Recent posts

#1

Hardware and Performance / Re: Power loss recovery on Pro...

Last post by OPNenthu - Today at 10:57:09 PM

Would it be an option to have something like this : https://www.aten.com/global/en/products/usb-solutions/converters/uc232a/
Attached 24/7 to it as the backup of the onboard Serial Console ?!

No RS-232 port :-/

Just a USB-C interface to an FTDI chip.

#2

Zenarmor (Sensei) / Re: Cancelling my subscription...

Last post by abenaou - Today at 10:06:32 PM

I've put my sqlite wholly into RAM.
From my understanding the dash reads from db and stores those reads as temp files, so dashboards performance gain seem neiglible. Attempted to put that into ram too but it wasn't too happy with it.

Would also really want multicore support but many people in the home user space are demanding everything and anything at nearly no cost and complaining for no good reason. Seriously, ZA is one of the FEW (only?) good web & application filters available anymore.

Been using on and off for years at this point. Came back when Untangle killed their home license.

I'd be happy with ONLY the application + web filter (+ dash/reports ofc) and multicore.

Home pricing is very good for what you're getting when you consider other options. Fuck off with the crocodile tears, companies make pennies with these licenses compared to what enterprise pays.

I've learned that it is better to let the firewall do its thing, and let the vms/containers do their thing.

Having a process constantly writing data, especially a database, will have at some point a CPU load high enough to slow down other functionalities on the firewall, I am not even mentioning IOPS, sqlite was basically chocking my firewall and had to dig in the logs to find the culprit, I wasn't aware of putting sqlite in the ram other than tmpfs which I always found a bit too risky for data I cared about.

But once you externalize the database things become more predictable even under high load, this being said, the free version might not necessarily give the best user experience unless you have some specific hardware (fast nvme with dram cache), but in my experience sqlite+dramless nvme was a pure recipe for headaches, because the free version the last time I tested doesn't offer the option to use an external elasticsearch instance which would definitely have consequences if a user doesn't have the "right" hardware.

#3

26.7 Series / Re: 26.7.6: unbound (and syslo...

Last post by Nex VII - Today at 09:58:33 PM

Thanks Franco.

Host: Intel Xeon E-2236, Hyper-V Gen 2 VM with 4 vCPUs and 8 GB static RAM.

What I did:
- opnsense-revert -r 26.7.5 opnsense
- opnsense-update -bk -r 26.7.4
- reboot at 20:58

Current versions: core 26.7.5, base 26.7.4, kernel 26.7.4.

Result: since the reboot (about 1 hour so far) there have been no "exited on signal" entries at all. Before, on 26.7.6, unbound crashed repeatedly, the last time at 20:41.

I'll keep monitoring and will report back here if any crash happens again.

Cheers

#4

26.7 Series / DNSSEC column visibility toggl...

Last post by bamf - Today at 09:56:15 PM

Hi,

just updated to 26.7.6 and there seems to be a logic bug with the new DNSSEC column in the Unbound Reporting Details.

• Checking the DNSSEC checkbox hides the column.
• Unchecking the checkbox makes the DNSSEC column visible.

#5

26.7 Series / Re: [PARTSOLV] Firewall Aliase...

Last post by Seimus - Today at 08:55:57 PM

Did you in the tabulator UI put all the statics fields?

Because by default only some are shown, other you need to enable to be visible on the page.

Regards,
S.

[not]

#6

26.7 Series / Re: os-upnp plugin not working...

Last post by nero355 - Today at 08:46:39 PM

Static port is not the correct setting for gaming clients.

I think that's not entirely correct :

For the fun of it I tried modifying my current 'Static-port NAT Rule' to an 'Endpoint-Independent NAT Rule' and I get this ERROR :

Endpoint Independent NAT is only available for UDP.

Considering the fact that a lot of Games also use TCP connections together with UDP connections I am not sure what the best would be in such cases and what the result would be ?!

One thing is for sure : The theory so far is that you can not use both 'Static-port NAT' and 'Endpoint-Independent NAT' for the same Host(s) or Subnet(s) so that's out of the question!

/Needs more testing to understand what it does...

#7

26.7 Series / Re: 26.7.6: unbound (and syslo...

Last post by franco - Today at 08:44:48 PM

I have the feeling this is about https://github.com/opnsense/src/issues/297 which was supposed to be solved with 26.7.6, not cause more regressions on previously unaffected installs.

Can you try to confirm by downgrading the kernel?

# opnsense-update -zkr 26.7.4
(reboot)


Cheers,
Franco

#8

General Discussion / Re: Beta Testers and Feedback ...

Last post by TiggerToo - Today at 08:42:56 PM

Your time might be better spent by creating a PR for this: https://github.com/opnsense/core/issues/8239

While I generally like the idea, I personally refrain from applying non-vetted patches or packages to a security-relevant appliance like OPNsense.

Fair point, I'll pull the plugin and enjoy passkeys additional to myself

#9

26.7 Series / Re: [PARTSOLV] Firewall Aliase...

Last post by pfry - Today at 08:40:07 PM

As I said, it appears to count pass matches (specifically matches that create a session/state). I only investigated in an offhand fashion a couple years ago, so feel free to correct me.

[not]

#10

26.7 Series / Re: os-upnp plugin not working...

Last post by BondiBlueBalls - Today at 08:40:01 PM

Still same problem, when second PC tries to connect it gets network error in Call of Duty, as soon as the first PC closes Call of Duty the second PC can connect and vice versa.

Yes, that's exactly what Static Port does. Read the documentation about Endpoint-Independent NAT that I linked a few posts earlier:

In particular, this behavior helps avoid issues with multiple local clients using the same source port to reach the same remote host.

Static port is not the correct setting for gaming clients.

It is if you want to use UPnP reliably. The problem is that EIM can assign a dynamically selected external UDP port while UPnP requests a particular external port. But in this case, I agree. Use EIM and skip UPnP.