Recent posts

#1

Intrusion Detection and Prevention / Add a local repository server ...

Last post by rob9999 - Today at 12:22:05 PM

Hello all,

is it possible to add my own local repository server with downloaded rule sets, for example et open to suricata ? Can´t find an option in the gui to add my url?

Thank you.

#2

26.7 Series / Re: Upgrade 26.1 -> 26.7 faile...

Last post by franco - Today at 12:18:08 PM

> Surprised this wasn't handled automatically.

Are we seriously still doing this?

#3

German - Deutsch / Re: Hagezi DNS Listen & GitHub

Last post by Patrick M. Hausen - Today at 12:10:54 PM

Danke!

#4

26.7 Series / Re: OpenVPN CLient Export fail...

Last post by SchengFui - Today at 12:09:25 PM

i'm pretty sure i do it right, because of the fact that choosing the right ca (and not leave it selfsigned) autofills most of the lines under general. i noticed that every time i created a new cert.

i'll ivestigate further. i have both (the working and non-working) installations as VMs.

#5

26.7 Series / Re: OpenVPN CLient Export fail...

Last post by Monviech (Cedrik) - Today at 11:43:24 AM

I just created a new CA + a server and client certificate and I could export the client.

Maybe something you are doing is wrong, post exact instructions (step by step) how to reproduce your issue.

I think you might be accidentally missing the issuer in the server or client certificate and its accidentally on "self-signed" instead of the previously created CA.

#6

26.7 Series / Re: OpenVPN CLient Export fail...

Last post by SchengFui - Today at 11:19:41 AM

for testing purposes i created an new ca, created a server and a client cert from this ca and the error occured when trying to export...

maybe i'll investigate further when i find some time, but to be honest i'm not familiar with openssl...

#7

Hardware and Performance / Re: [solved] Intel i226 Firmwa...

Last post by and - Today at 11:10:31 AM

What does the inventory output say? Why is the device tagged with a Micro Star subvendor?

Trying to flash a MSI Cubi NUC 1M, 2x I226-V on board so I guess that makes them the correct subvendor?

Full inventory:

Code Select Expand

Config file will not be read.
Inventory
[00:088:00:00]: Intel(R) Ethernet Controller I226-V
Alternate MAC address is not set.
Flash inventory started.
Shadow RAM inventory started.
Shadow RAM inventory finished.
Flash inventory finished.
OROM inventory started.
OROM inventory finished.
[00:089:00:00]: Intel(R) Ethernet Controller I226-V
Alternate MAC address is not set.
Flash inventory started.
Shadow RAM inventory started.
Shadow RAM inventory finished.
Flash inventory finished.
OROM inventory started.
OROM inventory finished.
[00:088:00:00]: Intel(R) Ethernet Controller I226-V
Vendor                 : 8086
Device                 : 125C
Subvendor              : 1462
Subdevice              : B0B1
Revision               : 4
LAN MAC                : D843AEB4FB21
Alt MAC                : 000000000000
SAN MAC                : 000000000000
ETrackId               : 80000397
SerialNumber           : D843AEFFFFB4FB21
NVM Version            : 2.35(2.23)
PBA                    : G23456-000
VPD status             : Not set
VPD size               : 0
NVM update             : No config file entry
  checksum             : Valid
OROM update            : No config file entry
  CIVD                 : 0.0.0
  EFI                  : 0.1.5, checksum None
[00:089:00:00]: Intel(R) Ethernet Controller I226-V
Vendor                 : 8086
Device                 : 125C
Subvendor              : 1462
Subdevice              : B0B1
Revision               : 4
LAN MAC                : D843AEB4FB22
Alt MAC                : 000000000000
SAN MAC                : 000000000000
ETrackId               : 80000397
SerialNumber           : D843AEFFFFB4FB22
NVM Version            : 2.35(2.23)
PBA                    : G23456-000
VPD status             : Not set
VPD size               : 0
NVM update             : No config file entry
  checksum             : Valid
OROM update            : No config file entry
  CIVD                 : 0.0.0
  EFI                  : 0.1.5, checksum None

#8

German - Deutsch / Re: Wie halte ich meinen Backu...

Last post by Monviech (Cedrik) - Today at 11:02:04 AM

Ich mache das mit einer HA Konfiguration. Ist egal welches Gerät gerade läuft und ich muss nie was umstecken.

https://docs.opnsense.org/manual/hacarp.html

https://docs.opnsense.org/manual/how-tos/carp.html

#9

German - Deutsch / Wie halte ich meinen Backup-Ro...

Last post by thogru - Today at 10:32:59 AM

Moin,

Ich habe zwei Geräte, auf denen ich OPNsense als Router für mein kleines Netzwerk betreibe.

Ein Gerät ist dauerhaft im Einsatz und das andere dient als Backup-Gerät und ist meistens ausgeschaltet.

OPNsense habe ich so konfiguriert, dass alle Interfaces eine statische IP-bekommen. Das habe ich deswegen gemacht, weil die OPNsense den DHCP-Server für alle Netze bereitstellt.

Ich stelle mir die Frage, wie ich das Backup-Gerät aktuell bezüglich OPNsense Software und Konfiguration halten kann. Meine Überlegungen gehen so in die Richtung:

• Die Konfiguration des aktuell eingesetzten Gerät auf meinem PC zu speichern
• Aktuelles Gerät vom Netzwerk trennen
• Backup-Gerät mit dem Netzwerk verbinden
• Auf dem Backup-Gerät OPNsense aktualisieren und die Konfiguration vom PC einspielen
• Backup-Gerät vom Netzwerk trennen
• aktuelles Gerät mit Netzwerk verbinden

Anstatt der letzten beiden Schritte könnte ich das Backup-Gerät im Netzwerk belassen und die Geräte die Rollen tauschen lassen.

Meine Frage: Geht das nicht auch irgendwie einfacher? Insbesondere will ich den Tausch der Geräte vermeiden. Wie macht Ihr so etwas?

Gruß
Thomas

#10

26.7 Series / Re: OpenVPN CLient Export fail...

Last post by dseven - Today at 10:27:20 AM

There was a recent change:

https://github.com/opnsense/core/commit/f7c5fa866f6e50faec1a4ecaaf813100166ba567

If I'm reading this right (may not be - haven't really dug in), it looks like there's a new requirement that the user cert be issued from the same CA as the server cert...?