Hello all you lovely people!

I'm trying to figure out if I can port forward to different servers based on the destination domain.

I have a domain with a wildcard cert and I'd like to be able to route all traffic headed towards "1.domain.com" to a server I'm calling "1". I'd still like traffic headed to domain.com to go to where it's currently going, we can call this server "0", and to be able to have a 2.domain.com or 3 or 4 in the future.

I thought that having a port forward rule with: interface: WAN Protocol: any source: any destination: a url alias including 1.domain.com redirect target ip: local ip

Would work, but it doesn't seem to. Any tips?

Hi!

I have a question. If I enable IPS mode, my outbound traffic graphs stop working.

This is a known bug? Is there something that I can do?

https://imgur.com/Igzjc6I

I'm running OPNsense 24.1.3_1.

Thanks!

Hi all, I've got a cheap Celeron box running OPNSense and it's been pretty good so far, but I found twice that the device turned off at some point while I was at work, and I have been unable to figure out what's causing it.

The only change was that I enabled Monit to see if I could figure out what was causing crowdsec to stop sometimes but never ended up configuring anything. I've only been running it for a couple months though, so it's possible that that is not related.

I know that on a Mac (based on freebsd, right?) you can determine whether the shutdown reason was a hard shutdown, regular shutdown, or the power cable being unplugged. Is it possible to do that with OPNSense? I'd like to narrow it down to software or hardware ideally.

After a home rewire, I'm ready to bump up to 2.5GbE, and demote my old 1Gbps router/wifi box to "AP Only mode".

I want at least ~~five~~ six total ports, four of which need to be 2.5+ (three to different rooms, one for uplink, one 1G+ for the AP, and one "any speed is enough" for the networked printer :) )

It seems like the "mini-PC with a bunch of 2.5GbE ports running OPNSense" option fits neatly between "Build a router out of my old i5-2500K and some eBay NICs and ignore the USD450 electric bill", and "enterprise rackmount gear with Delta fans left over from people overclocking their Socket A Athlons."

I see a lot of machines of the form "fanless case with a little castle of fins on top, Intel N100 CPU, six 2.5G ports from I226 chipset". A representative example is https://www.aliexpress.us/item/3256806214512701.html

I suspect they may all be re-brands of the same basic product, but I wanted to know real-world experiences:

• Basic question: can anyone vouch for any specific one of these devices/sellers and confirm it worked for them?

• I understand the i225-v LAN chipset was much buggier than the i226-v and to be avoided; still the case? I see a few products that are like USD50 cheaper, with different CPUs and i225-based LAN.

• For routing/firewall duties (probably 4 PCs, 3 phones, a couple printers, and some smart devices) , are the bottom-of-the-line configs (8GB RAM/128G disc) suitable? Is the CPU sufficient? The N100 makes me laugh-- Intel doesn't even want to give it a brand name.

• Regarding WiFi, should I just block out that little Mini-PCIe slot on the board from my mind? I know that FreeBSD WiFi has been sort of a fourth-class citizen for years, but I was wondering if there had been a breakthrough, or at least a "here is one specific card you can buy for a largely drama-free experience"

• Weird question: Any problems with RF noise? I have had some devices where the power brick made a mess of a neighbour's AM radio reception, and I don't want to start a war with him. I figure when you're buying a device with a 60w wall-wart from a random brand, it might not be the cleanest.

Just a few tips for installing on a Sophos SG135 (and perhaps others in the Sophos family?) using the serial build via usb

1. Sophos device starts at 38400,n,8,1 as com settings. OPNsense switches to 115200 after bios. If you set your session to 115200 prior to OPNsense taking over, this causes PuTTY to not be able to input keyboard characters until you kill and re-open the session. Something happens in the transition on either serial interface to cause problems.

2. Perform the auto detection of interfaces. For some reason I got screwed up on the interfaces and couldn't for the life of me get LAN to come up to configure the box. I believe this was twofold: one, the interfaces were all down when I configured them - and two, that caused them to go into a state to where even if 'ifconfig' showed active as I moved my cabling around, pings would not work (LAN). Once I redid the usb live and utilized the auto detection feature properly, no issues occurred.

Hope this helps someone who may run into similar issues.

Hey all, I've been trying to figure out why enabling IPS kills my network. I have some services I host and would like to get some sort of IPS running. I used to have Snort running through pfSense and didn't experience issues like this.

