Reporting -> Insight not working properly

[myksto]

Hello.
I've been using OPNSense for some months.
I'm on version 18.1.7, just updated.
I noticed a strange behaviour on the fantastic reporting section named "Insight".
I go on "Totals" tab then I go down to "Top usage ports/sources.
By default WAN is selected.
On the right of the graph I see several ip addresses (public ones) and if I go on the pie chart and select one of them, system takes me to the "Details" tab and put the ip address I select inside the "(src) Address" field as expected.
If I go back to the "Totals" tab, select "LAN" as the interface, choose and click on a IP adrress (private one this time) on the pie chart, system takes me to the "Details" tab but on the "src Address" put another IP address (public one) and NOT the one I chose before.

Beside if "WAN" is selected a small pop-up showing the ip address comes up when I go over the pie chart with the mouse but if I select LAN or another interface more often than not no IP is being shown.

I tried with Google Chrome and Mozilla Firefox and the behaviour is the same.

Is there a way to fix this "issue"?

Thanks a lot and cheers.

Michele.

[myksto]

Really no one can help???

Thanks a lot.

[opnfwb]

I'm not sure of the cause but, I am also able to duplicate the same behavior that you are describing.

[myksto]

Well, that means the "problem" exists and that I was good at explaining it. 
I really hope some guru of the developers group will give us an answer.

Cheers.

[marjohn56]

You may want to raise an issue on Github - https://github.com/opnsense/core/issues

[myksto]

Thanks, just done.

https://github.com/opnsense/core/issues/2405

Michele.

[franco]

Hi Michele,

Thanks for the ticket. Way better to keep track of precise issue reports like this. Did you try the patch? Does it work for you?


Cheers,
Franco

[myksto]

Hi Franco and thanks to you for reply.
I'm trying to follow discussion on github but to be sincere I don't understand it in a complete way.
I read some people are talking about a patch but I didn't understand where I can eventually find it and how I can apply it.
Furthermore my OPNSense is in a production environment: do I run any risk to apply such a patch? Or is it just like a OPNSense update?

Please let me know.

Cheers,
Michele.

[kapara]

Kind of off thread but I always keep a secondary cold firewall on hand for just this type of scenario.  Build it out apply patch, test and if all is good swap with the other one and perform the same.  Your down time will be even less as it is just a swap of the cables compared to a reboot.  Always keep a spare!  When dealing with opensource firewalls you don't have the luxury of support options like Cisco but you save a boat load of money!!!

[myksto]

Kapara,
I expecially need to know where to catch and how to apply the patch.
If you can help me in doing that please let me know.
Anyway thanks for your "precious" advise. 

[franco]

Hi Michele,

It's pretty straightforward. Mentioned are two commits:

https://github.com/opnsense/core/commit/3ac6a8
https://github.com/opnsense/core/commit/fc0507

You can install them manually from the console by issuing:

# opnsense-patch 3ac6a8 fc0507

And if they don't work better remove them again (reverse order):

# opnsense-patch fc0507 3ac6a8

Patches are for testing, so they don't stick around on firmware upgrades so e.g. 18.1.8 today will undo your patches and if you want them in the system again just add them anew. As soon as they are shipped you can stop patching the system or wait for that particular update.

Hope this helps.


Cheers,
Franco

[myksto]

Hi Franco,
thanks for your usual clear explanations.
I applied the patches and now:

• I see pop-ups when I go on pie chart and select "LAN" or "DMZ" interface. Before the patch I saw pop-ups only when WAN interface was selected. So I guess I can claim that patches solved this issue.
  
• Unfortunately if I go on "Totals" tab and go down to "Top usage ports/sources", select "LAN" or "DMZ" as the interface, choose and click on a IP address (private one) on pie chart (the one on the right), system takes me to the "Details" tab, put "LAN" in the interface filed but on the "src Address" put another IP address (a public one) and NOT the one I chose before. This is the same behaviour as before.
• Everything is working ok on the pie-chart on the left of the page (ports, services) whatever interface I select.

Do I have to report my results on the GitHub portal?

Thanks and cheers,
Michele.

[franco]

Hi Michele,

Yes, point two should be mentioned on GitHub.


Thanks,
Franco

[myksto]

Ok Franco.
Posted on GitHub as you suggested.

Thanks,
Michele.

[myksto]

Hello.
I saw that on GitHub tech conversions went on but I can't undestand whether the issue has been solved or not.
Is there any new patch to apply?

Thanks,
Michele.