Recent posts

#1

General Discussion / Dnsmasq DNS DHCP

Last post by bookie56 - Today at 01:17:09 PM

Hi guys!
I have had a lot to do recently but wanted to get back to OPNSense to have things setup right:
I have mendtioned before that I have a Intel 49Y4242 IBM Ethernet Quad Port Server Card 94Y5167 49Y4241 low Profile
I use the inbuilt nic for my WAN
The 4 port nic is setup as follows:
Private_LAN
Company_LAN
Private_wifi
Company_wifi
I obviously could have created vlans to do the same job but having the 4 port network card saved that work....
Each port has its own subnet for that network..
To stop my company lan and wifi from talking to private lan and wifi I setup an alias...
Not sure if I did it the right way..
I called it private_networks and in content I added the two private subnets...
The rest as default and saved.
I then created firewall rules to stop the private and company networks from talking to each other..

I then Went to  Dnsmasq DNS & DHCP:
General I chose all interfaces apart from WAN
The DNS Listen Poort: 53053
I setup DHCP Ranges for:
Private_LAN: 192.168.11.100 - 192.168.11.200
Company_LAN: 192.168.12.2  - 192.168.12.20
Private_wifi: 192.168.13.100 - 192.168.13.200
Company_wifi: 192.168.14.2 - 192.168.14.20
And that is as far as I have come....
I really don't know how to setup the DHCP Options?
Can someone give me examples from the above configuration?
Should I have done something different?
I am open to suggestions and learning how everything works....


bookie56

#2

German - Deutsch / Re: DNS Setup mit Unbound, DNS...

Last post by JeGr - Today at 12:51:03 PM

Dazu kommt doch, dass wir uns in dieser Runde hier gerade innerhalb von Deutschland unterhalten, jedenfalls meistens. Hier ist immer noch ein Rechtsstaat und es gilt die DSGVO. Von welchen ISPs reden wir denn bitte schön?

Was glaubst du wie die Kacke am Dampfen ist, wenn Telekom oder Vodafone dabei erwischt werden, wie sie shady Zeug mit dem Verkehr ihrer ISP-Kunden machen ...

Korrekt :)

Haben die nicht mal Malware-Filter eingebaut, ohne zu fragen, und das gab einen ziemlichen Shitstorm? Jedenfalls ist "Security on net" bei der Telekom heute erhältlich und optional. Kann ja jedes halten wie sie möchten.

Jein. Der eine der beiden hatte mal "versucht" DNS zu filtern und hat dafür eine ziemliche Klage als Brett aufs Maul bekommen. Der ANDERE der beiden war "so frei" und hat Kunden bei "DNS nicht gefunden" (NXDOMAIN) einfach seine eigene DrecksSuchmaschine untergejubelt und damit die DNS Antwort von "nicht vorhanden" auf "gibts -> bitte hier lang" verfälscht, was DNS Poisoning ist und noch dazu abgreifen von Daten (was hat mein Kunde da gesucht/eingegeben) etc. etc. - wofür sie auch aufs Brett und ne Klage bekommen haben.

Also gerade WEIL sie das schon versucht haben und krachend gescheitert sind, weiß man, dass aktuell bei uns wenigstens noch halbwegs unsere DSGvO und Rechtssprechung greift. Auch wenns diverse Kandidaten immer wieder aufs Neue versuchen (siehe Vorratsdatenspeicher, aber-denk-doch-wer-an-die-Kinder DNS Sperren und Co).

[AdGuard]

#3

German - Deutsch / Re: [Gelöst] Unbound-DNS Erw...

