OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Zenarmor (Sensei) »
  • Sensei on OPNsense - Application based filtering
« previous next »
  • Print
Pages: 1 ... 40 41 [42] 43 44 ... 79

Author Topic: Sensei on OPNsense - Application based filtering  (Read 359825 times)

sol

  • Newbie
  • *
  • Posts: 36
  • Karma: 3
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #615 on: November 19, 2019, 09:33:20 pm »
Thank you!
Logged

opnsenseuser

  • Sr. Member
  • ****
  • Posts: 381
  • Karma: 25
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #616 on: November 19, 2019, 09:34:24 pm »
Quote from: mb on November 19, 2019, 09:32:36 pm
rene, i was able to reproduce the issue. thanks for the hand. 1.1_4 coming up shortly.

that is fast. what´s the problem?
Logged
Supermicro A2SDi-4C-HLN4F
Team Rebellion Member (sidebar / themes: tukan, cicada & vicuna)

mb

  • Hero Member
  • *****
  • Posts: 908
  • Karma: 97
    • View Profile
    • Sunny Valley Networks
Re: Sensei on OPNsense - Application based filtering
« Reply #617 on: November 19, 2019, 09:35:44 pm »
Quote from: sol on November 19, 2019, 09:26:52 pm
In regards of dns: is it maybe dnscrypt proxy which interfers here?

sol, the issue with rene is different. yes, if you have dns encryption most probably this is the reason.
Logged

mb

  • Hero Member
  • *****
  • Posts: 908
  • Karma: 97
    • View Profile
    • Sunny Valley Networks
Re: Sensei on OPNsense - Application based filtering
« Reply #618 on: November 19, 2019, 10:48:54 pm »
Quote from: opnsenseuser on November 19, 2019, 09:34:24 pm
that is fast. what´s the problem?

rene, it was a sanity check going wrong because of a missing if condition ;) Fix was easy, 1.1_4 hotfix is out. Enjoy.

sol, we're thinking of implementing "lazy dns resolution" for these cases like dns encryption. This will allow Sensei to do realtime dns query for any ip addresses for which it does not have a dns mapping in its cache. Most probably it'll ship Q2 2020.
Logged

opnsenseuser

  • Sr. Member
  • ****
  • Posts: 381
  • Karma: 25
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #619 on: November 20, 2019, 09:28:46 am »
Quote from: mb on November 19, 2019, 10:48:54 pm
Quote from: opnsenseuser on November 19, 2019, 09:34:24 pm
that is fast. what´s the problem?

rene, it was a sanity check going wrong because of a missing if condition ;) Fix was easy, 1.1_4 hotfix is out. Enjoy.

sol, we're thinking of implementing "lazy dns resolution" for these cases like dns encryption. This will allow Sensei to do realtime dns query for any ip addresses for which it does not have a dns mapping in its cache. Most probably it'll ship Q2 2020.

you are the best. thx for your really fast response.i´ll test this later!. :-)
Logged
Supermicro A2SDi-4C-HLN4F
Team Rebellion Member (sidebar / themes: tukan, cicada & vicuna)

opnsenseuser

  • Sr. Member
  • ****
  • Posts: 381
  • Karma: 25
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #620 on: November 20, 2019, 04:04:57 pm »
Quote from: mb on November 19, 2019, 10:48:54 pm
Quote from: opnsenseuser on November 19, 2019, 09:34:24 pm
that is fast. what´s the problem?
rene, it was a sanity check going wrong because of a missing if condition ;) Fix was easy, 1.1_4 hotfix is out. Enjoy.

works. thx very much!! :-)

2 more questions:

1. is there a way to make a custom block html template? and perhaps upload it?
2. i get this error message in System: Firmware: Reporter
Code: [Select]
[20-Nov-2019 15:50:33 Europe/Vienna] PHP Warning:  explode() expects parameter 2 to be string, array given in /usr/local/opnsense/mvc/app/controllers/OPNsense/Sensei/Api/WidgetController.php on line 175
[20-Nov-2019 15:50:33 Europe/Vienna] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/opnsense/mvc/app/controllers/OPNsense/Sensei/Api/WidgetController.php on line 176
[20-Nov-2019 15:50:33 Europe/Vienna] PHP Warning:  explode() expects parameter 2 to be string, array given in /usr/local/opnsense/mvc/app/controllers/OPNsense/Sensei/Api/WidgetController.php on line 181
[20-Nov-2019 15:50:33 Europe/Vienna] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/opnsense/mvc/app/controllers/OPNsense/Sensei/Api/WidgetController.php on line 182
Logged
Supermicro A2SDi-4C-HLN4F
Team Rebellion Member (sidebar / themes: tukan, cicada & vicuna)

mb

  • Hero Member
  • *****
  • Posts: 908
  • Karma: 97
    • View Profile
    • Sunny Valley Networks
Re: Sensei on OPNsense - Application based filtering
« Reply #621 on: November 21, 2019, 03:53:50 am »
Hi rene, you're all welcome. custom landing page is available within Premium Features. SOHO Edition is coming this week.