Hey all, recent convert from pfSense. I'm trying to make sure only the DNS servers I've defined are being used for lookups? I'm using Unbound and noticing a lot of traffic on port 53 to destinations other than the ones I've put in.

Hi There,

Please excuse the lenghty post, I wanted to explain/have all the information I can possibly write down

I've been trying to have "udpbroadcastrelay" plugin to relay SSDP (Simple Service Discovery Protocol) between two subnets, LAN and Bridge. However, I've hit a roadblock with this setup.

The peculiar thing is that mDNS (Multicast DNS) works flawlessly using the same plugin and setup!

I hope that someone can help shed some light on this issue and help me get SSDP relay working as smoothly as mDNS does in my setup. If anyone has experience with the "udpbroadcastrelay" plugin in OPNsense or has encountered a similar issue, your insights and guidance would be greatly appreciated. Thanks in advance for any assistance or suggestions!

SIDENOTE:-

I have used BOTH of :

- os-udpbroadcastrelay 1.0_3 (frpm repo)
- compiled from source (Github) so i can use --msearch option

1. My Setup

   • Virtualized OPNsense in Proxmox
     • Pass-Through (WAN)
     • 2 VirtIO Interfaces (LAN & Bridge)
   • OPNsense Version: OPNsense 23.7.10_1-amd64 FreeBSD 13.2-RELEASE-p7
   • Proxmox Version: proxmox-ve: 8.1.0 (running kernel: 6.5.11-7-pve)

2. Troubleshooting Attempts:

I've tried various solutions from different sources to resolve this issue, including:

• HOW TO - Configure OPNsense for TV7 (init7) Multicast Stream

  LAN
  First we have to enable allow options on the default LAN rule Default allow LAN to any rule.

  • Navigate to Firewall -> Rules -> LAN
  • Edit the rule with the description "Default allow LAN to any rule" by clicking the pencil.
  • Scroll down until you see Advanced Options: and click on Show/Hide
  • Make sure that the allow options checkbox is checked
  • Click Save
  • Back on Overview click on Apply changes to enable the changed rule

• [SOLVED] - Multicast bridge problem | Proxmox Support Forum

  maybe try to disable multicast snooping on bridges ?

  echo 0 > /sys/class/net/vmbrX/bridge/multicast_snooping

• Multicast notes - Proxmox VE

  Linux: Disabling Multicast snooping on bridges

  Snooping should be enabled on either the router / switch or on the linux bridge, but it may not work if enabled on both. If you have a hosting provider that has igmp snooping enabled on the multicast switch, it may be necessary to disable snooping on the linux bridge. In that case use:

  post-up ( echo 1 > /sys/devices/virtual/net/$IFACE/bridge/multicast_querier )

  post-up ( echo 0 > /sys/class/net/$IFACE/bridge/multicast_snooping )

To help diagnose the issue effectively, here is what i managed to gather:

FW Ruleset

cat /tmp/rules.debug

LAN Rule Set
pass in log quick on vtnet0 inet from {(vtnet0:network)} to {any} keep state label "3070463c8d527cf93da451fa4f88c7cb" # Default allow LAN to any rule

Bridge Rule Set
 pass in log quick on vtnet1 inet from {(vtnet1:network)} to {any} keep state label "2681e3c4a046e0ab9b3ab64679df3edc" # Allow Bridge to any rule

Interfaces

igc0: flags=8963 metric 0 mtu 1500
	description: WAN (wan)
	options=4802028
	ether xx:xx:xx:xx:xx:xx
	inet 192.168.0.2 netmask 0xffffff00 broadcast 192.168.0.255
	media: Ethernet autoselect (1000baseT )
	status: active
	nd6 options=29
vtnet0: flags=8963 metric 0 mtu 1500
	description: LAN (lan)
	options=800a8
	ether xx:xx:xx:xx:xx:xx
	inet 192.168.100.3 netmask 0xffffff00 broadcast 192.168.100.255
	media: Ethernet autoselect (10Gbase-T )
	status: active
	nd6 options=29
vtnet1: flags=8963 metric 0 mtu 1500
	description: Bridge (opt1)
	options=800a8
	ether xx:xx:xx:xx:xx:xx
	inet 10.10.10.1 netmask 0xffffff00 broadcast 10.10.10.255
	media: Ethernet autoselect (10Gbase-T )
	status: active
	nd6 options=29

