Raspberry Pi OPNsense

[jorgevisentini]

Hi all

Is possible install OPNsense in Raspberry?

I would make a firewall gateway for VPN IPsec in my work.

Thanks.

[franco]

There is an old demo for the RPI 1 Model B: https://forum.opnsense.org/index.php?topic=3793.0

A new one for PRI 2 should have been out by know, but has been delayed because we wanted to add a native SD card images to the mix but that doesn't work because we don't know why as it's impossible to debug the bootup sequence with the knowledge that we have about the RPI.

If anyone can help, the script is here:

https://github.com/opnsense/tools/blob/master/build/arm.sh

And I could upload the defunct image by request.


Cheers,
Franco

[jorgevisentini]

Thank you for explaining.

I have not yet decided whether to buy a Rasp or find other small hardware to do this.

I'm looking for information to do the best.

Thank you!

[franco]

RPI1 and PRI2 are on the brink of being to slow, but might work if you expect connectivity for cheap hardware / small space / low power, but surely not in terms of throughput.


Cheers,
Franco

[chemlud]

...I still have the raspi 1 card with the opnsense image, never tested throughput, would like to try with 1-2 usb-RJ45 interfaces.

Thought about overclocking the machine:

https://haydenjames.io/raspberry-pi-safe-overclocking-settings/

Any experience on that out there?

PS: Franco, the raspi wierd boot process is a major problem for others, too, maybe better to stick to the bootstrap method?

[loden_richard]

I don't think that raspi is so much better in overclocked state. The network interface (even the internal one) is connected via USB-Stack which limits the performance. If you stack more usb-nics into the raspi then you won't get a high performance boost anyway.

[bartjsmit]

It all depends on the requirement. Plenty people are using RPi for HD video streaming. It would satisfy a lot of usage cases where there is little budget or space and the need for silent operation.

Bart...

[franco]

PS: Franco, the raspi wierd boot process is a major problem for others, too, maybe better to stick to the bootstrap method?

Yeah but it's so slow and I already killed an SD card with the rewrite + bootstrap. Let me have one more stab at it before giving up...

[loden_richard]

@Franco: Before you smash more SD Cards, you can use emulation

[franco]

True, but it's not the same.

We are going to try BPI shortly, maybe that gives better results.


Cheers,
Franco

[Gargamel]

I would go with a small linux dist and install openvpn there.
I have run a small linux dist with openvpn in a Pi2, it works, you wont set any speed records thought.
But it gave me access to lan when i needed to.

[chemlud]

...I'm interested in the firewall/NAT part of opnsense, when runningon raspi. Use it as a "personal firewall", e.g. with wifi as wan. ;-)

[loden_richard]

@Gargamel:

If you want to a small linux image for the PI you can use the DietPI image.

[mskvortsov]

There is an old demo for the RPI 1 Model B: https://forum.opnsense.org/index.php?topic=3793.0

A new one for PRI 2 should have been out by know, but has been delayed because we wanted to add a native SD card images to the mix but that doesn't work because we don't know why as it's impossible to debug the bootup sequence with the knowledge that we have about the RPI.

If anyone can help, the script is here:

https://github.com/opnsense/tools/blob/master/build/arm.sh

And I could upload the defunct image by request.


Cheers,
Franco

Hi,

The problem seems to be the php70-7.0.24 package is broken on armv6: /usr/local/bin/php enters infinite loop because of invalid elf relocations (a toolchain bug?). If I downgrade php70-* packages to the prebuilt 7.0.7 versions from http://pkg.freebsd.org/FreeBSD:11:armv6/release_0/All, OPNSense boots successfully on RPI2:

Code: [Select]

