Recent posts

#1

Development and Code Review / Re: netflector available as pl...

Last post by vicking - Today at 08:48:28 PM

Nice!
Currently I run mdns repeater and ssdpreflector between my lan and iot vlan.

If I am correct I can drop these packages for this single package? :D

#2

26.7, 26.10 Series / Re: Is sloppy state tracking a...

Last post by FlyveHest - Today at 08:27:49 PM

Do you use MACVLAN for your Docker Network ?

If not : You should! :)

I don't no, but the fix was pretty easy, I just had to add another PBR rule for the Docker network bridge and now everything works as it should.

Once again, thanks a bunch for the great help, now that the basic setup is done, I can get into the fun stuff and the main reason I chose to run OPNSense.

#3

26.7, 26.10 Series / Re: issue with legacy firewall...

Last post by nero355 - Today at 08:19:37 PM

Now I have the current version 26.7.8_2 and no migration assistent anymore.

IIRC you don't even need it : Just Export and Import the Rules again and you are done ??

Deleting the old Rules can also be done via your config.xml I think ?

There was a similar topic a week ago : https://forum.opnsense.org/index.php?topic=53280.0

#4

26.7, 26.10 Series / Re: Gradual Internet Performan...

Last post by nero355 - Today at 08:13:51 PM

rc.conf:
ip6addrctl_enable = "YES"
ip6addrctl_policy = "ipv4_prefer"

OPNsense: "System: Settings: General" -> "Networking" -> "Prefer IPv4 over IPv6"

I also only use IPv4 only, with no IPv6 address assignments or discovery, and "net.inet6.ip6.auto_linklocal = 0", so I can't comment on effect.

The second setting via the webGUI solves update issues for some in certain cases, but none of those things changes anything to a Android/Apple/Linux/Windows Client ofcourse ;)

#5

26.7, 26.10 Series / Re: Is sloppy state tracking a...

Last post by nero355 - Today at 08:10:59 PM

This has unearthed a new problem, unfortunately, because the issue is still present, but only on services published through Docker.

So, this is probably because there is some form of masquerading or other package mangling happening after routing has happened, leading to the traffic still being sent out the wrong interface.

Do you use MACVLAN for your Docker Network ?

If not : You should! :)

#6

Virtual private networks / Re: Noob trying to get Wiregua...

Last post by RoWAN Tree - Today at 07:54:58 PM

I think I was in the middle of setting this part up when chat gpt messed up last week, vlan 99 doesn't have anything setup.
My laptop is running CachyOS and in network manager its a wired manual ipv4 address of the one in the photo below.

I have various manual IPS on that connection and when I switch to personal vlan 20 I just switch it to wired automatic ipv4 to receive an IP in that personal range thats shown below. I confirm it does receive an IP ending between 20.100 - .20.200

Im still learning how IPs work, If I set it up like the rest of ranges ie: x.x.99.100-x.x.99.200 wont that exclude the manual laptop IP  192.168.99.10 because its lower than .99.100?

For the Xbox vlan I will have to check that to make sure.
 

#7

26.7, 26.10 Series / Re: Messages in firewall log w...

Last post by vimage22 - Today at 07:52:30 PM

Is this related to issue? No label? All firewall logging rules are disabled.

#8

Virtual private networks / Re: Noob trying to get Wiregua...

Last post by RoWAN Tree - Today at 07:40:58 PM

If it can help someone else too its cool with me, whenever I'm online looking how to do whatever it is, I like tutorials and troubleshooting with screenshots too makes it easier for everyone 😅 especially for an entry level person like myself.

 I might not know all the technical stuff or have the skills, but I know that privacy, self learning, open sourced information is vital to humanity in the digital age, why not learn


I've followed what you said and double checked those command lines as well as browser DNS settings. (screenshots below)

I'm not sure what any of that means 🤔😅

#9

26.7, 26.10 Series / Re: Is sloppy state tracking a...

Last post by FlyveHest - Today at 07:00:46 PM

Sounds like A-Symmetric Routing issues and the "Default DENY / State violation Rule" is always right in my experience :)

It seems like it's time to apply Policy Base Routing on your Server then :)

Thank you so much, this was the problem, and as I already had a bit of PBR in place it was quick to add a few rules more.

I have tested with a SSH connection that timed out previously, and now works as it should. (Prior I could tcpdump return traffic on the wrong interface, and after the PBR, the traffic was only visible on the correct one)

This has unearthed a new problem, unfortunately, because the issue is still present, but only on services published through Docker.

So, this is probably because there is some form of masquerading or other package mangling happening after routing has happened, leading to the traffic still being sent out the wrong interface.

#10

Intrusion Detection and Prevention / Re: abuse.ch rulesets not down...

Last post by jmw - Today at 06:45:55 PM

Since 26.7.8 you can paste your API Token at the end of the Download Section.

Ah, that's what I missed. Thank you.