"Recent posts
#1
26.7 Series / Re: WAN/PPPOE connection fail...
Last post by dseven - Today at 09:40:01 AMYou're conflating issues quite a bit (PPPoE, DNS on the firewall itself, DHCP, ...)
Kea DHCP won't affect how the firewall itself accesses DNS services, but FYI anyway; if you want to set explicit DNS servers or router for a subnet in Kea, you'd need to uncheck "Auto collect option data".
If you want to try specifying the DNS servers that the firewall itself uses, you might want to check "Do not use the local DNS service as a nameserver for this system" as well (at System -> Settings -> General). If that allows the firewall itself to resolve DNS names, you have some issue with Unbound. If it doesn't, perhaps your ISP blocks access to DNS other than their own servers? What was your DNS configuration before the problem started?
Kea DHCP won't affect how the firewall itself accesses DNS services, but FYI anyway; if you want to set explicit DNS servers or router for a subnet in Kea, you'd need to uncheck "Auto collect option data".
If you want to try specifying the DNS servers that the firewall itself uses, you might want to check "Do not use the local DNS service as a nameserver for this system" as well (at System -> Settings -> General). If that allows the firewall itself to resolve DNS names, you have some issue with Unbound. If it doesn't, perhaps your ISP blocks access to DNS other than their own servers? What was your DNS configuration before the problem started?
#2
26.7 Series / Re: WAN/PPPOE connection fail...
Last post by meyergru - Today at 09:30:29 AMIf your observations are correct, that makes two problems:
1. OpnSense cannot resolve DNS names.
2. Your former ISC DHCP does not work any more.
Obviously, the former version was not 26.7-based, but probably much earlier. There were several serious changes from, say, 25.x to 26.7., including which DHCP is preferred.
Thus, you essentially have two options:
a. Install the os-isc-dhcp plugin to restore your ISC DHCP setup - while it is EOL, this will give you local subnets again, solving point 2.
For point 1, I would first try to chec if "nslookup www.google.com 8.8.8.8" from the CLI of your OpnSense works, verifying WAN access. Then you can try to use Google DNS for OpnSense and Unbound.
b. Follow along the DNSmasq instructions from the docs, preferably on a fresh install to rule out other/older DNS or DHCP services blocking DNSmasq. If you switch DHCP, your reservations or internal DNS names will not be carried over automatically with either DNSmasq or Kea, anyway. There are external scripts to do that, but with a normal installation, it is probably better to do it manually.
I would prefer to start from scratch in your situation, because even the firewall and NAT rules have been changed. The jump from your old version to the current one is too far to justify the migration effort. I think it is easier to start fresh, maybe you can jot down or print out the relevant old rules and DHCP reservations first.
1. OpnSense cannot resolve DNS names.
2. Your former ISC DHCP does not work any more.
Obviously, the former version was not 26.7-based, but probably much earlier. There were several serious changes from, say, 25.x to 26.7., including which DHCP is preferred.
Thus, you essentially have two options:
a. Install the os-isc-dhcp plugin to restore your ISC DHCP setup - while it is EOL, this will give you local subnets again, solving point 2.
For point 1, I would first try to chec if "nslookup www.google.com 8.8.8.8" from the CLI of your OpnSense works, verifying WAN access. Then you can try to use Google DNS for OpnSense and Unbound.
b. Follow along the DNSmasq instructions from the docs, preferably on a fresh install to rule out other/older DNS or DHCP services blocking DNSmasq. If you switch DHCP, your reservations or internal DNS names will not be carried over automatically with either DNSmasq or Kea, anyway. There are external scripts to do that, but with a normal installation, it is probably better to do it manually.
I would prefer to start from scratch in your situation, because even the firewall and NAT rules have been changed. The jump from your old version to the current one is too far to justify the migration effort. I think it is easier to start fresh, maybe you can jot down or print out the relevant old rules and DHCP reservations first.
#3
26.7 Series / Re: Unbound stopps suddenly
Last post by DEC740airp414user - Today at 09:24:29 AMUnder logs is this listed under warning or error?
#4
German - Deutsch / Re: IDS
Last post by johnydo - Today at 08:55:39 AMQuote from: Patrick M. Hausen on Today at 08:50:19 AMDu greifst über die Firewall hinweg auf Shares zu?
