[Work In Progress] OPNsense Ported into ARM Devices

[rene_]

This could be interesting 

[dgktkr]

Do OPNsense builds for arm devices have logging disabled somehow? When using OPNsense as a gateway, "Inspect" shows large number of packets being blocked for some rules, but nothing shows up in the logs even though logging has been selected for those rules.

[kayti]

Hello, i have problem with running OPNsense on RPI2. Somehow, after installing img from opening post on SD card, RPI2 boots, but after loading kernel screen goes black and device is unresponsive, ETH not working too.
Last msg before black screen is something like:
Booting [/boot/kernel/kernel]...
/boot/dtb/bcm2836-rpi-2-b.dtb size=0x385e
Loaded DTB from file 'bcm2836-rpi-2-b.dtb'.
Kernel entry at 0x200180...
Kernel args: (null)

I tried 2 different SD cards (which both work normally on raspbian).
After that tried to compile myself but on FreeBSD 11.2 amd64 i get errors when # make base DEVICE=RPI2 so compiling is unsuccessful... Something about [clang], already removed VM so can't check. Any idea?

[nekoprog]

http://wiki.friendlyarm.com/wiki/index.php/NanoPi_R1S-H5

Was there ever a opnsense device for less than $25 which does the job? This could be the first one! 

I prefer at least 1GB of RAM to make it worth the time. Currently I'm working on NanoPi R1 device patch, let's hope FreeBSD accept it.

Hello, i have problem with running OPNsense on RPI2. Somehow, after installing img from opening post on SD card, RPI2 boots, but after loading kernel screen goes black and device is unresponsive, ETH not working too.
Last msg before black screen is something like:
Booting [/boot/kernel/kernel]...
/boot/dtb/bcm2836-rpi-2-b.dtb size=0x385e
Loaded DTB from file 'bcm2836-rpi-2-b.dtb'.
Kernel entry at 0x200180...
Kernel args: (null)

I tried 2 different SD cards (which both work normally on raspbian).
After that tried to compile myself but on FreeBSD 11.2 amd64 i get errors when # make base DEVICE=RPI2 so compiling is unsuccessful... Something about [clang], already removed VM so can't check. Any idea?

These two are different problem entirely.
1. Where do you get the image that hangs on boot?
2. If you have the image ready, why did you stuck on first stage of build? What config did you use with FreeBSD11.2? Need more details so that we can help you better.

Attached here is my RPI2 running OPNsense 20.1, I can confirm that opnsense/tools is working just fine.

[kayti]

Which version of RPI2 You have? I know, that there are 2 revisions, 2 different SOCs. I have first version with older CPU (V1.1), newer has the same as RPI3 but underclocked (V1.2).

I tried to use image from the first post of this topic. Resulted with black screen after initial booting, last msg was:
Booting [/boot/kernel/kernel]...
/boot/dtb/bcm2836-rpi-2-b.dtb size=0x385e
Loaded DTB from file 'bcm2836-rpi-2-b.dtb'.
Kernel entry at 0x200180...
Kernel args: (null)

After this message screen goes black, and both LEDs on RPI turn off. Ethernet port also is inactive (both LEDs are turned off).

Lately i successfully compiled new IMG from latest OPNSESNSE tools (19.7 on 11.2 FreeBSD). But the result after putting it on SD card is the same. Still black screen. I have now no idea how to tackle it.

EDIT. Can You share Your latest img? Either 19.7 or 20.1, maybe i'm doing something wrong.

[RoyJones]

Hello,
I used the image "OPNsense-201905020045-OpenSSL-arm-aarch64-rpi3" of https://drive.google.com/drive/folders/1bAWuECNJwu0LdJOpaIn-2MrTKZ8evGNY NekoProg for my  Raspberry Pi 3 B+.

The following error occurs, it seems he can't find the image he needs to boot. ?

Image: https://ibb.co/4KmTv9q

Does anyone have a solution ?

[tsgan]

Was able to run OPNsense 20.1 on NanoPI R1S H5 version of board.

[marshalleq]

Looks fantastic - I'm still searching for the perfect board - gotta have two nics somehow and hopefully get close to Gigabit speed. (By close I mean 500+ range is prob good enough.

Now that arm is apparently working, we just need to find the right hardware.  I wonder if there are any network hats and if this will run on Rpi4 given it has a bit of extra RAM and faster bus speed - there could be some options there.

[tsgan]

Network wise either espressobin or machiatobin is better. IIRC, espressobin is cheapest OPNsense also works.

[marshalleq]

Great timing, I just through googling actually had success finding espressobin - have googled many times before and found nothing - quite excited now!  The other one is basically the cost of a computer, so not really so keen on that - may as well just get a cheap ryzen on a micro atx or some other low powered x86 cpu for the difference.  Do you happen to know if there's any luck getting pásense or opnsense on the espresso bin?  I'm about to start googling that, but maybe you can give me a head start...  Looks like it could just be another mod to the arm port - that would be exciting.

Thanks,

Edit: Just saw this: https://forum.opnsense.org/index.php?topic=15361.0

[tsgan]

pfsense works on this device:

https://www.netgate.com/solutions/pfsense/sg-1100.html

As for OPNsense, you can try my image (it is not official one):

https://people.freebsd.org/~ganbold/OPNsense-201912171639-OpenSSL-arm-aarch64.img.xz

It works for me on espressobin.

[marshalleq]

I've just been reading the reviews of the espressobin and they don't seem particularly positive.  Any thoughts on that?  They mention heat and faulty hardware and non existent support and forums riddled with spam.  Probably don't need a ton of support, but overheating and faulty hardware sound challenging.  How's your experience been?

Just looking at that SG-1100 - it looks like it will struggle with all but the most basic use cases - and homes are no longer basic with all the video downloads and Skype and netflix, youtube, game sharing and such.  It's actually why I moved to Opnsense on a PC - the Asus router (similar specs to the SG-1100 didn't handle it except for very basic traffic and packet filtering.  If I can't run IDS / IPS, then may as well go back to the ASUS right?

I find the situation quite interesting - the hardware companies are all priced by connection speed with all the top connection speeds typically going to enterprise customers.  They can't seem to quite figure out how to get it to work for any consumer with a Gigabit connection.

[tsgan]

As for IDS/IPS, suricata doesn't run yet on arm64 hardware.
loos@ said espressobin v7.2 is recommended once they are released.

You can stay with your PC if your usage is so heavy that it can't run on devices.

[max660]

Hi All,
i've a cluster of 5 pi 4's with kvm on each node.
I would like to install opnsense on a vm but i cannot with the imgs files... Could someone can give me an installer in .iso format so i can install it on the vm.
(i've already checked on FreeBSD Page to a file but i've found only .img files)

[jo3rg]

Hi everyone,
has anyone ever tried to port it for armv8 (khadas vim3)?
I think it should have a big performance advantage in crypto things (openvpn) compared to other boards.
Is there any guide on how to setup an environment for crosscompiling?
Thanks and regards
Joerg