Dashboard widget error got already fixed in 1.2, which will also ship this week :)
Logged

opnsenseuser

  • Sr. Member
  • ****
  • Posts: 381
  • Karma: 25
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #622 on: November 21, 2019, 05:00:07 am »
Quote from: mb on November 21, 2019, 03:53:50 am
Hi rene, you're all welcome. custom landing page is available within Premium Features. SOHO Edition is coming this week.

Dashboard widget error got already fixed in 1.2, which will also ship this week :)

is there no standard block template in the free edition ?. because the message that I get when blocking a page is a connection error page. It is therefore difficult to determine if this is a real connection error or not.
the html block template that I found did not work. or is it intended?

best regards, rene

supplement:
I noticed now, if I use "app controls" and block for example, facebook, then there is no html block template but only a connection error page (see my screenshot). if I block a page under "web control", then comes the block template. Is it wanted like that? best regards, rene

« Last Edit: November 21, 2019, 04:42:41 pm by opnsenseuser »
Logged
Supermicro A2SDi-4C-HLN4F
Team Rebellion Member (sidebar / themes: tukan, cicada & vicuna)

tusc

  • Newbie
  • *
  • Posts: 31
  • Karma: 4
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #623 on: November 21, 2019, 10:49:20 pm »
So I'm still experiencing issue where traffic completely halts shortly after the engine service is started. I never could figure out the problem so didn't use this for a while. I'm now on the latest version and it's still happening. I have a 4 port intel card where igb0 is LAN and igb1 is WAN. There's an onboard Realtek I'm not using (re0).

Searching in /usr/local/sensei/log/active I see this in the logs
Code: [Select]
root@OPNsense:/usr/local/sensei/log/active # egrep igb main*
main_20191119T000000.log:2019-11-19T10:45:28 INFO: Worker [@0,Bridged,Lan=netmap@igb0,Wan=netmap@igb0^,Queue=0,Cpu=1
main_20191119T000000.log:2019-11-19T21:18:49 INFO: Worker [@0,Bridged,Lan=netmap@igb0,Wan=netmap@igb0^,Queue=0,Cpu=1
main_20191120T000000.log:2019-11-20T19:16:42 INFO: Worker [@0,Bridged,Lan=netmap@igb0,Wan=netmap@igb0^,Queue=0,Cpu=1

Why is WAN referencing igb0^? Shouldn't it be igb1?

If I grep for igb1 in the directory nothing comes back.

Here's another output from a worker logfile:

Code: [Select]
root@OPNsense:/usr/local/sensei/log/active # egrep igb worker0_20191120T000000.log | tail
2019-11-21T14:57:19 INFO:               Stats LAN igb0:0 [ 4024 pkts, 0 drp, 610.74 KB]
2019-11-21T14:57:19 INFO:               Stats LAN igb0:1 [ 109564 pkts, 0 drp, 150.78 MB]
2019-11-21T14:57:19 INFO:               Stats LAN igb0:2 [ 27493 pkts, 0 drp, 2.00 MB]
2019-11-21T14:57:19 INFO:               Stats LAN igb0:3 [ 33916 pkts, 0 drp, 2.54 MB]
2019-11-21T14:57:19 INFO:               Stats WAN igb0^ [ 239646 pkts, 0 drp, 177.91 MB]
2019-11-21T14:57:20 INFO:               Stats LAN igb0:0 [ 4024 pkts, 0 drp, 610.74 KB]
2019-11-21T14:57:20 INFO:               Stats LAN igb0:1 [ 109564 pkts, 0 drp, 150.78 MB]
2019-11-21T14:57:20 INFO:               Stats LAN igb0:2 [ 27493 pkts, 0 drp, 2.00 MB]
2019-11-21T14:57:20 INFO:               Stats LAN igb0:3 [ 33917 pkts, 0 drp, 2.54 MB]
2019-11-21T14:57:20 INFO:               Stats WAN igb0^ [ 239646 pkts, 0 drp, 177.91 MB]

Let me know what else I can provide to help troubleshoot this as I've noticed others have posted a similar problem. Thanks.
Logged

mb

  • Hero Member
  • *****
  • Posts: 908
  • Karma: 97
    • View Profile
    • Sunny Valley Networks
Re: Sensei on OPNsense - Application based filtering
« Reply #624 on: November 22, 2019, 01:20:22 am »
Hi Rene,

Yes, customizable block page is available in Premium.