CLI USED

./udpbroadcastrelay -d -d --id 1 --port 1900 --dev vtnet1 --dev vtnet0 --multicast 239.255.255.250 --msearch dial

2023/12/29 21:48:17.555 <- [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet1 len=438 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term upnp:rootdevice
2023/12/29 21:48:17.555 -> [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet0 len=438 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:17.593 <- [ 10.10.10.46:52323 -> 239.255.255.250:1900 (iface=vtnet1 len=462 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term urn:schemas-sony-com:service:Party:1
2023/12/29 21:48:17.593 -> [ 10.10.10.46:52323 -> 239.255.255.250:1900 (iface=vtnet0 len=462 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:17.593 <- [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet1 len=447 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term uuid:00000001-0000-1010-8000-045d4bdcbc2f
2023/12/29 21:48:17.593 -> [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet0 len=447 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:17.614 <- [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet1 len=490 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term urn:schemas-upnp-org:device:MediaServer:1
2023/12/29 21:48:17.614 -> [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet0 len=490 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:17.637 <- [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet1 len=502 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term urn:schemas-upnp-org:service:ContentDirectory:1
2023/12/29 21:48:17.637 -> [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet0 len=502 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:17.663 <- [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet1 len=504 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term urn:schemas-upnp-org:service:ConnectionManager:1
2023/12/29 21:48:17.663 -> [ 10.10.10.46:64321 -> 239.255.255.250:1900 (iface=vtnet0 len=504 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:18.315 <- [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet1 len=283 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:schemas-upnp-org:device:MediaRenderer:1
   Applying default action FORWARD
2023/12/29 21:48:18.315 -> [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet0 len=283 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:18.373 <- [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet1 len=283 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:schemas-upnp-org:device:MediaRenderer:1
   Applying default action FORWARD
2023/12/29 21:48:18.373 -> [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet0 len=283 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:18.460 <- [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet1 len=283 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:schemas-upnp-org:device:MediaRenderer:1
   Applying default action FORWARD
2023/12/29 21:48:18.460 -> [ 10.10.10.46:58092 -> 239.255.255.250:1900 (iface=vtnet0 len=283 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:24.824 <- [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet0 len=127 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:schemas-upnp-org:device:MediaServer:1
   Applying default action FORWARD
2023/12/29 21:48:24.824 -> [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet1 len=127 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:24.924 <- [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet0 len=127 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:schemas-upnp-org:device:MediaServer:1
   Applying default action FORWARD
2023/12/29 21:48:24.924 -> [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet1 len=127 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:25.425 <- [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet0 len=118 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:ses-com:device:SatIPServer:1
   Applying default action FORWARD
2023/12/29 21:48:25.425 -> [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet1 len=118 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:48:25.525 <- [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet0 len=118 tos=0x00 DSCP=0 ttl=4)
   Found M-SEARCH search term urn:ses-com:device:SatIPServer:1
   Applying default action FORWARD
2023/12/29 21:48:25.525 -> [ 192.168.100.76:35630 -> 239.255.255.250:1900 (iface=vtnet1 len=118 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:49:16.556 <- [ 10.10.10.46:50201 -> 239.255.255.250:1900 (iface=vtnet1 len=267 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term upnp:rootdevice
2023/12/29 21:49:16.556 -> [ 10.10.10.46:50201 -> 239.255.255.250:1900 (iface=vtnet0 len=267 tos=0x04 DSCP=1 ttl=4)

2023/12/29 21:49:16.577 <- [ 10.10.10.46:50201 -> 239.255.255.250:1900 (iface=vtnet1 len=276 tos=0x00 DSCP=0 ttl=4)
   Found NOTIFY search term uuid:00000004-0000-1010-8000-045d4bdcbc2f
2023/12/29 21:49:16.577 -> [ 10.10.10.46:50201 -> 239.255.255.250:1900 (iface=vtnet0 len=276 tos=0x04 DSCP=1 ttl=4)

Lan Wireshark Capture

Hi everyone,

I’m at my wits end here getting port forwarding working on my setup with Nginx Proxy Manager (NPM) and OPNsense.

I recently upgraded my networking gear, and everything is working great, I’m loving OPNsense and 10G networking. I’ve had the same setup for port forwarding for years and never had issues, the main change was the addition of OPNsense and a switch.

