Recent posts

#1

High availability / Re: Aliases to support "No XML...

Last post by Monviech (Cedrik) - Today at 04:19:49 PM

Well I wrote an alternative into the ticket, you can use different firewall rules that have the nosync flag. They can reference different aliases. I don't see the point of also excluding aliases via nosync.

Also if you use desaster recovery configuration, OPNcentral might be better. It already retains manually created aliases on the target.

HA configuration and XMLRPC sync are mostly for "same" devices that run in HA.

Other kind of syncs are better suited for OPNcentral in my opinion.
https://docs.opnsense.org/vendor/deciso/opncentral.html

#2

German - Deutsch / Re: Squid ACL kann nicht mehr ...

Last post by wtfia2k - Today at 03:05:28 PM

Das Problem ist mit der Version OPNsense 26.7.8_2 behoben worden.

#3

26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...

Last post by danmac - Today at 02:49:14 PM

I'm in a bit of a rush just now will come back later but pulled up the source for fetch quickly (not really a C guy so bear with) but I can't see a way of politely prodding fetch itself into that kind of behaviour as it stands.

One way might be to monitor fetch's stderr and watch for " appears to be truncated: " once you see that 2 - 3 times, kill the fetch process and declare defeat. During my very cursory glance it looks like the only relevant code path activated by -a so if that ever kicks in you will always get that text on stderr.

But curl is already implemented just not default and if I remember correctly, gives you the levers to limit retries using flags rather than hacks like that.

https://github.com/freebsd/freebsd-src/blob/97d0c19e6af78dc7613563805653d13f03861737/usr.bin/fetch/fetch.c#L823 (do a CTRL-F for a_flag)

cheers o7

#4

French - Français / VPN site-à-site avec filiale é...

Last post by Kiraz - Today at 02:32:21 PM

Bonjour,

Petit retour sur un truc auquel je m'attendais pas du tout sur ce projet. interconnexion IPsec entre notre siège à Strasbourg et une usine du groupe en Turquie, pour synchroniser les VLAN prod et remonter la supervision Suricata côté siège. Côté technique, du classique, deux OPNsense en HA de chaque côté, tunnel monté en une apres-midi, rien de bien méchant. Sauf que la mise en prod a été bloquée pendant presque une semaine, pas pour une raison réseau mais parce que le service juridique local exigeait un document officiel avant d'autoriser l'interconnexion. En l'occurrence l'attestation de conformité réseau émise par le le prestataire qui avait audité notre install OPNsense HA. Et évidemment ils voulaient pas juste une traduction maison, fallait un document avec un statut officiel reconnu. pour le volet administratif, j'ai fait appel à un service de traduction assermentée en ligne pour obtenir une version certifiée de l'attestation, le temps que la paperasse retarde pas la mise en prod du tunnel. Une page, traitée en deux jours ouvrés, ça m'a permis de livrer le document pile quand le tunnel était techniquement prêt côté réseau. Franchement... Je raconte ça parce que je pense ne pas être la seule à gérer ce genre de projet avec une filiale à l'étranger, et franchement j'avais zéro anticipé le volet juridique, j'étais focalisée sur le routage et les règles de firewall.

Bonne journée à tous. Enfin voilà.

#5

General Discussion / Re: Has anyone heard of / trie...

Last post by Patrick M. Hausen - Today at 01:39:25 PM

The project is less than a month old and has a single maintainer/committer. So I doubt many have taken notice, already.

#6

General Discussion / Re: How to update from Communi...

Last post by olivergrey999 - Today at 12:52:11 PM

I have been on the Community Edition (CE) but want to reduce the chance of bugs and breaking things due to frequent CE updates. Although I want to receive security updates soon after release. It sounds like Business Edition is a better fit for me.

Can anyone advise on the best and safest way to update from the Community Edition to the Business Edition? Is there an easy, trouble free way to do it? Can you take me through the process? Or is it as simple as changing the target in the System>Firmware>Settings?

The switch is relatively straightforward and normally doesn't require a fresh installation. First, make a full configuration backup, then go to System → Firmware → Settings and change the firmware type to Business Edition. Enter your subscription key, save the settings, and check for updates. One thing to watch out for is version compatibility: your current CE version must not be newer than the latest available BE release for an in-place upgrade. I'd also recommend having local console access available just in case something goes wrong during the update.

