• opnsense

OPNsense

About

• https://opnsense.org/

• OPNsense.org Docs

• OPNsense.org Downloads

• OPNsense Mirror - University of Applied Sciences Fulda

• OPNsense.org Shop

• OPNsense.org Releases

• OPNsense.org Roadmap

• pkg.opnsense.org releases/mirror

• github.com opnsense

• OPNsense Changelog

• OpenBSD Handbook pfctl cheat sheet

OPNsense® is an open source, easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.

OPNsense includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources.

Important notice

When you virtualized the OPNsense appliance, you can easily attach and detach NICs, maybe even live. But you need to keep an eye on the interface order. OPNsense does not determine its interfaces based on MAC addresses, it uses device names. This means the order of the physical interfaces matters a lot!

Imagine you remove the interface vtnet0 from the OPNsense, than any interface name is decremented by one and every OPNsense interface will be assigned a wrong physical (para-virtualized) interface.

You may escape this situation only by logging into a TTY and create an intermediate configuration that allows network connectivity on the shell. So make sure you have shell access and can elevate privileges to configure the network! As an example you may take down an IP from a interface and configure it on another interface. Here is a simple example:

   1 ifconfig vtnet0 up 172.16.255.2/24
   2 ifconfig vtnet1 down 172.16.255.2/24

To disable the firewall and access the web-interface you can disable the firewalling entirely with
pfctl -d

Essential packages

Install some essential packages

   1 pkg update
   2 pkg install bind-tools tmux vim

Preparing a USB-Stick

1. Download the compressed image from

   OPNsense.org Downloads

2. Plugin the USB-stick and determine the device with lsblk.

3. Unzip the image and write it to the stick on the fly.

      1 IMAGE="OPNsense-22.1-OpenSSL-vga-amd64.img.bz2"
      2 bzip2 -dc "$IMAGE" |dd of=/dev/sdc status=progress
   

USB-Stick with config

1. Plugin the USB-stick and determine the device with lsblk.

2. Create a new GPT partitioning table

      1 parted /dev/sdc
      2 mktable gpt
      3 mkpart primary 1 -1
      4 quit
   

3. Create a vfat filesystem (with an all-caps LABEL)

      1 mkfs.vfat -n CONFIG /dev/sdc1
   

4. Mount and prepare recovery config

      1 mount /dev/sdc1 /mnt
      2 mkdir /mnt/conf
      3 CONFIG="config-devicename-20220215090017.xml"
      4 cp "$CONFIG" "/mnt/conf/config.xml"
      5 sync
      6 umount /mnt
      7 eject /dev/sdc
   

When booting interrupt the processes when asked and enter the device name from the list (like da0). OPNsense will then mount the filesystem and load the config. Test the firewall config before continuing it is possible that you imported the config from the live medium.

When entering a password please mind that you will probably use a en_US keyboard layout.

To login in as root or installer the root password of the old config is needed. It is easier if you know the root password of the config to be imported. But if you have a login with sudo capabilities. You may login to the shell, change the passwords at runtime and exit the shells to return to the login prompt.

   1 sudo -s
   2 passwd installer
   3 passwd root
   4 exit
   5 exit

Now you may login to the installer with the new and known password.

The boot order may have changed during the installation. :-D

You'll have to install previous extensions after installation.

Extensions

There are some realy nice extensions

• os-git-backup Track config changes using git
• os-lldpd LLDP allows you to know exactly on which port is a server
• os-smart SMART tools

• os-wireguard WireGuard VPN service

Themes

• os-theme-cicada The cicada theme - dark grey
• os-theme-rebellion A suitably dark theme
• os-theme-tukan The tukan theme - blue/white
• os-theme-vicuna The vicuna theme - dark anthrazit

Aliases and names

I've introduced some "rules" for myself to make distributed firewalling more understandable.

1. Prefix your interfaces with a string that is specific for your firewall instance

   (like DC1_) to make your names more readable. This leads to automatically created aliases that are named "DC1_DMZ network" or "DC1_WAN address", which are also unique on multiple firewalls.

2. You shouldn't create aliases for locally networks, that have automatically created aliases. This may leads to situations, where an interface network changes but the corresponding firewall ruleset does not and the firewall blocks legitimate traffic. In any case this increases effort for ruleset maintenance.
3. Use the description field for the fqdn/hostname, when creating an alias for a host, when possible.

