Recent posts

#1

General Discussion / Re: nfSensei ( fork pfsense )

Last post by Greg_E - Today at 04:03:00 PM

nfSensei is not a fork.  The developer of nfSensei, Scott Ullrich was involved with forking Monowall many years ago which became pfSense. 

You are right, I went back to the blog to look at history. This is a clean sheet in Rust with an adaptation of PF for Linux.

#2

Zenarmor (Sensei) / Re: Am I missing something or ...

Last post by Greg_E - Today at 03:54:49 PM

You are not wrong, waiting for a quote to be returned because what was once $1000usd turned into $4000usd. It's almost like they are going to kill the OPNsense plugin and push you to set up a dedicated server. It might be better performance, but it absolutely prices places like my work out of being possible.

#3

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by tuto2 - Today at 03:53:50 PM

I don't have any further insight or experience to contribute at this stage, but what module coding and link partners have been tested? We don't have a non-production DEC appliance, but we do have DACs, AOCs, and SR/LR SFP28 modules on hand that we can recode at will, so if there's a specific combination that hasn't been tested (or needs validation) I might be able to provide another test case.

This was tested with a connection to a separate desktop machine (debian) also running an E810 expansion card. Modules tested were the ones as listed in the documentation: https://docs.opnsense.org/hardware/sfp_compatibility.html#ice.

Testing the combinations isn't going to be as useful as the amount of products in the wild are going to vary quite a bit, and 25G connectivity gets expensive, fast.

Since you are able to reproduce it, it would be great if you could re-test once we have something to offer.

#4

26.7, 26.10 Series / No health graphs since 26.7.8 ...

Last post by szty0pa - Today at 03:36:00 PM

Hi,

Health graphs stopped being collected for me on multiple (different AMD-based) boxes since the 26.7.8 update. I have reset the RRD data, there are no graphs since then either. I saw that there had been changes to this in the update. Does anyone else have such problems? If time allows please do have a look at the updated data collection code.

Thanks!

#5

26.7, 26.10 Series / Re: Messages in firewall log w...

Last post by mooh - Today at 03:06:40 PM

It just realised that the routes entered by NDP proxy don't go away when an interface is removed from the config. To me, that's a clear indication that the communication is expected to stop and the routes should go away. But I agree that routes should not be removed when stopping / restarting the proxy.

Not terribly important though ...

#6

26.7, 26.10 Series / Re: PPPoE over an unassigned V...

Last post by franco - Today at 02:08:39 PM

Hi,

Yes, sorry for dropping the ball here somewhat.  I prepared some changes for PPPoE today to defer dialling to after bootup completes (which is already on the development branch).  Most of the backports will be in 26.7.9 on Wednesday.  I'll then do a call for testing on that defer dialling patch.  Feel free to ping again as soon as 26.7.9 is out.


Cheers,
Franco

#7

Zenarmor (Sensei) / Re: Cancelling my subscription...

Last post by Timeraider - Today at 01:40:01 PM

Support was great and the software is amazing for very specific blocking of applications, easy zero-trust networking and  domain blocking and allowing within 1-2 clicks.

But I have to say that I will not be renewing either.
Now I have to say that I do not have kids (which will put more significance on the easy blocking of sites and categories) so that might influence my choice.

However there were a few things I realised.

1. Zenarmor is focussing more towards business. Which is fine and their choice .. I would do the same if most of the revenue would come from there, but im not a business so im becoming "not the target audience". Every update, more settings get added that give an popup regarding subscription upgrading.

