failed now and then, so give it a couple of days before we call it solved.

The wait right after the change may come from the firewall. With the relay, the speakers answer the app's searches directly, as new traffic from the Sonos VLAN to the phone's VLAN. If no rule on the Sonos VLAN interface passes it, those answers are dropped and the app has to wait for the speakers' own periodic announcements. Firewall > Log Files > Live View shows such drops as blocked UDP from the speakers to the phone. If you see them, add a pass rule on the Sonos VLAN interface for UDP from the speakers to the phone's network.

#3

Virtual private networks / Re: Issue with multiple wiregu...

Last post by Bob.Dig - Today at 10:43:30 PM

at a time sets an additional route to the gateway/DNS address.

Monitor IPs get a route added automatically.

Can I leave them like this?

Sure, why not if it is working.

so I should also just change this 2a07:b944::2:2/128 to /126?

Never done it myself (IPv6 VPN) but it is looking good to me.

#4

Virtual private networks / Re: Issue with multiple wiregu...

Last post by Unsocial_Firewall - Today at 10:23:01 PM

The tunnel IP for the first instance, 10.2.0.1/32, did set the route properly until I disabled the static routes.

I changed the tunnel IP from 10.3.0.1/32 to /30 .

I'm a bit confused: the routes now look correct, and everything works when I set both the first and second instances to a /30 subnet.

For some reason, only a single WireGuard instance at a time sets an additional route to the gateway/DNS address. Right now it's 10.3.0.1; before, it was 10.2.0.1. I am not using any manual routes right now.

My routes now look like this:

Code Select Expand

10.2.0.0/30        link#14            U               wg0
10.2.0.2           link#3             UHS             lo0
10.3.0.0/30        link#15            U               wg1
10.3.0.1           link#15            UHS             wg1
10.3.0.2           link#3             UHS             lo0


Can I leave them like this?  also I have issues with an additional third ipv6 wg so I should also just change this 2a07:b944::2:2/128 to /126?

#5

26.7, 26.10 Series / Re: Liveview not updating afte...

Last post by cookiemonster - Today at 10:05:58 PM

working fine here. Firefox 159.0.1 on MS Win 10, the client I had available now.

#6

26.7, 26.10 Series / Re: what causes this? [zone: p...

Last post by nero355 - Today at 09:49:13 PM

Should i go higher?

Restore it to the default value and have a look at your MTU settings for the connection or use MSS Clamping seems to be the way to fix it after a quick search on the internet :)

What is going on with my router? Any tips?

Have a look at this : https://forum.opnsense.org/index.php?topic=21207.0
And apply whatever could work for you and see if it helps...

#7

26.7, 26.10 Series / what causes this? [zone: pf fr...

Last post by XxTriviumxX - Today at 08:54:58 PM

mEver since i got my n150 opnsense router, i see this message multiple times a week when i plug it to a monitor:


[zone: pf frag entries] PF frag entries limit reached


I raised Firewall Maximum Fragments 3-4 times. Every time i bump it up, it would stop showing any messages (on screen) for 1-2 weeks. After a while i have to bump it up again since it comes back. It is now set at 15000. Should i go higher? What is going on with my router? Any tips?

For further info: i use intel nics, and the mini pc has 16gb ram. Im on the latest version 26.7.9_1.  I bypassed my IPS router with a XGSPON OLT stick with a fan and i convert the fiber to ethernet with a switch. I use crowdsec's default protection with no IPS/IDS. I also use qfeeds. Let me know if you need more info on my case!

#8

Virtual private networks / Re: Issue with multiple wiregu...

Last post by Bob.Dig - Today at 08:22:54 PM

Make the Tunnel address 10.3.0.2/30.

#9

General Discussion / Re: Unbound blocklist question

Last post by sopex - Today at 07:51:06 PM

Yes, OPNsense moved a few months ago from getting them directly from GitHub to using the mirror. https://github.com/opnsense/core/pull/10709

#10

Virtual private networks / Re: Issue with multiple wiregu...

Last post by Unsocial_Firewall - Today at 07:44:22 PM

Just to clarify: the first instance has never had any issues, while for the second one I'm using the gateway/DNS address (10.3.0.1) as the monitoring target.

I did everything again from the guide, just for the second instance, so the settings should not overlap.

The Wireguard handshake also does not appear to be the source of the problem