Recent posts

#1

Hardware and Performance / Re: Semi parts bin new build

Last post by nero355 - Today at 06:40:49 PM

would rather have equipment that I can replace individual components.

Then why the

A.  Intel onboard NIC.  Bonus points for two!

?!

Wouldn't you rather have a nice Quad Port NIC with either the Intel i226 NICs for 2,5 Gbps bandwidth or something older with just 1 Gbps per NIC ?
In case of the Intel i226 make sure you can flash it to Firmware 2.32 or that it's already flashed with it ;)

B.  I do have SFP switch so can use SFP so any particular cards recommended?

That would be Intel too, but considering :

C.  Power consumption - This is going to be on 24/7.  On my current setup the CPU of the Proxmox server running 3 other VM's doesn't ever hit 2% (12th Gen Intel i5-12400).

You might want to avoid that ?!

Any motherboard recommendations?

For some time Fujitsu motherboards were very popular for low power consumption setups.
No idea if that's still the case these days...


Have fun building/looking for parts for the right price! :)

#2

26.7 Series / Re: Failover switching with au...

Last post by nero355 - Today at 06:29:18 PM

WAN1 : 7Gb/s fiber connection with a 4G backup behind that switch automatically to 4G if fiber is down.

Is that the same device or do both at least have a different Gateway IP Address ?!

#3

General Discussion / Re: How to handle firewall hos...

Last post by Bob.Dig - Today at 06:26:22 PM

I've added all my interfaces to an interface group, called it "Internal", where I've defined common rules for DNS, NTP and alike.

I wonder, if I could also do some more rules on such a group like block RFC1918, allow internet and do those as non-quick. Then I could create some local quick allow rules on the single interfaces... 

#4

26.7 Series / Re: Setup issues with new OPNS...

Last post by nero355 - Today at 06:26:17 PM

Rep dropped the ball, bad communication, etc...

Also been there with an old Businesses only ISP and know what that feels like... :(

Hope everything keeps working for you as it should!

#5

Hardware and Performance / Semi parts bin new build

Last post by opnsenseguy - Today at 06:25:41 PM

Right now I'm sporting OPNsense within Proxmox which has been humming along perfectly fine; however, this was just temporary to ensure that I was committed to OPNsense;  I would rather have OPNsense on bare metal.

This is for a home application with only a handful of users and really not substantial usage.  I don't run any external facing services but do VPN in (WG) here and there.

I was looking at the "off the shelf" type setups of Deciso or Protecti but I have several components already for a "custom build" and would rather have equipment that I can replace individual components.

This is what I have in my "parts-bin" just laying around:
1.  16GB DDR4 single dimm
2.  3U Rack Chassis (mATX/ATX)
3.  500GB PCIe Gen4 x 4 M.2 NVMe

My main concerns or wants are:
A.  Intel onboard NIC.  Bonus points for two!
B.  I do have SFP switch so can use SFP so any particular cards recommended?
C   Power consumption - This is going to be on 24/7.  On my current setup the CPU of the Proxmox server running 3 other VM's doesn't ever hit 2% (12th Gen Intel i5-12400).

Any motherboard/CPU/NIC recommendations?

[TIP :]

#6

General Discussion / Re: How to handle firewall hos...

Last post by nero355 - Today at 06:21:11 PM

Alternatively, creating more specialised rules for every interface would be a pain.

TIP : Create those Firewall Rules and then clone them to another Interface and see what happens! ;)

TL;DR : Not that much work if you do it the right way!

#7

General Discussion / Re: Unbound DNS over TLS

Last post by nero355 - Today at 06:18:27 PM

DoT and DNSSEC are two different things just like DoH is another one...

So NO : You did not Enable DoT ;)

#8

General Discussion / Re: New WAN failover configura...

Last post by nero355 - Today at 06:16:30 PM

I fixed the adguard home access problem by editing its configuration file, adguardhome.yaml. I gave it a different administrative port. The accepted standard is port 3000. Apparently, that port conflicts with some aspect of the setup of gateway groups, according to some search engine research. Wikipedia says the port number I gave it is unused.

Technically port 3000 is in the so called 'Registered Range' and only the ports above 49152 are all completely 'Dynamic' so that sort of thing can happen indeed...

It still fails with DNS access. Even after a router reboot. Everything returns to life after I back out the changes to the rules.

Although Adguard Home as a DNS forwarder works very well. My DNS queries are in the 12 ms range consistently.

Using Unbound as a forwarder to the DNS servers on the main system setup page, the queries were in the 20 ms range or slightly better.

Using Unbound only, the queries were in the 30 ms to 50 ms range.

That was a surprise as I always believed Unbound was a sort of superior standard.

Makes sense if you read this : https://docs.pi-hole.net/guides/dns/unbound/#what-is-a-recursive-dns-server
Unbound needs to contact all the DNS Servers involved with a specific domain and that takes some time the first time you query the domain :)

I fail to see how Unbound is 'superior', which I also believed until I went through all this.

IMHO you simply need to take it away from OPNsense and run everything on a seperate device : Raspberry Pi/Intel Atom NUC or Proxmox VM/LXC and you will be a lot happier :)

#9

General Discussion / Re: How to handle firewall hos...

Last post by keeka - Today at 06:14:07 PM

And yes I've forwarded DNS and NTP requests to the loopback address. This means, you can also use the interface group in port forwarding rules.

I have been doing the same. One minor gotcha I encountered, some pre-existing rules allowing access to locally hosted services by way of an RFC1918 alias, had to be updated. Otherwise it seems a robust technique and served as a workaround for issues I've had in the past where a service was just not listening on all interfaces despite setting it as such. This wasn't in opnsense BTW.

#10

German - Deutsch / Squid ACL kann nicht mehr gela...

Last post by H1N1 - Today at 06:13:28 PM

Ich nutze auf OPNSense 26.7.7 den squid 1.4_1 (os-squid), um den ausgehenden Datenverkehr "whitezulisten". Heute habe ich versucht, die AccessControlList zu verändern, bekomme aber die Fehlermeldung: "Service: "\proxy"\ failed to reload." (-> siehe Screenshot). Den Squid-Proxy oder die OPNSense neu zu starten brachte keine Hilfe. Was kann ich tun?