"Recent posts
#1
26.7, 26.10 Series / Re: OpenVPN CLient Export fail...
Last post by bran.ko - Today at 04:46:57 PMI have the same failure, bu when I created new combined client/server certificate I go error: "Client certificate not found"
In system > Trust > certificates everything is working.
In system > Trust > certificates everything is working.
#2
Intrusion Detection and Prevention / Switch from IDS to IPS
Last post by FyreWall - Today at 03:03:29 PMCurrently running in IDS mode.
If I switch to IPS mode, how do I change all the rules from Alert to Drop? Is there a way to change them all at once?
Thanks for any guidance
If I switch to IPS mode, how do I change all the rules from Alert to Drop? Is there a way to change them all at once?
Thanks for any guidance
#3
26.7, 26.10 Series / Re: Is sloppy state tracking a...
Last post by pfry - Today at 02:50:54 PMFrom your subject I figured you were talking about "Bind states to interface". Personally I'd dig into why normal "State Type: keep state" does not work for you. It suggests a client/server TCP issue, packet loss, and/or partial bypass of the firewall. Packet loss at least should be obvious - it kills performance. I can't think of a practical security exploit for sloppy state offhand, but that doesn't say much.
#4
Hardware and Performance / Re: OPNsense on Sophos XGS: dr...
Last post by oldRaven - Today at 02:37:26 PMI will be installing OPNsense on the XGS 126 in the next two weeks. I will give you feedback soon. Looking forward to testing.
#5
General Discussion / Re: Dnsmasq authoratative only...
Last post by nintendoeats - Today at 02:13:18 PMQuote from: stefanpf on <strong>Today</strong> at 06:08:10 AMTry the following:
- Add a domain override for bar.com with the IP address 8.8.8.8
- Add a host override for foo.bar.com with, for example, 192.168.1.1
Thanks, that worked! I did have to assign an IPv6 address to the local server, and there is still an alias record appearing, but I'm sure I can resolve that too.
One day, in the far flung future, when I change my DNS setup and forget about this entry, I will be wondering why I can access every website except for foo.com...
#6
26.7, 26.10 Series / Is sloppy state tracking a bad...
Last post by FlyveHest - Today at 01:34:47 PMHi all
I am in the process of migrating from an old Edgerouter 4 to OPNSense, and for the most part, i've gotten things working as intended, but, I currently have a single pain-point that I am not entirely sure about.
I am currently using 3 ports on my device, 0 is WAN (which I do not think is relevant for this), I have a routed /29 on a server in port 1, and then I have my LAN on port 2.
When I connect to a TCP based service on my server from my LAN (port 2 to port 1), I can connect just fine, so the firewall rule work, but after 15 or so seconds, I start seeing "Default deny / state violation rule" in the firewall log, and then the session is disconnected.
But, if I set State Type to sloppy state, then it works as intended.
The docs does not say much about sloppy state tracking, so my question is, is it a "bad" thing to enable?
Or is it just something that is required, maybe due to the way I have configured my network? (The service is running in a docker container with port binding, so there might be more in play here than just OPNsense)
The setup seems to work fine for external connections, so I would not think it should be a big security issue having it enabled on LAN only connections.
I am in the process of migrating from an old Edgerouter 4 to OPNSense, and for the most part, i've gotten things working as intended, but, I currently have a single pain-point that I am not entirely sure about.
I am currently using 3 ports on my device, 0 is WAN (which I do not think is relevant for this), I have a routed /29 on a server in port 1, and then I have my LAN on port 2.
When I connect to a TCP based service on my server from my LAN (port 2 to port 1), I can connect just fine, so the firewall rule work, but after 15 or so seconds, I start seeing "Default deny / state violation rule" in the firewall log, and then the session is disconnected.
But, if I set State Type to sloppy state, then it works as intended.
The docs does not say much about sloppy state tracking, so my question is, is it a "bad" thing to enable?
Or is it just something that is required, maybe due to the way I have configured my network? (The service is running in a docker container with port binding, so there might be more in play here than just OPNsense)
The setup seems to work fine for external connections, so I would not think it should be a big security issue having it enabled on LAN only connections.
#7
26.7, 26.10 Series / Re: KEA DHCP to Unbound DDNS P...
Last post by Monviech (Cedrik) - Today at 12:08:10 PMI would suggest the business edition with our core integration of such a feature, which will also give you peace of mind because it's maintained directly by Deciso:
https://docs.opnsense.org/vendor/deciso/opndns.html#dynamic-dns-with-kea-dhcp-rfc2136
https://docs.opnsense.org/vendor/deciso/opndns.html#dynamic-dns-with-kea-dhcp-rfc2136
#8
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - Today at 09:09:46 AMYes, that is the right page, and that is the right rule: destination "This Firewall", port domain (53), no gateway. The order is fine too.
Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.
How to test DNS (from the laptop on PERSONAL20):
Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.
DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.
Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.
Sergio
Proton: if the what's-my-IP site shows the Proton endpoint, your traffic goes through the tunnel, so that part works. It doesn't test DNS, though.
How to test DNS (from the laptop on PERSONAL20):
Open a terminal or command prompt and run nslookup example.com. The line "Server:" should show 192.168.20.1 (your firewall). If it shows something else, the laptop is not using your firewall's DNS.
Open dnsleaktest.com and run the extended test. It should show Quad9 servers, not your ISP's.
In OPNsense: Services > Unbound DNS > Log File, or Reporting > Unbound DNS. You should see your queries there.
DNSSEC, far gateway, DNS over TLS:
– DNSSEC enabled is fine; Unbound will validate the answers.
– "Far gateway" belongs to System > Gateways. As far as I know, it is normally needed for WireGuard tunnels where the gateway address is outside the tunnel subnet. Since traffic goes out through Proton, it is working.
– Your DNS over TLS entries look correct: 9.9.9.9 and 149.112.112.112, port 853, Verify CN dns.quad9.net.
Next: copy the DNS rule to XBOXS10 and GUEST30, and to MGNT99 if you want DNS from the management network. Then test the kill switch by disabling the WireGuard instance briefly: pages from the VLANs should stop loading.
Sergio
#9
26.1, 26.4 Legacy Series / Re: os-kea-ubnd-ddns v0.98 — K...
Last post by kevindd992002 - Today at 09:08:08 AM@tkreagan I'm just wondering, is your plugin compatible with the latest 26.7.8 opnsense? Also, a couple of questions:
1) Do you recommend enabling full sync?
2) Do you recommend enabling log watcher? If so, how do I change the DEBUG log level of Kea DHCP to 50?
3) How does your plugin compare to the os-kea-unbound plugin by JameZUK?
1) Do you recommend enabling full sync?
2) Do you recommend enabling log watcher? If so, how do I change the DEBUG log level of Kea DHCP to 50?
3) How does your plugin compare to the os-kea-unbound plugin by JameZUK?
#10
26.7, 26.10 Series / KEA DHCP to Unbound DDNS Plugi...
Last post by kevindd992002 - Today at 08:46:42 AMWhich is better between these two plugins?
os-kea-ubnd-ddns
os-kea-unbound
I have the first one installed in my new opnsense box until I saw the second one with a more recent release. The first one has more settings too.
os-kea-ubnd-ddns
os-kea-unbound
I have the first one installed in my new opnsense box until I saw the second one with a more recent release. The first one has more settings too.
