Announcement: Zenarmor WireGuard Filtering on OPNsense 24.7

[beki]

Dear Zenarmor Users,

Some of our users have reported compatibility issues with filtering WireGuard VPN traffic on OPNsense 24.7. We are currently investigating the issue. If you are using Zenarmor to protect WireGuard VPN interfaces (kernel mode), we advise you not to upgrade your OPNsense platform to the latest version until we make our next announcement for safe operation.

Best Regards
Zenarmor Team

[franco]

Kernel to try:

# opnsense-update -zkr 24.7_7

Don't forget to reboot.


Cheers,
Franco

[alexfabian]

After applying the 24.7_7 patch, the system started working perfectly again, making Zenarmor read the Logs and generate reports...

Now we have to wait for the corrections for the new dashboard widgets that are still being developed so that the system can be put into production once and for all!

Thank you once again for your prompt and attentive service.

[franco]

Thanks for confirming. Expect this to ship in 24.7.1 


Cheers,
Franco

[Seedman]

Ive already upgraded to 24.7_9, however with the native netmap driver I'm still unbale to filter WireGuard traffic.

How can i go about downgrading to 24.7_7 to use the test kernel.

Would really appreciate some guidance.

Thanks

[franco]

It's fixed in both test kernels. Have you rebooted?

[Seedman]

Yes, i have already rebooted.

[franco]

Can't help you further, sorry,

[Seedman]

Zenarmor support also asked me to avoid upgrading to 24.7_9.

Below mentioned is their email:-

"The test kernel on the Wireguard side has been patched on the OPNsense side.
 
We recommend that you make a backup before the process.
 
Kernel to try
 
opnsense-update -zkr 24.7_7
 
Don't forget to reboot
 
https://forum.opnsense.org/index.php?topic=41762.0
 
Additionally, we do not recommend updating to OPNsense 24.7_9. Wireguard works in the 24.7_7 version I provided.
 
We recommend that you follow OPNsense and Zenarmor updates."

Ive done the opnsense update via gui and have also checked for updates to zenarmor (1.17.5).

Should i be using the emulated native netmap driver under zenarmor instead of the native netmap driver?

Thank you

[franco]

I don't see any reason to avoid any amendments to 24.7. All these have been put out specifically for fix real wold issues. I can't speak for their application, but kernel and core wise all these amendments are correct.


Cheers,
Franco

[sy]

Hi all,

Zenarmor 1.17.6 version will include this fix. We plan to ship it at the end of this week.


 

[beki]

Zenarmor v1.17.6 is out. Our users can safely upgrade their Zenarmor and OPNsense platforms to the latest versions.

https://www.zenarmor.com/docs/support/release-notes