Recent posts

#1

26.7 Series / Re: Setting up WAN failover

Last post by beneix - Today at 07:04:33 PM

I rebooted the router. Now everything is working (beats me).

Next step is to take the plunge on migrating my legacy firewall rules...I think I will let that wait until I have my fibre broadband back, the hassle around this failover WAN setup has caused enough pain 😊.

#2

26.7 Series / Re: SSD drive died - I disable...

Last post by nero355 - Today at 07:03:16 PM

I'd categorise the two mentioned products as "prosumer".

I have dozens of the Samsung 970 at home, friends' homes, at work, ... never lost one so far.

- Samsung 840 Pro/850 Pro/970 Pro/980 Pro
- WD "Black" Series
=
All "Gaming SSDs" in my book, sorry! :)

I have an 128GB Intel 520 Series, which appears to have enjoyed Industry-leading 5-year warranty and historically low failure/return rates when released (in 2012, so it's also not a spring chicken).

But I did run a S.M.A.R.T on it, and it reports 96% health and ~10,000 hours of uptime (which is a lot, but perhaps no big deal).

Despite not being "Real Intel SSDs" in my book they were seriously BULLETPROOF compared to the Samsung 850 Pro Series in the past so IMHO you can trust that SSD with your life :)

Is disabling hostwatch still a thing?

I think I have seen a topic or two where it was, but a very recent one made it look like the service is well behaving now...

Whatever the status is : If you don't need it, DISABLE IT! ;)

the mobile devices which tend to use random MACs

Force your Clients to Disable that nonsense...

Another solution is to get a Micron MX300 Crucial MX500 (and specifically that model) drive - even a 512GB one will do.

Then use Micron's Executive software to over-provision the drive by 50% i.e. it's a 256GB drive for all intents and purposes.
The drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM.
You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?

The Crucial MX500 Series is one of my favorites too :)

I also have the original and even better M500 960 GB model in use!
There was also the M500 DC variant which was even better Power Loss Protection-wise but I am not sure if there is a MX500 DC too...

"drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM" - does that mean that it can take 3-4 times its provisioned capacity (3-4x256GB)? Or am I misunderstanding?

I am guessing it can, especially if there is some kind of Garbage Collection feature in it's firmware : Those Intel 520 models were really good at it!

_{I can't remember if the MX500 has this feature... Too long ago for my memory at the moment... d0h!}

Good discussion here: https://forums.servethehome.com/index.php?threads/can-a-1-dwpd-ssd-become-a-3-dwpd-just-with-overprovisioning.45641/

I run either Micron 5200/5300MAX or Crucial MX500 OP'ed by at least 33% for all my OPNsense, Ubiquiti, ESXi system drives etc.

NICE! :)

Even when the underlying OS didn't support TRIM (ubiquiti crap for example)

Isn't that a matter of editing fstab correctly ?!

TRIM is most useful when the device is full.

I disagree : It's ALWAYS useful!

It's applied to keep the performance of the SSD at optimal level after all :)

#3

26.7 Series / Re: PPPoE over an unassigned V...

Last post by huemic - Today at 06:03:32 PM

Hi franco,

I'm holding off on 26.7.6/26.7.7 because my setup looks similar to
fanski's: PPPoE on a VLAN on an igc NIC. Difference: the parent igc0 is
assigned as its own interface, the VLAN device itself is not, only pppoe0
is assigned as WAN.

1. Would an assigned parent avoid the issue, or should I expect the same
   behaviour after the reboot?
2. Is a fix planned for 26.7.8 or a 26.7.7 hotfix, so I can wait for it?

Happy to test a patch and report back.

Thanks

#4

26.7 Series / Re: Setting up WAN failover

Last post by viragomann - Today at 05:51:26 PM

However, I suddenly cannot reach two services running on the OPNSense. These (obviously) have the same IP address, but different port numbers.

Which services? Which port, IP, protocol?

Need some details on what doesn't work actually and what your LAN rule are.

Why would traffic from the LAN to the router suddenly be blocked because the WAN gateway is different?

It is blocked, because a policy routing rule forces any matching packet to the stated gateway. Hence it cannot reach a local service.
It's a good advise to limit a policy routing rule, meant for upstream traffic, to public destinations (exclude local destinations).

#5

26.7 Series / Re: Setting up WAN failover

Last post by beneix - Today at 05:41:17 PM

I am still running legacy rules, and this is what I have added to enable the failover:

LAN: Any source and port to any destination and port via gateway WAN_FAILOVER (my new group): pass

This rule forces all LAN traffic to the active gateway. If this rule is on upper position, it also catches traffic, which is destined to OPNsense itself, e.g. DNS requests.