Es gibt hier ein Englischsprachiges Subforum speziell zu IDS/IPS-Themen, da kann man dir evtl. eher helfen. Ich nutze den Kram nicht.
Vermutung: es gibt irgendwelche Patterns/Regeln, die man ausschalten kann, und dann funktioniert es wieder ;-)
Hi,
ja, das Filesystem steht in der DMZ daher läuft es über die Firewall. Ja, gelesen habe ich das schon das man da auch ein Regelwerk erstellen kann mit Ausnahmen usw.. Ich habe aber auch noch so gut wie nichts mit IDS gemacht daher habe ich hier die Frage eingestellt :). Ich schaue auch mal in dem anderen Subforum vorbei...
#5
German - Deutsch / Re: IDS
Last post by Patrick M. Hausen - Today at 08:50:19 AMDu greifst über die Firewall hinweg auf Shares zu?
Es gibt hier ein Englischsprachiges Subforum speziell zu IDS/IPS-Themen, da kann man dir evtl. eher helfen. Ich nutze den Kram nicht.
Vermutung: es gibt irgendwelche Patterns/Regeln, die man ausschalten kann, und dann funktioniert es wieder ;-)
Es gibt hier ein Englischsprachiges Subforum speziell zu IDS/IPS-Themen, da kann man dir evtl. eher helfen. Ich nutze den Kram nicht.
Vermutung: es gibt irgendwelche Patterns/Regeln, die man ausschalten kann, und dann funktioniert es wieder ;-)
#6
German - Deutsch / IDS
Last post by johnydo - Today at 08:38:51 AMHallo zusammen,
da meien OPNsense nun schon einige Tage läuft habe ich mich mal mit dem IDS befasst. Generell läuft IDS und ich habe es wie auf dem Screenshot eingerichtet.
Eine Sache stört mich aktuell noch und ich wollte fragen ob jemand den Fehler kennt und wie ich diesen beheben kann. Und zwar stürzt mein Windows Explorer ab wenn ich auf Netzlaufwerke zugreife. Ok, das ist schon fast eine Standardfunktion vom Windows-Excplorer abzustürzen ;). Spaß beiseite...wenn ich IDS deaktiviere habe ich das verhalten nicht, sobald ich es aktiviere passiert es. Und zwar "friert" der Windows-Explorer ein und nach ca. 10 Sekunden funktioniert wieder alles. Wenn ich dann einen Ordner wechsele passiert wieder das gleiche.
da meien OPNsense nun schon einige Tage läuft habe ich mich mal mit dem IDS befasst. Generell läuft IDS und ich habe es wie auf dem Screenshot eingerichtet.
Eine Sache stört mich aktuell noch und ich wollte fragen ob jemand den Fehler kennt und wie ich diesen beheben kann. Und zwar stürzt mein Windows Explorer ab wenn ich auf Netzlaufwerke zugreife. Ok, das ist schon fast eine Standardfunktion vom Windows-Excplorer abzustürzen ;). Spaß beiseite...wenn ich IDS deaktiviere habe ich das verhalten nicht, sobald ich es aktiviere passiert es. Und zwar "friert" der Windows-Explorer ein und nach ca. 10 Sekunden funktioniert wieder alles. Wenn ich dann einen Ordner wechsele passiert wieder das gleiche.
#7
General Discussion / Zabbix REST API Template for O...
Last post by Garfieldttt - Today at 08:28:19 AMSince I couldn't find a proper Zabbix template for the OPNsense API, I decided to create my own.Since I couldn't find a proper Zabbix template for the OPNsense API, I decided to create my own.
- IPsec: Phase 2 was previously requested via a GET request, even though the endpoint reads the connection via getPost('id'). This caused Phase 2 to remain empty for all systems – this is now fixed.
- CARP: CARP discovery resulted in an error on firewalls without CARP, even though an empty list is the correct response there.
- System: CPU utilization (split into user, system, and interrupt), memory, kernel network memory, mbuf clusters, netisr queues, swap space, and temperature.
- Performance: CPU load per core, clock synchronization, filesystems, and UPS status.
