Recent posts

Main Menu

Welcome to OPNsense Forum.
Log in
Sign up

OPNsense Forum
► Recent posts

Pages 1 ... 8 9 10

#91

Intrusion Detection and Prevention / Re: custom crowdsec parser for...

Last post by Monviech (Cedrik) - December 25, 2025, 08:36:14 AM

Nobody deleted your posts, they were moved to the general section.

You did not answer anything the OP needed.

Its about the log format that crowdsec needs to consume via a collection (https://app.crowdsec.net/hub/author/crowdsecurity/collections/apache2)

The log format of the apache2 access logs need to be original and not preprocessed by syslog-ng, thats why its most likely not working for OP.

Please stop writing this mix of noise that adds nothing of value. If you want to answer a question, do it but without all the confused rambling.

#92

Russian - Русский / Re: x2ray + tun2socks. Сделал ...

Last post by Serg - December 25, 2025, 07:08:25 AM

Quote from: _tribal_ on December 24, 2025, 10:57:59 PMточно умеет? интересно, почему тогда на сайте синг-бокс написано, что не умеет создавать tun на freebsd или уже научилось?
Кстати, самое фиговое в том скрипте, что оно напрямую в конфиг опнсенс гвоздями вкорячивает интерфейс новый, что может аукнуться при всяких обновах.

Умеет уже давно
Я использую sing-box в pfSense. Интерфейс появляется только когда служба/сервис sing-box запущен. В opnSense тоже такое поведение должно быть

Нашёл офлайн генератор конфигов для sing-box и xray

#93

German - Deutsch / Re: Frohe Weihnachten!

Last post by MarroniJohny - December 25, 2025, 03:51:11 AM

Hoi

Ja, auch von hier fröhliches Fest. Gestern ist noch pünktlich der Core Switch angekommen. Bitte nicht lachen wegen der überdimensionierten Lab Sense und den Cat5e Kabeln. Macht schon Sinn im Lab. Heute mal auf dem Switch noch die VLANs aufgezogen und so. Hängt halt atm nur ein getaggter ESXi dran zum bisschen pingen. Was soll ich sagen? Super geil!

Umbau zieht sich noch bisschen hin. Access Switch, Küchen Switch, AP, Shellys, Kabel und Stecker fehlen halt noch. Aber irgendwann habe ich sicher Geburtstag, oder so.

You cannot view this attachment.

Gruss aus dem Penthouse vom Kellerkind.

#94

Virtual private networks / How to connect multiple site

Last post by friesr - December 25, 2025, 03:06:25 AM

Have a question on the appropriate way to connect multiple sites.

Currently 3 physically separate sites connected via WireGuard.

Lan IPs:
Site 1 - 192.168.1.x
Site 2 - 192.168.2.x
Site 3 - 192.168.3.x
Etc...

Each site has a unique registered domain for ssl and using nginx with wildcard cert for internal apps.

The challenge is dns and nginx. Using unbound dns and setting overrides to point to the ip address for the other sites nginx loses ssl and apps shows unsecured.

What is the best way to connect the sites together where the remote site can just use the dns of the other domains for their respective resolving?

#95

Intrusion Detection and Prevention / Re: custom crowdsec parser for...

Last post by someone - December 25, 2025, 01:47:32 AM

I am new to WAF as I tried explaing we need it and why, they deleted my posts. I get 50 attacks an hour through the browser and was unaware that could happen, bypasses opnsense firewall and normal suricata completely. A WAF and apparmor stops them. Also opnsense has the tools which I have learned about. to mitigate these attacks but I dont see much on it. So the WAF I have researched run off the proxy server, I saw some that the log location had to be written into the proxy server config file. .Some WAf need a connector program to the proxy if not already compiled in. OPNWAF may already have it. OPNWAF should I think run on its own, not sure what your trying to do. Crowdsec is an IP based WAF. OPNWAF uses owasp modsecurity rulesets and a few other things. I may have to look at OPNWAF, I was working on Coraza in Haproxy, open-appsec in nginx, and naxsi in nginx but says I have to manually put in owasp rules in naxsi, and squid and or nginx decryption to suricata using a transparent proxy, or reverse proxy .. There are others here who know.Are you getting log errors. Check where they are sent. Is it working getting errors or blocks or page blocks. There is a test commandin the Docs, there are websites to test it with. Did you check crowdsec forums and docs. Crowdsec shows integrating open-appsec into crowdsec engine.. Which would give crowdsec owasp modsecurity rules. Check for similar or others. If you are running opnwaf why integrate with crowdsec.

#96

German - Deutsch / BGP Prefix Lists filtern

Last post by Crunk_Bass - December 25, 2025, 12:37:27 AM

Um mehrere Firewalls und deren Netze zu verbinden, habe ich mir gedacht ich spiele mal ein bisschen mit Routing Protokollen rum.

Momentan sieht mein Testaufbau so aus:
Firewall 1 stellt einen OpenVPN Server bereit, zu dem sich Firewall 2 verbindet.
Auf beiden Firewalls ist FRR installiert und BGP konfiguriert.