Hit [Enter] to boot immediately, or any other key for command prompt.
Booting [/boot/kernel/kernel]...               
Using DTB provided by U-Boot at address 0x100.
Kernel entry at 0x0x2200100...
Kernel args: (null)
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2016 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 11.0-RELEASE-p12 #0 02581be96(stable/17.7): Tue Oct 17 17:08:53 UTC 2017
    root@:/usr/obj/arm.armv6/usr/src/sys/SMP-RPI2 arm
FreeBSD clang version 3.8.0 (tags/RELEASE_380/final 262564) (based on LLVM 3.8.0)
VT: init without driver.
sema_sysinit
[HBSD ASLR] status: opt-out
[HBSD ASLR] mmap: 14 bit
[HBSD ASLR] exec base: 14 bit
[HBSD ASLR] stack: 14 bit
[HBSD ASLR] vdso: 8 bit
[HBSD LOG] logging to system: enabled
[HBSD LOG] logging to user: disabled
[HBSD HARDENING] procfs hardening: enabled
[HBSD SEGVGUARD] status: opt-out
[HBSD SEGVGUARD] expiry: 120 sec
[HBSD SEGVGUARD] suspension: 600 sec
[HBSD SEGVGUARD] maxcrashes: 5
CPU: Cortex A7 rev 5 (Cortex-A core)
 Supported features: ARM_ISA THUMB2 JAZELLE THUMBEE ARMv4 Security_Ext
 WB enabled LABT branch prediction disabled
LoUU:2 LoC:3 LoUIS:2
Cache level 1:
 32KB/64B 4-way data cache WB Read-Alloc Write-Alloc
 32KB/32B 2-way instruction cache Read-Alloc
Cache level 2:
 512KB/64B 8-way unified cache WB Read-Alloc Write-Alloc
real memory  = 989851648 (943 MB)
avail memory = 953303040 (909 MB)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
random: entropy device external interface
kbd0 at kbdmux0
netmap: loaded module
ofwbus0: <Open Firmware Device Tree>
simplebus0: <Flattened device tree simple bus> mem 0x3f000000-0x3fffffff on ofwbus0
local_intc0: <BCM2836 Interrupt Controller> mem 0x40000000-0x400000ff on simplebus0
generic_timer0: <ARMv7 Generic Timer> on ofwbus0
Timecounter "ARM MPCore Timecounter" frequency 19200000 Hz quality 1000
Event timer "ARM MPCore Eventtimer" frequency 19200000 Hz quality 1000
intc0: <BCM2835 Interrupt Controller> mem 0xb200-0xb3ff on simplebus0
bcmwd0: <BCM2708/2835 Watchdog> mem 0x10001c-0x100027 on simplebus0
gpio0: <BCM2708/2835 GPIO controller> mem 0x200000-0x2000af on simplebus0
gpio0: read-only pins: 46,48-53.
gpio0: reserved pins: 48-53.
gpiobus0: <OFW GPIO bus> on gpio0
gpioled0: <GPIO led> at pin 35 on gpiobus0
gpioled1: <GPIO led> at pin 47 on gpiobus0
gpioc0: <GPIO controller> on gpio0
iichb0: <BCM2708/2835 BSC controller> mem 0x205000-0x20501f on simplebus0
iicbus0: <OFW I2C bus> on iichb0
iic0: <I2C generic I/O> on iicbus0
iichb1: <BCM2708/2835 BSC controller> mem 0x804000-0x80401f on simplebus0
iicbus1: <OFW I2C bus> on iichb1
iic1: <I2C generic I/O> on iicbus1
spi0: <BCM2708/2835 SPI controller> mem 0x204000-0x20401f on simplebus0
spibus0: <OFW SPI bus> on spi0
bcm_dma0: <BCM2835 DMA Controller> mem 0x7000-0x7fff,0xe05000-0xe05fff on simplebus0
mbox0: <BCM2835 VideoCore Mailbox> mem 0xb880-0xb8bf on simplebus0
sdhci_bcm0: <Broadcom 2708 SDHCI controller> mem 0x300000-0x3000ff on simplebus0
mmc0: <MMC/SD bus> on sdhci_bcm0
uart0: <PrimeCell UART (PL011)> mem 0x201000-0x201fff on simplebus0
uart0: console (115200,n,8,1)
vchiq0: <BCM2835 VCHIQ> mem 0xb800-0xb84f on simplebus0
vchiq: local ver 8 (min 3), remote ver 8.
pcm0: <VCHIQ audio> on vchiq0
bcm283x_dwcotg0: <DWC OTG 2.0 integrated USB controller (bcm283x)> mem 0x980000-0x99ffff on simplebus0
usbus0 on bcm283x_dwcotg0
cpulist0: <Open Firmware CPU Group> on ofwbus0
cpu0: <Open Firmware CPU> on cpulist0
bcm2835_cpufreq0: <CPU Frequency Control> on cpu0
cpu1: <Open Firmware CPU> on cpulist0
cpu2: <Open Firmware CPU> on cpulist0
cpu3: <Open Firmware CPU> on cpulist0
fb0: <BCM2835 VT framebuffer driver> on ofwbus0
fbd0 on fb0
VT: initialize with new VT driver "fb".
fb0: 656x416(656x416@0,0) 24bpp
fb0: fbswap: 1, pitch 1968, base 0x3daac000, screen_size 818688
cryptosoft0: <software crypto>
Timecounters tick every 10.000 msec
usbus0: 480Mbps High Speed USB v2.0
ugen0.1: <DWCOTG> at usbus0
uhub0: <DWCOTG OTG Root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus0
mmcsd0: 8GB <SDHC SL08G 8.0 SN ACC22582 MFG 11/2015 by 3 SD> at mmc0 41.6MHz/4bit/65535-block
bcm2835_cpufreq0: ARM 600MHz, Core 250MHz, SDRAM 400MHz, Turbo OFF
uhub0: 1 port with 1 removable, self powered
ugen0.2: <vendor 0x0424> at usbus0
uhub1: <vendor 0x0424 product 0x9514, class 9/0, rev 2.00/2.00, addr 2> on usbus0
uhub1: MTT enabled
uhub1: 5 ports with 4 removable, self powered
ugen0.3: <vendor 0x0424> at usbus0
smsc0: <vendor 0x0424 product 0xec00, rev 2.00/2.00, addr 3> on usbus0
smsc0: chip 0xec00, rev. 0002
miibus0: <MII bus> on smsc0
ukphy0: <Generic IEEE 802.3u media interface> PHY 1 on miibus0
ukphy0:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
ue0: <USB Ethernet> on smsc0
ue0: Ethernet address: b8:27:eb:3b:07:c9
Release APs
Trying to mount root from ufs:/dev/ufs/OPNsense [rw]...
warning: no time-of-day clock registered, system time will not be set accurately
Mounting filesystems...
tunefs: soft updates remains unchanged as enabled
tunefs: file system reloaded
camcontrol: cam_lookup_pass: CAMGETPASSTHRU ioctl failed
cam_lookup_pass: No such file or directory
cam_lookup_pass: either the pass driver isn't in your kernel
cam_lookup_pass: or mmcsd0 doesn't exist
** /dev/ufs/OPNsense
FILE SYSTEM CLEAN; SKIPPING CHECKS
clean, 580629 free (309 frags, 72540 blocks, 0.0% fragmentation)
** /dev/ufs/OPNsense
FILE SYSTEM CLEAN; SKIPPING CHECKS
clean, 580629 free (309 frags, 72540 blocks, 0.0% fragmentation)
random: unblocking device.
Configuring vt: blanktime.
Configuring crash dump device: /dev/null
.ELF ldconfig path: /lib /usr/lib /usr/lib/compat /usr/local/lib /usr/local/lib/ipsec /usr/local/lib/perl5/5.24/mach/CORE
Soft Float compatibility ldconfig path:
done.
>>> Invoking early script 'update'
>>> Invoking early script 'configd'
Starting configd.
>>> Invoking early script 'php'
Configuring PHP: OK
>>> Invoking early script 'backup'
Launching the init system...done.
Initializing............done.
Starting device manager...done.
Configuring login behaviour...done.