- Packet Filter (pf): State and source tracking tables including limits, pf counters, table entries, and the loaded ruleset with change detection.
- Network & Interfaces: Traffic, errors, link state, and blocked packets per interface, protocol errors, and gateways.
- VPN & Services: CARP, IPsec (including Phase 2 per connection), WireGuard, OpenVPN, system services status, Unbound DNS resolver, and DHCP leases.
- Security & Maintenance: Certificate expiration and firmware status.
- ... and much more!
The template is ready for Zabbix version 7.0 and higher. In my opinion, version 7.4 does not bring any significant advantages for this template. Therefore, I chose the LTS version 7.0 to ensure the highest possible compatibility.
I hope this template turns out to be useful for some of you!
https://github.com/Garfieldttt/opnsense-zabbix-template
- IPsec: Phase 2 was previously requested via a GET request, even though the endpoint reads the connection via getPost('id'). This caused Phase 2 to remain empty for all systems – this is now fixed.
- CARP: CARP discovery resulted in an error on firewalls without CARP, even though an empty list is the correct response there.
- System: CPU utilization (split into user, system, and interrupt), memory, kernel network memory, mbuf clusters, netisr queues, swap space, and temperature.
- Performance: CPU load per core, clock synchronization, filesystems, and UPS status.
- Packet Filter (pf): State and source tracking tables including limits, pf counters, table entries, and the loaded ruleset with change detection.
- Network & Interfaces: Traffic, errors, link state, and blocked packets per interface, protocol errors, and gateways.
- VPN & Services: CARP, IPsec (including Phase 2 per connection), WireGuard, OpenVPN, system services status, Unbound DNS resolver, and DHCP leases.
- Security & Maintenance: Certificate expiration and firmware status.
- ... and much more!
The template is ready for Zabbix version 7.0 and higher. In my opinion, version 7.4 does not bring any significant advantages for this template. Therefore, I chose the LTS version 7.0 to ensure the highest possible compatibility.
I hope this template turns out to be useful for some of you!
https://github.com/Garfieldttt/opnsense-zabbix-template
#8
26.7 Series / Re: can't find where to delete...
Last post by Patrick M. Hausen - Today at 07:21:44 AMNo, you have a DHCP range from .24 to .24. In that case you probably cannot use the same address as a static assignment. My guess - I'm running Kea, not DNSmasq.
#9
26.7 Series / Re: Make my backup history saf...
Last post by Roger@Opnsense - Today at 03:39:48 AMMaybe even rm /conf/backup/*.xml would be a safer implementation of the flush operation ?
#10
26.7 Series / Re: Make my backup history saf...
Last post by Roger@Opnsense - Today at 03:25:58 AMThanks for all the feedback!
Yes, it was os-git-backup that I have been using, but only with a local repo in /conf/backup/git, which unfortunately I had not cloned elsewhere.
It sounds like the symlink idea is worth testing. I can at least build a new repo using the backups I have made through the GUI, since those are stored on a different machine and give me a reasonable amount of history on their own.
I guess it also makes sense for me to add a nightly cron job to do an additive rsync of /conf/backup to another machine, since it sounds like I cannot uncheck this option and make that setting stick.
I do feel that the "Flush (full) local configuration history" option should be off by default, though. I would not normally expect a restore operation to destroy the history that would allow me to undo that restore.
I could also envisage a workflow where you roll back to an older configuration temporarily and then want to roll forward again. Flushing the history makes that impossible unless you have another copy elsewhere.
Yes, it was os-git-backup that I have been using, but only with a local repo in /conf/backup/git, which unfortunately I had not cloned elsewhere.
It sounds like the symlink idea is worth testing. I can at least build a new repo using the backups I have made through the GUI, since those are stored on a different machine and give me a reasonable amount of history on their own.
I guess it also makes sense for me to add a nightly cron job to do an additive rsync of /conf/backup to another machine, since it sounds like I cannot uncheck this option and make that setting stick.
I do feel that the "Flush (full) local configuration history" option should be off by default, though. I would not normally expect a restore operation to destroy the history that would allow me to undo that restore.
I could also envisage a workflow where you roll back to an older configuration temporarily and then want to roll forward again. Flushing the history makes that impossible unless you have another copy elsewhere.