Previous setup (I realize this wasn’t the best):

ISP modem -> DHCPv4 with ports 80/443 forwarded to ASUS wireless router WAN -> DHCPv4 with ports 80/443 forwarded to VM on proxmox running NPM -> NPM set up with hosts to proxy services on other VMs/server.

This (or a variation thereof) has all been working great for years, along with ddns set up as I have a dynamic IP.

New setup:

ISP modem -> DHCP off with ports 80/443 forwarded to OPNsense WAN via MAC address -> OPNsense NAT-Port Forwarding set up to the NPM host/port, rest is the same as before.

The settings for the port forward are the standard I’ve found in guides. WAN address, any source/port, redirect to NPM host and ports. Tried the domain I usually use, no luck. Port checker shows the ports are closed.

Tried the following:

1. DMZ on the ISP modem keeping WAN IP default/automatic and adding OPNsense to the DMZ, no change.
2. Advanced DMZ on ISP, WAN is the external IP, no change
3. Same as 2, but changed OPNsense WAN settings from DHCPv4 to PPPoE, and added the ISP login info. Received new IP, updated ddns, still no change.
4. Checked over port forwarding settings, enabled NAT reflection, still nothing.

I’m between all these steps, I rebooted OPNsense, proxmox, switches, etc.

Any ideas on what I could try for next steps? All of the local networking and external connections work awesome, it’s just the port forwarding as the last piece. Thanks!

Edit 2023-01-03:

I finally solved this, turned out the OPNSense and NPM configuration was all correct.

The problem was a glitch in the docker compose/portainer. I had my ports in docker compose set to 80:80/443:443, but when the container was deployed, it assigned 1880:80/18443:443 because of…reasons, and I didn’t notice until going through it all line by line 🤦.

Redeploying the stack/container didn’t solve it, so I changed the time zone to another city, redeployed and viola, everything works perfect as it should!

Will I be able to use proton vpn .conf for WireGuard so I can run all my devices in that tunnel

• system: close boot file after probing to avoid lock inheritance
• system: fix lock() inheriting the lock state
• system: give more context in process kill error case since we operate PID numbers only
• firewall: groups were not correctly parsed for menu post-migration
• firewall: hide row command buttons for internal groups
• firewall: add "ipv6-icmp" to protocol list in shaper
• firewall: fix PHP warnings on the rules pages
• dhcp: check if manufacturer exists for IPv4 lease page to prevent error
• dhcp: use base16 for iaid_duid decode for IPv6 lease page to prevent error
• dhcp: fix validation for static entry requirement
• firmware: revoke 23.1 fingerprint
• network time: support pool directive and maxclock (contributed by Kevin Fason)
• openvpn: fix static key delete
• openvpn: fix "mode" typo and push auth "digest" into export config
• openvpn: fix race condition when using CRLs in instances
• openvpn: remove arbitrary upper bounds on some integer values in instances
• unbound: migration of empty nodes failed from 23.1.11 to 23.7
• unbound: fix regression when disabling first domain override
• mvc: fix empty item selection issue in BaseListField
• plugins: os-ddclient 1.14
• plugins: os-acme-client 3.19
• src: bhyve: fully reset the fwctl state machine if the guest requests a reset
• src: frag6: avoid a possible integer overflow in fragment handling
• src: amdtemp: Fix missing 49 degree offset on current EPYC CPUs
• src: libpfctl: ensure the initial allocation is large enough
• src: pf: handle multiple IPv6 fragment headers
• ports: curl 8.2.1
• ports: nss 3.92
• ports: openssl 1.1.1v
• ports: perl 5.34.1
• ports: py-dnspython 2.4.1
• ports: strongswan 5.9.11
• ports: syslog-ng 4.3.1

There is no better feeling in the world

I’ve been using OPNsense for a little over a year now, after migrating from PFsense which I used for many years. I really love it, it’s incredibly powerful and yet easy to use once you wrap your head around things. And the interface is much cleaner than PFsense ever was.

I have a fairly complex setup with several vlans and different outbound routing for different hosts, client vpn (outbound) and server vpn (inbound). I’m no network guru but I’m happy to help with any questions to the best of my ability. More people should be using this!

Update went smoothly as can be. A reboot is required.