Default interfaces not found -- Running interface assignment option.
ue0: link state changed to UP

Press any key to start the manual interface assignment: 1

Valid interfaces are:
smsc0: chip 0xec00, rev. 0002
ue0: link state changed to DOWN
ue0              b8:27:eb:3b:07:c9 USB Ethernet

You now have the opportunity to configure VLANs.  If you don't require VLANs
for initial connectivity, say no here and use the GUI to configure VLANs later.

Do you want to set up VLANs now? [y/N]: n

If you do not know the names of your interfaces, you may choose to use
auto-detection. In that case, disconnect all interfaces now before
hitting 'a' to initiate auto detection.

Enter the WAN interface name or 'a' for auto-detection:

Enter the LAN interface name or 'a' for auto-detection
NOTE: this enables full Firewalling/NAT mode.
(or nothing if finished): ue0

Enter the Optional 1 interface name or 'a' for auto-detection
(or nothing if finished):

The interfaces will be assigned as follows:

LAN  -> ue0

Do you want to proceed? [y/N]: y

Writing configuration...done.
Configuring loopback interface...done.
Configuring kernel modules...done.
Setting up extended sysctls...done.
Setting timezone...done.
Writing firmware setting...done.
Setting hostname: ue0: link state changed to UP
OPNsense.localdomain
Generating /etc/hosts...done.
Starting syslog...done.
Configuring loopback interface...done.
Creating wireless clone interfaces...done.
Configuring LAN interface...smsc0: chip 0xec00, rev. 0002
done.
Generating /etc/resolv.conf...done.
Configuring firewall......done.
Setting up gateway monitors...done.
Starting web GUI...done.
Configuring CRON...done.
Setting up routes...done.
Starting Unbound DNS...done.
Starting DHCP service...done.
Generating /etc/hosts...done.
Configuring firewall......done.
Starting NTP service...deferred.
Generating RRD graphs...done.
Starting syslog...done.
>>> Invoking start script 'freebsd'
>>> Invoking start script 'carp'
>>> Invoking start script 'cron'
Starting Cron: OK
>>> Invoking start script 'beep'
Root file system: /dev/ufs/OPNsense

*** OPNsense.localdomain: OPNsense 17.7.5_22 (armv6/OpenSSL) ***

 LAN (ue0)       -> v4: 192.168.1.1/24


[mateusjua]

Hello! Would you have a step by step how to install?

I tried to execute the script arm.sh but it did not work.