Last post by JeGr - Today at 12:45:59 PM

Ich kann da wie Patrick auf meine Kommentare zu diesem Thread verweisen:

https://forum.opnsense.org/index.php?topic=50075.msg274087#msg274087
und
https://forum.opnsense.org/index.php?topic=50075.msg274498#msg274498

Dazu das DoHoT Projekt von Alec Muffett, der das ganze Thema DoH, DoT, DoQ und Co mal auseinander genommen hat und zum Schluß kam: wenn du WIRKLICH superverschlüsselt, hochsicher, DNS machen willst, dann gehts nur via DoH+Tor, damit sich die DoH Requests wie TOR HTTPS Traffic in der Masse tarnen können. Und das ist für die meisten absoluter Overkill. Was aber dabei interessant rauskam: das ganze Rat-Race mit "ich hab die schnellsten ms Auflösung in DNS" ist quark und du spürst davon in der Praxis kaum was. Ob jetzt dein Browser beim Webseiten-Aufruf 1x von 10x ein wenig länger braucht (ca. 500-600ms) und danach durch den Unbound Cache der Rummel dann in <1ms läuft merkst du in der Praxis kaum. Einzig bei selten aufgerufenem Kram mag das vllt mal spürbar sein, aber das geht in der Load unter.

Dann noch ein kleines Wort zu Patricks Empfehlung wegen AdGuard:

AdGuard (Home) und PiHole mögen die OldSchoolers sein, was DNS Blocking angeht, aber sie machen ihren Job absolut hocheffizient mittels dnsmasq (oder Fork davon) im Unterbau! Ich habe mal in einer unserer Freitagsrunden an denen wenig los war und kaum jemand Zeit hatte mit den 2-3 Leuts die da waren ein Experiment gemacht: Mein aktuelles PiHole Setup mit allen Blocklisten auf eine der gehypten anderen DNS Lösungen versucht zu portieren. Auch auf Unbound selbst:

Das war ernüchternd! Egal ob Unbound roh, Technitium, Blocky, CoreDNS und wie die ganzen hippen DNS Tools alle heißen: die meisten, die ich auf die schnelle mal durchspielen konnte, sind einfach an meinen Blocklisten verzweifelt im Sinne von "haben so viel RAM gefressen bis sie gestorben sind". Warum ist das relevant? Weil AdGuard und PiHole bspw. mit <1GB RAM problemlos klar kommen, da DNSmasq die Blocklisten einliest und (ich kann jetzt nur praktisch von PiHole sprechen) hasht und in schnell-durchsuchbaren Indexbäumen speichert (gravityDB). AdGuard macht da m.W. was sehr ähnliches. Dadurch können die Tools Millionen! Einträge an Domains in ein paar MB RAM abrufen. Die anderen neuen hippen DNS Tools, die alle mit so-viel-toller-Featuritis daher kommen, versuchen die ganzen Listen in den RAM zu laden und (wenn meine TestVM zu klein ist) scheitern dann und der Prozess stirbt. War gerade bei Unbound, Blocky & Technitium sehr deutlich sichtbar mit Ladekurve, RAM steil hoch, BÄM, tot, OOM-Killer.

TL;DR: wenn du ordentlich GROSSE Blocklisten hast (-> bspw. Gerds HaGeZi Pro(++) o.ä.) kommst du schnell auf 10-20Mio Domains die da auf deiner Blockliste stehen und da säuft dir entweder deine Firewall Hardware RAM wie nix Gutes weg, oder du nimmst dafür ein Tool, was den Kram in ein paar Hundert Megabyte abfrüstückt. Daher AdGuard (als Plugin auf der Sense selbst) oder intern eben einen PiHole/Adguard vorschalten (als kleinen Container o.ä. irgendwo draufgepackt) und den per DHCP dann als DNS announcen und dort dann als Upstream den Unbound der Firewall eintragen, damit dort dann das saubere Resolving läuft (statt das einfach alles zu forwarden zu irgendjemandes(TM) DNS Server).

Vorteil: Resilienz! Ich hab bei sauber laufendem Konstrukt aus PiHole + Unbound(resolver) selten irgendwelche DNS Calls die fehlschlagen oder Zensur anzeigen.

Cheers :)

#4

German - Deutsch / Re: ICMP-Block auf Gateway und...

