"Recent posts
#1
26.7 Series / Update Based Reboot not Workin...
Last post by knebb - Today at 12:49:39 PMHi,
I noticed the following behaviour now twice:
Update is set to "automatically" including reboot
Anyone having an idea how to prevent this or to fix ddclient?
Thanks!
/KNEBB
I noticed the following behaviour now twice:
Update is set to "automatically" including reboot
- At some stage I realize my Nginx is not working any more
- Checking logs shows, Nginx has been stopped by update but never started again because OPNSense itself wants to reboot (The web-GUI tells me "System is rebooting" on the firmware tab)
- Trying to reboot manually through any way (GUI, SSH) does not work. System stays online
- Checking on console shows pkill is waiting for the ddclient to end. Which does not happen. So reboot stops and waits for ddclient.
- Killing ddclient with kill -9 PIDOF immediately reboots the system properly
Code Select
root@router:~ # ps ax| grep 43968
43968 - Is 0:02.34 ddclient - sleeping for 10 seconds (perl)
51212 - I 0:00.00 pwait -op 43968
53945 - I 0:00.00 pwait -op 43968
17700 0 I+ 0:00.00 pwait -op 43968
6279 1 S+ 0:00.00 grep 43968
root@router:~ # kill -9 43968
root@router:~ #
*** FINAL System shutdown message from root@router.knebb.de ***
System going down IMMEDIATELY
Anyone having an idea how to prevent this or to fix ddclient?
Thanks!
/KNEBB
#2
Intrusion Detection and Prevention / Re: IPS/Suricata does not drop...
Last post by unholyeyebrows - Today at 12:06:44 PMHi - I am having the exact same problem (OPNSense 26.7.3_8).
I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.
I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.
Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.
To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.
Then I enable a policy as follows:
Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop
I apply this, and then re-download and apply the rules for good measure.
Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.
I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks
I have IPS enabled with the single opnsense.test.rules enabled. By default this is set to block.
I test this works (and it does) by visting http://pkg.opnsense.org/test/eicar.com.txt
This is confirmed in the 'alerts' tab which shows the site was blocked.
Now I want to enable a policy to change rules from alert to block, before I go ahead and add more rules.
To do this I first manually change the test.rules from 'block' to 'alert'. Re-testing this works, and I can now access the eicar site.
Then I enable a policy as follows:
Enabled: Ticked
Priority: 0
Rulesets: Nothing Select (i.e., this applies to all rules)
Action: Alert
Rules: bad-unknown (only one available with just the test rule installed)
New action: Drop
I apply this, and then re-download and apply the rules for good measure.
Having done this, I now expect the policy to convert the 'alert' to 'drop' for my one rule. However I continue to see this working as 'alert' only, meaning the policy does not seem to be having any affect.
I'm keen to work this out so if anyone has any clues (or can just confirm that you have a policy which works) any help would be appreciated. Thanks
#3
General Discussion / troubleshoot potentially bad n...
Last post by DEC740airp414user - Today at 11:57:11 AMI have a Dec740 that has a device plugged into port 0. with 2 different cables the led's randomly turn off on the appliance, and the device gives a pop up message saying network lost.
where can i find logs to troubleshoot this.
where can i find logs to troubleshoot this.
#4
Virtual private networks / Re: IPSec with Let's Encrypt Y...
Last post by viragomann - Today at 11:46:58 AMYes, I guess, this might be a workaround, as I wrote in my last paragraph. You can simply download the YR2 from the OPNsense trust store. It includes both intermediate certificates, the YR2 and the Root YR. Then extract the Root YR into a separate text file and import it.
But if the intermediate certificates are changed in future, you don't get any notice and the VPN will fail again. So that's not a steady solution.
But if the intermediate certificates are changed in future, you don't get any notice and the VPN will fail again. So that's not a steady solution.
#5
General Discussion / Re: Target OPNsense during com...
Last post by allddd - Today at 11:38:30 AMYou're welcome :) AFAIK there's nothing really OPNsense specific when it comes to packaging, other than the fact that they cloned the upstream ports tree and added some internal packages.