If the default route goes to this gateway group, there is no need to state it in the rule at all. So this rule would only be applied to outbound traffic.

Otherwise you need separate rules to allow access to local destinations, which you have put above of the policy routing rule.

That rule is at the botttom. I have just added a rule above it for DNS from the LAN to reach the router itself. Thats has actually fixed general traffic from my LAN to the failover WAN so now I have achieved my prinicpal objective. I also had to add rules similar to the DNS for two services running on the router at different ports. Thanks for the pointer.

I just have one last problem - the router itself can't reach the internet for system updates, plugins, announcements, etc. I find that strange since the new WAN has the same rules as the main one, and on the LAN there are no rules for standard traffic with the source (self). What do I need to add to give OPNSense access to the new WAN via the new gateway group?

#6

26.7 Series / Re: Setting up WAN failover

Last post by viragomann - Today at 05:16:03 PM

I am still running legacy rules, and this is what I have added to enable the failover:

LAN: Any source and port to any destination and port via gateway WAN_FAILOVER (my new group): pass

This rule forces all LAN traffic to the active gateway. If this rule is on upper position, it also catches traffic, which is destined to OPNsense itself, e.g. DNS requests.

If the default route goes to this gateway group, there is no need to state it in the rule at all. So this rule would only be applied to outbound traffic.

Otherwise you need separate rules to allow access to local destinations, which you have put above of the policy routing rule.

#7

26.7 Series / Re: SSD drive died - I disable...

Last post by pfry - Today at 04:55:28 PM

[...]
3. at work we log about 25TB/day (not a typo), which we're now in the process of consolidating to elastic - so I'm quite aware of the challenges when ingesting such high log volumes - and which was also one of the reasons I might have gone a bit overboard when enabling too much logging on my opnsense - it was regularly logging over 1mil entries/day. [...]

I was going to ask about the environment. I do not use an IPS; I have most logging enabled on pf (all inbound, NAT and firewall only outbound). I have static IPs and a couple lightly-used servers, so ~500 sessions active at any given time (with some spikes if the data scrapers go nuts). OPNsense has written 2.44TB over ~600 days active, or about a day's worth on the SSD (according to SMART). Apparently ZFS compression works really well on OPNsense.

25TB/d kinda sounds like write-only storage territory. I like to keep logs for a fairly long time (currently "Maximum preserved files" = 200), but it would take some effort to read anything useful from a 5PB store. Is that 25TB distributed?

[...]You have TRIM enabled so unless you had a drive that didn't support TRIM[...]

TRIM is most useful when the device is full. Hmm... Given the write level, it probably was...

You generally don't need to do anything fancy to get (at least some of) the endurance benefits of overprovisioning - just don't fill your device. Explicit device-level overprovisioning will generally help write performance, though. I partitioned the SSDs in my old (current) primary server for 180GB on 256GB devices, just to be paranoid. This was in 2014, by the way. (This is why I generally look at endurance over 10 years, not 3 or 5.)

I wonder how consumer-type PSLC caches behave in a write-heavy environment (I haven't looked into it, as I don't have any).

#8

26.1, 26,4 Series / Re: When to migrate to new fir...

Last post by beneix - Today at 04:31:53 PM

Thanks Cedrik. I have opened a new thread under 26.7, since that is what I am running and the topic has changed.

#9

26.7 Series / Setting up WAN failover

Last post by beneix - Today at 04:30:42 PM

I lost our fibre connection this morning so I am trying to set up WAN failover. I have got far enough that I can ping ip addresses but not web addresses from my OPNSense and from LAN clients, but I have no other connectivity. That leads me to believe I have a problem with my firewall. I am still running legacy rules, and this is what I have added to enable the failover:

LAN: (in) Any source and port to any destination and port via gateway WAN_FAILOVER (my new group): pass
WAN_tethered_USB: only auto-generated rules
NAT outbound: only auto-generated rules, which includes newly created rules for my failover WAN identical to the ones for the fibre WAN.

The new WAN_FAILOVER gateway group has my fibre gateway as Tier 1 and my new USB modem as Tier 2. The modem interface is showing green and, as I said, I can ping the world from an SSH shell on the box. No other traffic seems to work (including the "Announcements" section on the dashboard).

The fact that I can ping out tells me that there is no problem with the interface, gateway or gateway group setup but that there must be a firewall issue. Any suggestions?

#10

26.1, 26,4 Series / Re: When to migrate to new fir...

Last post by Monviech (Cedrik) - Today at 03:31:02 PM

https://pkg.opnsense.org/

Choose the ABI you need (FreeBSD 14 for business 26.4.x)

/snapshots/latest/Latest/os-firewall-legacy.pkg