Sensei on OPNsense - Application based filtering

[mb]

Hi @actionhenkt,

When browsing the session explorer, I wanted to block a website directly from the session explorer, is it possible block single
websites without blocking the whole web/app control from the session explorer ? 

Good catch!. We'll add this to the upcoming release. Hopefully will ship with 1.1.

Is it possible to bulk import websites into the "white/black-list" ?
Can I add my own webcontrols/appcontrols ?

Not yet. Both roadmap items.

Redirect to the "block page" doesnt work when connecting over https. Do I need TLS inspection for this ?

Correct, since TLS session preceeds the HTTP session. Yes, with TLS, this would be possible.

[mb]

Dear Sensei users,

Some good news from a super-busy month working on the upcoming 1.1 release. Here are some of the major goodies that are shipping with 1.1.

The most notable one is the support for low-end devices. We're now able to install on low-end devices with weak CPUs and with memory as low as 2GB. Yes!, with reporting.

Please find the detailed list below.

We're targeting early November for the release.

In the meantime, just PM me if you'd like to test drive before it's made publicly available.

What will be coming up with Sensei 1.1

Better low-end device support

• Support for low-end devices with weak CPUs. Try Sensei on your Deciso A10 / Pcengines APU devices: Yes! with reporting
• Minimum RAM requirement lowered to 2GB

More interface support

• lagg(4) and bridge(4) interface members can be protected now

New Cloud Servers Infrastructure goes live

• New less-latency cloud servers for US-West, US-East, Asia and Australia regions
• New web category/threat intelligence database
• Improved/faster cloud query mechanism
• Better availability
• Status screen now shows uptime in a prettier format

Reporting

• Reporting Performance Improvements (Reports load faster (a lot faster )

[opnsenseuser]

Dear Sensei users,

Some good news from a super-busy month working on the upcoming 1.1 release. Here are some of the major goodies that are shipping with 1.1.

The most notable one is the support for low-end devices. We're now able to install on low-end devices with weak CPUs and with memory as low as 2GB. Yes!, with reporting.

Please find the detailed list below.

We're targeting early November for the release.

In the meantime, just PM me if you'd like to test drive before it's made publicly available.

What will be coming up with Sensei 1.1

Better low-end device support

• Support for low-end devices with weak CPUs. Try Sensei on your Deciso A10 / Pcengines APU devices: Yes! with reporting
• Minimum RAM requirement lowered to 2GB

More interface support

• lagg(4) and bridge(4) interface members can be protected now

New Cloud Servers Infrastructure goes live

• New less-latency cloud servers for US-West, US-East, Asia and Australia regions
• New web category/threat intelligence database
• Improved/faster cloud query mechanism
• Better availability
• Status screen now shows uptime in a prettier format

Reporting

• Reporting Performance Improvements (Reports load faster (a lot faster )

great news :-) an sensei widget would be also great! thx regards rené

[mayo]

Great!

[mb]

great news :-) an sensei widget would be also great! thx regards rené

Hi rené,

What would you like to see in the widget?

[tong2x]

great news :-) an sensei widget would be also great! thx regards rené

Hi rené,

What would you like to see in the widget?

network interface with the throughput
(as a scale of time of possible)

maybe...
recent security blocks
(no idea yet if in graph or test)

[mb]

I guess throughput is already available in OPNsense widgets?

recent security blocks

Got it. Any other ideas?

[opnsenseuser]

great news :-) an sensei widget would be also great! thx regards rené

Hi rené,

What would you like to see in the widget?

maybe some of the status informations of sensei as widget?

[mb]

maybe some of the status informations of sensei as widget?

Good idea. Got it.

[mb]

Dear Sensei users,

We've made release 1.1 available for LibreSSL users. LibreSSL flavor users can now do a fresh install for / update to Release 1.1.

Tests underway for OpenSSL flavor. Hope to ship this one on Tuesday.

[mow4cash]

Just wanted to say it's a very nice interface and works well. Very user friendly. Ran into an issues where the reports are getting corrupted and I have to fix them. How far away on the roadmap is importing custom whitelist/blacklist and will it be on the free tier? Maybe even a page to add url's to pull our favorite lists and a few popular ones preloaded to enable? With the new update taking away more control I'm going to have to whitelist some porn sites

[JohnDoe17]

I just updated from 19.1.10 to 19.7.6.  Now I'm getting the following message every time I click on the Dashboard:

Elasticsearch service is not running!  In order to view reports, you need to start Elasticsearch service. Do you want to start it?

And when I click "Yes," it doesn't seem to start.  I just get a

Waiting for database service to come up

bar.

This used to work fine.  Any ideas?

[JohnDoe17]

I just noticed some messages on the console that don't look good either.  I don't know if they are related to my Sensei issue or not, but I thought I'd post them in case they were.

See attachment.

[mb]

I just updated from 19.1.10 to 19.7.6.  Now I'm getting the following message every time I click on the Dashboard:

Elasticsearch service is not running!  In order to view reports, you need to start Elasticsearch service. Do you want to start it?

This used to work fine.  Any ideas?

@JohnDoe17,

Messages on the console are related to HardenedBSD's SEGVGUARD. It detected that syslog-ng process crashed several times. This does not seem to be related to Sensei.

There was a major python upgrade from 2.7 to 3.7 in OPNsense 19.7. We have mechanisms to handle this, though it's possible to miss something.

Can we have a look at your system together? I'll be contacting you.

[mb]

Dear Sensei users,

Can anyone who is experiencing Elasticsearch issue contact me? We can't reproduce this in our test/PoC systems.

Any help is much appreciated.