Sensei on OPNsense - Application based filtering

[RamSense]

I use Opnsense with Sensei and have ads blocked for the Lan devices. Works great. Only problem is with the mobile devices connected by 4g-vpn redirect gateway- sensei -> does not block ads on those devices. Everything else is working. This while I have added both interfaces in sensei-configuration.

Anybody else having this issue? Know how to solve?

[Nekromantik]

Hi

Can we have a free edition for devices less then 15?
I dont have 50 so spending  $10 a month on home seems a lot when max I have 5 devices.

[sy]

Hi @Nekromantik,

You can use the free edition for your network. Home and other licenses provide extra features. But if you ask a license type for fewer devices, unfortunately, the basic license is Home 100.

[Nekromantik]

Hi @Nekromantik,

You can use the free edition for your network. Home and other licenses provide extra features. But if you ask a license type for fewer devices, unfortunately, the basic license is Home 100.

ok

[mb]

Hi @RamSense, can you confirm if blocking is working with PCs over vpn ? I want to make sure if this is a mobile problem.

[RamSense]

@MB,

That is a good question. I tried with my MacBook outside of my network with vpn connection, and the adds appear, no blocking.
When I am on my MacBook on wifi at home, no vpn, adds are being blocked.
At home iPhone wifi - vpn -> no adds getting blocked.
At home iPhone wifi - no vpn -> adds are being blocked

[mb]

@ramsense, we suspect that this is due to netmap tun support adding null byte ethernet header.

We want to send you a test kernel. Can you reach out to support? Let's take it from there.

[RamSense]

Thank you for your reply and help.
I have just submitted a support ticket.

[Miheerwa]

Hello all.

I am having an issue with policy rank. It seems that only the default policy works. Any new policy does not work. If set the default to permissive and restrict the new policy, web traffic I expect to be blocked is allowed.


 I want to be able to toggle a working policy instead of updating the default each time I need to turn off filtering.

I tried searching the forum however it doesn't seem I can only search this thread?

I have the home licensing.

Side question: would it be possible to automatically upload block lists or upload lists larger than 100? Or is anything larger only available via the API? (I find the ad blocking and ad tracking 70% effective, and there are lists large lists I would like to import.)

[sy]

Hi @Miheerwa,

The policies work with and condition. Please just be careful about the criteria that you added. For example, if you add an IP and username in the same policy, a session must belong to the IP and username. If one of them doesn't match with the session, Sensei tries to match another policy and if none of them match, the Default policy is applied.

- API support will be added in 1.8

[RamSense]

@MB,

Thank you for the help. support has made a test kernel to solve the (opnsense) netmap problem.
In the first tests it looks like the problems being solved and all is working. Have do to some more testing, but feeling very confident that it is working now! great! thank you/sensei

[mb]

@RamSense, a pull request is on the way. This might be a bit late for 21.1, but I guess this has a chance for 21.1.1.

https://github.com/opnsense/src/pull/97

[RamSense]

@MB thnx!
Great to hear it is on the list to being implemented / corrected.

In the meantime, I am very happy with this test kernel, and all is working great now!

[Antaris]

Hi faisal,

Than it must be the cpu score. There is a 300.000 minimum cpu score requirement for Elasticsearch.

Here's  a quick hack:

1. Remove /usr/local/sensei/etc/.configdone

Code: [Select]

rm /usr/local/sensei/etc/.configdone
3. Edit /usr/local/opnsense/scripts/OPNsense/Sensei/check_hardware.sh file and locate these lines:

Code: [Select]

if [ $CPU_SCORE -le 300000 ]; then
       CPU_PROPER="false"
else
       CPU_PROPER="true"
fi

Change 300000 to a lower value, like 200000. 

4. Do a browser refresh on the OPNsense UI, and click on any sensei menu. It'll re-run the config wizard. Now it should select Elasticsearch.

Now I'm thinking: for cpu scores between 200K and 300K and if there is enough memory (>=8GB) I think we should let the user decide on the database backend.

This solution no longer works on fresh install today. And i can't find from where to choose Elastic engine...

Hi Murat,
One year later i have the same headbang This time for other reason, but i can't use mongodb on this system and the database have to be internal.
Can i ask for current method to select database engine manually?

[mb]

Hi @Antaris, this workaround should still work today. Unfortunately, database selection is still based on the cpu score in the UI.