2. How many features do I actually use? Most of the reports/dashboards etc. etc. are fully unused. What did I use? Well, the easy blocking of entire categories etc. However after keeping track of it for a few months, I realised that almost all Zenarmor blocks basically came down to:
- Websites being seen as empty, but actually legitimate websites that host static content or redirects to payment providers.
- Telemetry calls from IoT devices. Which came down to either allow it or block it and have Zenarmor logging be 100% filled by 1-2 blocks per second

3. Zenarmor was bashing my SSD to death. Never realised it but after wanted to replace a disk a few days ago and checking the drive health. Zenarmor was responsible for 80-90% of writes to the drive and was writing 90GB/day. That basically brings a disks lifetime from 100 years to 10 :P

This mostly started becoming more relevant after I started self-hosting an self-created applications with SIEM/SOC and dashboard capabilities meaning that the entire "overview" idea of Zenarmor wasnt needed anymore.

So yeah.. felt like the entire solution didnt add much anymore.
Qfeeds, Crowdsec, UnboundDNS and just to make sure Suricata ... outside of being able to toggle on/off Tiktok or whatever with a click, its just not worth the money and problems anymore for me.

#8

German - Deutsch / Re: OPNsense VM klonen, irgend...

Last post by sternchen45 - Today at 01:23:17 PM

ah, VM - das hatte ich überlesen. Danke!

#9

High availability / Re: CARP - Preventing individu...

Last post by Patrick M. Hausen - Today at 11:47:32 AM

So is there a way to handle a Split Brain Situation or would this be a limitation of HA?

There is of course the concept of STONITH - one of my favourite IT acronyms: shoot the other node in the head.

So whichever node first decides that a failover happened and it has become the new primary actively disables (power off, shutdown switch port, ...) the other node to prevent split brain.

Of course this needs operator attention, a diagnose, and a manual restore of the HA state, afterwards. So it is not very common. I cannot think of a mechanism in OPNsense that could do this easily with the tools present today.

"Serious" HA/cluster solutions like e.g. Galera for MariaDB/MySQL or Elasticsearch require at least three nodes to have a reliable quorum without the risk of split brain.

I also know of no implementations for networking that would go that route. HA routing for example is quite easily achieved by some IGP (e.g. OSPF), some EGP (e.g. BGP4) and VRRP/HSRP/CARP for the client facing interfaces. If the links between the two nodes are dedicated ports with simple cables/fibres and are redundant (two of them) to begin with, a split brain situation is highly unlikely.

For example in case you have occasional switch outages you migh want to consider connectiong each OPNsense in your pair via a pair of LCAP interfaces to a pair of two separate switches capable of multi chassis LCAP (MLAG). Then configure every single security zone as a VLAN over that redundant link.

This would give you layer 2 failover - but it's another level of complexity and there are interoperability issues with fast (1s) LACP timeout across vendors, so the most reliable configuration is slow (30s) ones. I don't know if 30s failover time in the worst case is quick enough for you. Then again, STP is 30s in its default configuration, too, so ...

HTH,
Patrick

#10

Russian - Русский / Re: os-xray — плагин Xray-core...

Last post by Spylive - Today at 10:45:57 AM

Добрый вечер. Оставляю восторг работе!!!!По переключал всё вдоль и поперёк все инстансы всё ХОР.!!! За исключением тех которые не работают и в HAPP на android,но это проблема на vps.ВОПРОС- Как внедрить auto ping и авто переключение между лучшем пингом?

Автоматический выбор не планировал делать, как и работу по спискам. В основном это делалось для работы на актуальной версии opnsense через свой VPS сервер.
Сейчас РКН активно блокирует личные VPS, но я работаю через цепочку VPS и специально использую выходным сервером уже заблокированный в РКН и это позволило мне уже несколько месяцев обходить блокировку.

Это как? Каким то каскадом? У меня сейчас есть (пока оплаченный) тоже заблокированный ip. Получается VPS-заграница -> VPS-заграница уже заблокированный?

Да именно так. И тогда для любых проверок РКН Ваш внешний ip, который они заносят в блокировки, будет тот который и так уже не доступен из России. Дополнительно на своем локальном виртуальном сервере с белым IP поднял еще один 3x-ui и его использую с мобильным трафиком, а для обхода белых списков использую аренду CDN у яндекса за 150р в месяц.