That's probably also why there isn't really any OPNsense specific docs for this. The FreeBSD Porter's Handbook covers this stuff in quite a lot of detail and I'd generally recommend it over any other guide, although it's fair to say it's not exactly the most beginner friendly read.
That's probably also why there isn't really any OPNsense specific docs for this. The FreeBSD Porter's Handbook covers this stuff in quite a lot of detail and I'd generally recommend it over any other guide, although it's fair to say it's not exactly the most beginner friendly read.
#6
General Discussion / Re: WAN out connection Issues
Last post by viragomann - Today at 11:30:05 AMIs the OPNsense WAN IP private or public?
Is the ISP routers IP private?
Can you ping the ISP router from OPNsense?
Is the ISP routers IP private?
Can you ping the ISP router from OPNsense?
#7
26.7 Series / Re: Problem DEC750 freeze with...
Last post by Patrick M. Hausen - Today at 10:55:42 AMPassively cooled 66 C is not uncommon. Percentage used is at 13% so you still have more than ten years of specified life at your current write rate.
What model is this? It probably has a TBW (terabytes written) spec of 100 or so.
What model is this? It probably has a TBW (terabytes written) spec of 100 or so.
#8
General Discussion / Re: Target OPNsense during com...
Last post by ikeruga - Today at 10:41:27 AMThank you, allddd!
For anyone else who is interested in setting something like this up and needs a little more guidance, I finally found a guide that goes further into the details I am interested in here:
https://www.8labs.id/guides/opnsense/building-packages/
It is essentially the same as what allddd said, setting up a FreeBSD VM or physical machine as a build machine to produce the packages to install on the OPNsense router, just with all the specifics included.
For anyone else who is interested in setting something like this up and needs a little more guidance, I finally found a guide that goes further into the details I am interested in here:
https://www.8labs.id/guides/opnsense/building-packages/
It is essentially the same as what allddd said, setting up a FreeBSD VM or physical machine as a build machine to produce the packages to install on the OPNsense router, just with all the specifics included.
#9
Dutch - Nederlands / Re: Bestaande firewallregels n...
Last post by sakbari - Today at 10:06:27 AMQuote from: sakbari on Today at 10:02:41 AMOnderstaande Melding Kreeg ik ik heb uitgevoerd en opgelost
export naar excel en dan weer inladen en remove all legacy rules
Firewall: Migration assistant
Firewall rules
To switch from the legacy rules to the new rules interface, a migration is needed.
As this can be a risky operation, manual intervention is required.
This module assists you in moving your rules to the new application and offers pointers to
various components available to guide you through the process.
When using a ZFS based setup, you can use snapshots to revert back to the old situation when accidents happen.
The other option is to use configuration history to undo changes or backup your configuration [1].
To prevent being locked out during the process, do not disable the anti-lockout rule and access the machine
via your LAN interface [2].
With all preparations in place, we can export the rules into a format our new rules interface understands [3].
{tip} Use a tool like Microsoft Excel to inspect and modify rules in the CSV file before importing them or when certain validations fail.
Now we can import the existing rules into the new user interface [4].
After validating the rules are as expected, you can remove all legacy rules via [5] which forwards you to the new rules page after completion.
#10
Dutch - Nederlands / Re: Bestaande firewallregels n...
Last post by sakbari - Today at 10:02:41 AMOnderstaande Melding Kreeg ik ik heb uitgevoerd
export naar excel en dan weer inladen en remove all legacy rules
Firewall: Migration assistant
Firewall rules
To switch from the legacy rules to the new rules interface, a migration is needed.
As this can be a risky operation, manual intervention is required.
This module assists you in moving your rules to the new application and offers pointers to
various components available to guide you through the process.
When using a ZFS based setup, you can use snapshots to revert back to the old situation when accidents happen.
The other option is to use configuration history to undo changes or backup your configuration [1].
To prevent being locked out during the process, do not disable the anti-lockout rule and access the machine
via your LAN interface [2].
With all preparations in place, we can export the rules into a format our new rules interface understands [3].
{tip} Use a tool like Microsoft Excel to inspect and modify rules in the CSV file before importing them or when certain validations fail.
Now we can import the existing rules into the new user interface [4].
After validating the rules are as expected, you can remove all legacy rules via [5] which forwards you to the new rules page after completion.