1. With regard to how we display block page: we display Block Page only if it is an HTTP connection.
2. For HTTPS connections, since TLS comes early and client and server does not yet speak HTTP, we cannot display.
3. For Application control, we do not display since it might be a connection which does not speak HTTP.

For the third item, I think there is a window of improvement there; since we can still detect if it is HTTP
and therefore we can display a block page.

For HTTPS connections, block pages will be available along with TLS feature.
Logged

mb

  • Hero Member
  • *****
  • Posts: 908
  • Karma: 97
    • View Profile
    • Sunny Valley Networks
Re: Sensei on OPNsense - Application based filtering
« Reply #625 on: November 22, 2019, 01:32:43 am »
Hi @tusc,

WAN in that file is an internal Sensei terminology and it is different from general firewall terminology. Sensei acts like a bridge connecting hardware rings of the ethernet driver and the Operating System network stack (with the help of netmap). Taking into account the fact that we're protecting LAN-facing interfaces, Sensei considers the Operating System side of the "virtual bridge" as WAN since packets going to/coming from that way is Internet-bound.

It is expected that packet flow can pause a 2-5 seconds during engine restarts. This is because once sensei starts running it initializes the interfaces in netmap mode which -in turn- causes them to go down/up.

If it halts the packet flow permanently, this is very interesing, which I would definitely want to have a look. Can you PM me so that we dive into this?
Logged

donatom3

  • Jr. Member
  • **
  • Posts: 67
  • Karma: 11
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #626 on: November 22, 2019, 04:56:21 am »
@MB

How does soho work with the 15 device limit for those of us with well over that on our home networks?
Do we pick and choose what's protected or is it any device that's on the protected interface?
Logged

robvanhooren

  • Newbie
  • *
  • Posts: 13
  • Karma: 5
    • View Profile
index not found exception?
« Reply #627 on: November 22, 2019, 06:52:47 am »
hi, fresh install, and I'm getting a ton of 'index not found exception' errors, with a lot of sensei panels displaying a red error box.

"An error occurred while report is being loaded!"

details and log excerpt below.

thoughts?

thanks.


Code: [Select]
{
  "error": {
    "root_cause": [
      {
        "type": "index_not_found_exception",
        "reason": "no such index",
        "resource.type": "index_or_alias",
        "resource.id": "alert_all",
        "index_uuid": "_na_",
        "index": "alert_all"
      }
    ],
    "type": "index_not_found_exception",
    "reason": "no such index",
    "resource.type": "index_or_alias",
    "resource.id": "alert_all",
    "index_uuid": "_na_",
    "index": "alert_all"
  },
  "status": 404
}


 -----8<-----{snip}-----8<-----
/usr/local/sensei/log/active

ipdr_streamer.log:2019-11-22T00:43:47.637231 response: {"took":0,"errors":true,"items":[{"index":{"_index":"http_write","_type":"http","_id":null,"status":404,"error":{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_expression","resource.id":"http_write","index_uuid":"_na_","index":"http_write"}}},{"index":{"_index":"http_write","_type":"http","_id":null,"status":404,"error":{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_expression","resource.id":"http_write","index_uuid":"_na_","index":"http_write"}}},{"index":{"_index":"http_write","_type":"http","_id":null,"status":404,"error":{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_expression","resource.id":"http_write","index_uuid":"_na_","index":"http_write"}}}]}


Logged

Quetschwalze

  • Newbie
  • *
  • Posts: 29
  • Karma: 3
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #628 on: November 22, 2019, 11:46:10 am »
Love the plugin!
Will there be a monthly option for paid home use?
Logged

opnsenseuser

  • Sr. Member
  • ****
  • Posts: 381
  • Karma: 25
    • View Profile
Re: Sensei on OPNsense - Application based filtering
« Reply #629 on: November 22, 2019, 02:52:56 pm »
Quote from: mb on November 22, 2019, 01:20:22 am
Hi Rene,

Yes, customizable block page is available in Premium.

1. With regard to how we display block page: we display Block Page only if it is an HTTP connection.
2. For HTTPS connections, since TLS comes early and client and server does not yet speak HTTP, we cannot display.
3. For Application control, we do not display since it might be a connection which does not speak HTTP.

For the third item, I think there is a window of improvement there; since we can still detect if it is HTTP
and therefore we can display a block page.

For HTTPS connections, block pages will be available along with TLS feature.

thx for your information. this plugin is really really great!. great work! :-)
Logged
Supermicro A2SDi-4C-HLN4F
Team Rebellion Member (sidebar / themes: tukan, cicada & vicuna)

  • Print
Pages: 1 ... 40 41 [42] 43 44 ... 79
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Zenarmor (Sensei) »
  • Sensei on OPNsense - Application based filtering
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2