Last post by JeGr - Today at 12:26:49 PM

Und wo ist da ne Regel für ICMP? Ich seh nur UDP und TCP?
In dem Firewall / Rules (new) Screenshot ist ein Haufen Geraffel drin, aber keine einzige Regel mit Protokoll "*" oder ICMP.
Wie soll dann Ping/ICMP funktionieren? :)

Cheers

#5

German - Deutsch / Re: ACME all-inkl DNS-01 Chall...

Last post by JeGr - Today at 12:16:50 PM

Ich würde generell mal die DNS Sleeptime auf 150-300s stellen. 180 genügt normalerweise.

Grund: acme.sh versucht bei Werten von (ich meine) <120 DoH zu machen um DNS TXT Einträge zu verifizieren. Hat man DoH geblockt, die IPs, die DNSe oder irgendwas davon - klappt die Verifikation nicht. Hat man einen Provider, dessen DNSe etwas langsam aktualisieren - klappt die Verifikation nicht. Daher stell ich bei den meisten Systemen inzwischen auf 180s ein. Das ist u.a. auch im Wiki/Doku von acme.sh so dokumentiert, dass bei kleinen Werten das Skript DoH versucht, bei großen Wartezeiten wird dagegen dann klassisch ein normaler DNS Call gemacht.

Cheers

#6

General Discussion / Re: Caddy + Let's Encrypt , ce...

Last post by Monviech (Cedrik) - Today at 12:08:14 PM

Did you create the additional domains in the Subdomains grid, and in the Handler did you select both the wildcard domain and the subdomain?

Cause it looks like the shared certificate config isn't attached to the subdomains you configured.

#7

26.7 Series / Re: How to enable/disable webg...

Last post by jonm - Today at 11:36:20 AM

Thanks for all the suggestions, will do some testing...

#8

Tutorials and FAQs / Cannot install fish shell on O...

Last post by klandestine - Today at 10:49:20 AM

OPNsense:~ # pkg install fish
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
pkg: No packages available to install matching 'fish' have been found in the repositories                                                                                 


It seems the standard OPNsense repository does not include the fish package by default. What is the proper or recommended way to install fish shell on OPNsense without breaking core dependencies?

Thanks in advance for your help!

#9

26.7 Series / Re: Wireguard vs. DNS resoluti...

Last post by Bob.Dig - Today at 10:41:51 AM

But while it works it's a quite cool setup

I don't think so. None the less, what happens if you don't monitor the gateway? There is often no point in monitoring it anyway.   

#10

General Discussion / Re: Caddy + Let's Encrypt , ce...

Last post by Pete5 - Today at 08:39:26 AM

My caddy log file

Code Select Expand

2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "info","ts":"2026-10-24T05:35:49Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:49 Error caddy "debug","ts":"2026-10-24T05:35:49Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "info","ts":"2026-10-24T05:35:12Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:12 Error caddy "debug","ts":"2026-10-24T05:35:12Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "info","ts":"2026-10-24T05:32:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:32:30 Error caddy "debug","ts":"2026-10-24T05:32:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:31:25 Warning caddy "warn","ts":"2026-10-24T05:31:25Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "info","ts":"2026-10-24T05:24:53Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:24:53 Error caddy "debug","ts":"2026-10-24T05:24:53Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:18:08 Warning caddy "info","ts":"2026-10-24T05:18:08Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Error caddy "debug","ts":"2026-10-24T05:18:08Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "info","ts":"2026-10-24T05:11:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:11:30 Error caddy "debug","ts":"2026-10-24T05:11:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "info","ts":"2026-10-24T05:03:24Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:24 Error caddy "debug","ts":"2026-10-24T05:03:24Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "info","ts":"2026-10-24T05:03:22Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:22 Error caddy "debug","ts":"2026-10-24T05:03:22Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "info","ts":"2026-10-24T05:01:41Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}



Unintentionally i posted the logfile twice, sorry for that.