Mit der Einstellung Connected routes (directly attached subnet or host) für Route Redistribution gibt es folgendes Probmlem:
Es werden sowohl die Route für lokale Subnetze als auch die WAN Adressen per BGP ausgetauscht.
Das führt dann dazu, dass die VPN Verbindung abbricht, weil die Firewalls ihre WAN IPs über den VPN Tunnel ansprechen möchten.

Von der Logik her dachte ich mir gut, dann lege ich einfach Prefix Lists an, um die ausgetauschten Routen auf RFC1918 Adressen zu beschränken.
Allerdings werden dann alle Prefixe blockiert und keine Routen mehr ausgetauscht.

Code Select

prefixStats
    inboundFiltered : 21
    aspathLoop : 0
    originatorLoop : 0
    clusterLoop : 0
    invalidNextHop : 0
    withdrawn : 0
    attributesDiscarded : 0

Wahrscheinlich habe ich in der Konfiguration nur einen Anfängerfehler und sehe ihn nicht.

Kann hier bitte mal jemand mit mehr Ahnung drüber schauen?

Konfiguration Firewall 1:

Code Select

Building configuration...

Current configuration:
!
frr version 10.5.0
frr defaults traditional
hostname firewall1.test.lan
log syslog notifications
!
ip prefix-list RFC1918 seq 10 permit 10.0.0.0/8 le 16
ip prefix-list RFC1918 seq 11 permit 172.16.0.0/12 le 20
ip prefix-list RFC1918 seq 12 permit 192.168.0.0/16 le 24
!
router bgp 65001
 bgp log-neighbor-changes
 no bgp ebgp-requires-policy
 no bgp default ipv4-unicast
 bgp graceful-restart
 neighbor 10.1.2.2 remote-as 65002
 !
 address-family ipv4 unicast
  redistribute connected
  neighbor 10.1.2.2 activate
  neighbor 10.1.2.2 soft-reconfiguration inbound
  neighbor 10.1.2.2 prefix-list RFC1918 in
  neighbor 10.1.2.2 prefix-list RFC1918 out
 exit-address-family
 !
 address-family ipv6 unicast
  redistribute connected
  neighbor 10.1.2.2 activate
  neighbor 10.1.2.2 soft-reconfiguration inbound
  neighbor 10.1.2.2 prefix-list RFC1918 in
  neighbor 10.1.2.2 prefix-list RFC1918 out
 exit-address-family
exit
!
end

Konfiguration Firewall 2:

Code Select

Building configuration...

Current configuration:
!
frr version 10.5.0
frr defaults traditional
hostname firewall2.test.lan
log syslog notifications
!
router bgp 65002
 no bgp ebgp-requires-policy
 no bgp default ipv4-unicast
 bgp graceful-restart
 neighbor 10.1.2.1 remote-as 65001
 !
 address-family ipv4 unicast
  redistribute connected
  neighbor 10.1.2.1 activate
  neighbor 10.1.2.1 soft-reconfiguration inbound
 exit-address-family
 !
 address-family ipv6 unicast
  redistribute connected
  neighbor 10.1.2.1 activate
  neighbor 10.1.2.1 soft-reconfiguration inbound
 exit-address-family
exit
!
end

Die auszutauschenden Routen liegen alle in 10.0.0.0/8 und es sind /24 Netze.

#97

Russian - Русский / Re: x2ray + tun2socks. Сделал ...

Last post by _tribal_ - December 24, 2025, 10:57:59 PM

Quote from: Serg on December 10, 2025, 07:16:01 AMсразу создавать интерфейс на который можно настроить переадресацию.

точно умеет? интересно, почему тогда на сайте синг-бокс написано, что не умеет создавать tun на freebsd или уже научилось?
Кстати, самое фиговое в том скрипте, что оно напрямую в конфиг опнсенс гвоздями вкорячивает интерфейс новый, что может аукнуться при всяких обновах.
Вот оно:

Code Select

log "$YELLOW" "添加 tun_3000 接口..."
if grep -q "<if>tun_3000</if>" "$CONFIG_FILE"; then
  log "$CYAN" "存在同名接口，忽略"
else
  awk '
  BEGIN { inserted = 0 }
  {
    print
    if ($0 ~ /<\/lo0>/ && inserted == 0) {
      print "    <opt10>"
      print "      <if>tun_3000</if>"
      print "      <descr>TUN</descr>"
      print "      <enable>1</enable>"
      print "    </opt10>"
      inserted = 1
    }
  }
  ' "$CONFIG_FILE" > "$TMP_FILE" && mv "$TMP_FILE" "$CONFIG_FILE"
  echo "接口添加完成"
fi
echo ""

тупо вписывается интерфейс в обход стандартных механизмов opnsense.

#98

German - Deutsch / Re: Frohe Weihnachten!

Last post by passeri - December 24, 2025, 09:42:28 PM

Frohe Weihnachten Patrick und alle anderen

#99

25.7, 25.10 Series / Re: DNSmasq and Unbound Peacef...

Last post by DEC670airp414user - December 24, 2025, 07:37:56 PM

when using servers that use dnssec. you don't need it enabled on the router within unbound.
that is my understanding

#100

General Discussion / Re: modified frequently, resol...

Last post by vimage22 - December 24, 2025, 05:27:43 PM

Just tested and no change. BTW, the motivation for this is to reduce disk writes.

Pages 1 ... 8 9 10