WISH LIST for OPNsense

[chol]

As far as ZFS and OPNsense are concerned, actually it is sometimes not uninteresting to buy a book and read.

I bought me the new 2nd ed. of "The Design and Implementation of the FreeBSD Operating System". There, introductory page 24 has some interesting specs:

The Zettabyte filesystem is listed as having 256125 lines of code, which represent 16,2% of the machine-independent code of the 2015 FreeBSD kernel.

Out of a strict security viewpoint, this was a huge attack surface, isn't it?


Power failure: Did you have problems with the use of an embedded OPNsense version or with a full install? Seems to me, you're calling for a nanoBSD version at your site, with RAM disk and an external log server.

[weust]

You actually go though the pain or changing the colour for the occasional (re)boot of the machine?
Damn...

[Supermule]

No no it survives the reboot.

It doesnt survive an update to a newer version

[franco]

I need some click and edit options

Maybe we can work out something better. Loader.conf should have a GUI like Tunables. We also want to bundle a colour picker for the themes eventually. Everything is SCSS so you can have branding colours throughout the GUI consistently.

chol: modern file system tend to grow considerably in LOC. It's a tradeoff between stability vs. complexity vs. features. Features and stability win for ZFS. Not sure about the volume of exploits against it, but I haven't seen many.

[Supermule]

That would be awesome!

Currently using the file manager package in pfsense to do the editing.

[windozer]

I'm not sure whether this classifies as a wish for FreeBSD or OPNsense, but here it is - baby-jumbo frames in PPPoE.

[jstrebel]

What is the application for this? PPPoE is normally limitted by the operator to 14xx.


Gesendet von iPhone mit Tapatalk

[windozer]

Mostly found in FTTx(fibre) and in some cases (v)DSL. It's an extension to PPPoE that makes up for the PPPoE overhead & thus to have MTU like LAN - therefore less segmentation. This is assuming that the WAN port is gigabit capable because the MTU is set to 1508. It's prevalent in UK and rest of the world.

RFC 4638 - Accommodating a Maximum Transit Unit/Maximum Receive Unit (MTU/MRU) Greater Than 1492 in the Point-to-Point Protocol over Ethernet (PPPoE)

OpenBSD RFC 4638 support for pppoe

[gratis]

How about DNSCrypt?

Currently using OpenWRT router with DNSCrypt package, and a few FreeBSD machines using dnscrypt-proxy pkg with Unbound. Apparently, there is discussion on the PFSense forum of people doing a "pkg install dnscrypt-proxy" from the terminal and getting it setup FreeBSD style, even though it is not currently a PFSense package, but on OPNSense the package is not found in the repository.

I am currently testing the OpenDNS functionality of OPNSense, but there are a lot of DNSCrypt enabled DNS servers out there, other than just OpenDNS, as seen here: https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv

Just sharing my thoughts, for what it's worth... Great work, by the way.

[franco]

Gratis, I have added dnscrypt-proxy to the package mirror: https://github.com/opnsense/tools/commit/2d415dbd9facf476d308746baceafad3a7913349

As soon as 15.1.12 is out tomorrow, it can be installed using the usual pkgng magic. If somebody works on getting GUI support going for OPNsense, we're more than happy to help polish it and pull it in.

[gratis]

Very nice. Thanks for the prompt response, and your efforts...

[guest7876]

my Wish list includes Tor and polipo as a caching proxy for Tor. have not investigated whether squid could
be used in place of polipo.

both of these packages are available to FreeBSD 10.1.

i wouldnt mind helping with building the GUI for this add-ons once you get your plans finished up for
how the Add-ons will be integrated. i know some about bootstrap.

this would be awesome from the security point for people.

other one would be sixxs-aiccu for IPv6 Tunnel since my provider doesnt provide v6.
also willing to help on building the GUI for this one as well.

let me know what i can do to help and point me to any documentation on a starting point.
im pretty well versed on pkg and how it works.

[franco]

Hi wild045,

I will take care of the packages requests soon: https://github.com/opnsense/tools/issues/12

As far as pkg and our new plugin infrastructure (what pfSense calls packages essentially) goes one doesn't need to care about pkg at all as the plugin build framework wraps everything already. What is barely working is the plugin plugin into the running system. It works by manually reloading the web server, typing the URL in the browser, but we want to have a dynamic menu and backend service as well to make sure the plugins deserve their name.

If anybody wonders why plugins are not named packages, well, FreeBSD already has designated terms for ports and packages and everything is already packaged in OPNsense (except base/kernel) so we thought plugins would be a more fitting term. Also, alliterations are neat.


Cheers,
Franco

[guest7876]

Franco,

i understand the pkg system well. ive been a FreeBSD admin since before 4.x came out.

please dont forget the sixxs-aiccu package. for people that need the v6 tunnel to sixxs , its handy.

looking forward to seeing how you implement the dynamic framework in opnsense. and then i can get to
work, working on getting GUI's for the few packages i referenced.

in the meantime , im assuming i can just install the packages i referenced and edit the config files manually
and start the services correct?

[franco]

Not all packages from the repository are installed by default. You can query the remote by:

# pkg rquery "%n: %c"

You'll notice sixxs-aiccu is already there waiting to be installed.

And, yes, you can configure /etc/rc.conf, but you'll have to run "service xxx start" manually for now. We have an automatic hook, but it needs to be replaced as it is not working very well, e.g. with open-vm-tools(-nox11).