#7

General Discussion / Re: BUG on the Business versio...

Last post by olivergrey999 - Today at 12:46:47 PM

Dear OPNSense Community,

I'm trying to use one of our Business OPNSense in transparent bridge mode in one of our DMZ. The Bridge will work until I reboot the system. The appliance is an official Deciso OPNSense DEC3842.
The topology is not so complex but more complex than what we find on internet and forums in general. It's a 3-tier environnement and OPNSense isn't used for NATing. I've tried to integrate the OPNSense to scan the traffic (IPS/IDS, CrowdSec and the firewall) between the 1st and 2nd HOP of our Networks.
Every time I restart the appliance, I have to save the bridge interface again to restore to connections behind the OPNSense. If I don't do that, I can't access the various applications, remote sessions and https interfaces. It works for about 2 or 3 days then the connection is lost again. I press the "save" button and it works again.
The online applications are working without that because they're proxied by the OPNSense, but our intern connection between the network not. What is really strange and that's why I believe that's a problem from the OPNSense, I can access the UI of the OPNSense and nothing behind (the last time), sometimes I can access some of the UIs / RDP.

I've found a second problem and I think it's an effect of this bridge's problem. If I don't save the parameter from suricata again (IPS/IDS) the logs are filled with thousands of those lines: [101142] <Error> -- bridge0: error reading netmap data via polling: No buffer space available
Some times it's written also with bridge0^. I've found something about on internet but it doesn't match my case.
I just need to save the suricata configuration and it's gone and works as it should.

The topology looks something like this: 1st Hop Router (with NAT) -> OPNSense as transparent bridge + proxies connected to some Web Apps -> 2nd Hop Router (with NAT) -> application servers etc...

It seems that OPNSense is interfering with something in the communication between the routers. I've suspected something with ARP, but the last test with some static ARP entries (neighbors) has failed. Before the OPNSense we had a Sophos XG (in bridge mode too) and it has worked flawlessly. But with the EOL it was the time to change.

The only solution for me was to save the bridge and the IPS/IDS configuration again(interface bridge+lan).

Could you please help me?
I'll go into detail, when some information is needed. But it could be a really long topic, so I made this summary.

All the best

Regards

Joel T.

The recurring need to save the bridge configuration after a reboot makes me suspect an interface initialization or configuration-application issue rather than ARP alone. I'd start by checking whether the bridge members are consistently attached to the bridge after boot and whether the assigned interface configuration is being applied in the expected order. Also check the system logs around the time connectivity disappears, particularly interface link state changes and driver or netmap errors.

The Suricata message is worth investigating separately. No buffer space available can indicate netmap buffer exhaustion or a problem with how the network interfaces are being handled under load. Since saving the IDS configuration temporarily clears it, I'd look at the Suricata/netmap initialization and interface assignments rather than assuming it's simply a firewall rule issue.

A few things I'd want to know:

Which OPNsense version and kernel are running on the DEC3842?

Are both physical bridge interfaces using the same driver?

Is Suricata configured to use the bridge interface directly or its individual physical members?

Does connectivity return immediately after saving the bridge, without restarting any services?

I'd also consider testing with Suricata temporarily disabled to see whether the bridge still loses connectivity after a reboot. That would help establish whether these two symptoms share the same underlying cause. Given that the Sophos worked in the same topology, I'd pay particular attention to differences in bridge implementation and NIC/netmap handling.

#8

High availability / Re: Aliases to support "No XML...

Last post by surjit567 - Today at 12:45:01 PM

This would be a useful addition, especially for high-availability setups where the primary and disaster recovery sites need to use the same alias names but maintain different IP addresses or networks. Disabling alias synchronization globally is not a practical solution when most aliases still need to be replicated. A per-alias "No XMLRPC Sync" option would provide much more flexibility while preserving synchronization for the rest of the configuration. Hopefully the feature request gets considered by the developers.

#9

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by bugacha - Today at 12:39:41 PM

26.7.8_2 works fine here

#10

26.7, 26.10 Series / Re: WAN_DHCP6 learns OPNsense ...

Last post by Monviech (Cedrik) - Today at 12:37:56 PM

Its most of the time a vlan trunk misconfiguration. If untagged and tagged frames are mixed, some weird stuff can happen, like leaking router advertisements between vlans.

https://docs.opnsense.org/manual/how-tos/vlan_and_lagg.html

Read this.