DNS rebind attack prevention

Just add the hostnames, which should be allowed to

• System: Settings: Administration -> Alternative Hostnames

• System: Einstellungen: Verwaltung -> Alternative Hostnamen

Firewall services

Firewall offers:

Show listening ports

   1 sockstat -l

Show device information

Show PCI information of the NICs

Example from Supermicro X11SDV-4C-TP8F
pciconf -lv |grep -A1 -B3 network

   1 igb0@pci0:101:0:0:      class=0x020000 rev=0x01 hdr=0x00 vendor=0x8086 device=0x1521 subvendor=0x15d9 subdevice=0x1521
   2     vendor     = 'Intel Corporation'
   3     device     = 'I350 Gigabit Network Connection'
   4     class      = network
   5     subclass   = ethernet
   6 igb1@pci0:101:0:1:      class=0x020000 rev=0x01 hdr=0x00 vendor=0x8086 device=0x1521 subvendor=0x15d9 subdevice=0x1521
   7     vendor     = 'Intel Corporation'
   8     device     = 'I350 Gigabit Network Connection'
   9     class      = network
  10     subclass   = ethernet
  11 igb2@pci0:101:0:2:      class=0x020000 rev=0x01 hdr=0x00 vendor=0x8086 device=0x1521 subvendor=0x15d9 subdevice=0x1521
  12     vendor     = 'Intel Corporation'
  13     device     = 'I350 Gigabit Network Connection'
  14     class      = network
  15     subclass   = ethernet
  16 igb3@pci0:101:0:3:      class=0x020000 rev=0x01 hdr=0x00 vendor=0x8086 device=0x1521 subvendor=0x15d9 subdevice=0x1521
  17     vendor     = 'Intel Corporation'
  18     device     = 'I350 Gigabit Network Connection'
  19     class      = network
  20     subclass   = ethernet
  21 --
  22 ixl0@pci0:181:0:0:      class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x37d2 subvendor=0x15d9 subdevice=0x37d2
  23     vendor     = 'Intel Corporation'
  24     device     = 'Ethernet Connection X722 for 10GBASE-T'
  25     class      = network
  26     subclass   = ethernet
  27 ixl1@pci0:181:0:1:      class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x37d2 subvendor=0x15d9 subdevice=0x37d2
  28     vendor     = 'Intel Corporation'
  29     device     = 'Ethernet Connection X722 for 10GBASE-T'
  30     class      = network
  31     subclass   = ethernet
  32 ixl2@pci0:181:0:2:      class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x37d0 subvendor=0x15d9 subdevice=0x37d0
  33     vendor     = 'Intel Corporation'
  34     device     = 'Ethernet Connection X722 for 10GbE SFP+'
  35     class      = network
  36     subclass   = ethernet
  37 ixl3@pci0:181:0:3:      class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x37d0 subvendor=0x15d9 subdevice=0x37d0
  38     vendor     = 'Intel Corporation'
  39     device     = 'Ethernet Connection X722 for 10GbE SFP+'
  40     class      = network
  41     subclass   = ethernet

Show description and firmware version NICs

Extract further device information

   1 sysctl -a \
   2         |grep -E 'dev.(igb|ix|em).*.(%desc|fw_version)' \
   3         |sort -n
   4 dev.igb.0.%desc: Intel(R) I350 (Copper)
   5 dev.igb.0.fw_version: EEPROM V1.63-0 eTrack 0x800009fa
   6 dev.igb.1.%desc: Intel(R) I350 (Copper)
   7 dev.igb.1.fw_version: EEPROM V1.63-0 eTrack 0x800009fa
   8 dev.igb.2.%desc: Intel(R) I350 (Copper)
   9 dev.igb.2.fw_version: EEPROM V1.63-0 eTrack 0x800009fa
  10 dev.igb.3.%desc: Intel(R) I350 (Copper)
  11 dev.igb.3.fw_version: EEPROM V1.63-0 eTrack 0x800009fa
  12 dev.ixl.0.%desc: Intel(R) Ethernet Connection X722 for 10GBASE-T - 2.3.2-k
  13 dev.ixl.0.fw_version: fw 4.1.59148 api 1.9 nvm 4.11 etid 80002044 oem 1.265.0
  14 dev.ixl.1.%desc: Intel(R) Ethernet Connection X722 for 10GBASE-T - 2.3.2-k
  15 dev.ixl.1.fw_version: fw 4.1.59148 api 1.9 nvm 4.11 etid 80002044 oem 1.265.0
  16 dev.ixl.2.%desc: Intel(R) Ethernet Connection X722 for 10GbE SFP+ - 2.3.2-k
  17 dev.ixl.2.fw_version: fw 4.1.59148 api 1.9 nvm 4.11 etid 80002044 oem 1.265.0
  18 dev.ixl.3.%desc: Intel(R) Ethernet Connection X722 for 10GbE SFP+ - 2.3.2-k
  19 dev.ixl.3.fw_version: fw 4.1.59148 api 1.9 nvm 4.11 etid 80002044 oem 1.265.0

There is much more to harvest in sysctl -a.

Show connected media

/usr/local/sbin/ifmedia.sh

   1 #!/usr/bin/env bash
   2 
   3 declare -a IFACES
   4 IFACES=( $(ifconfig |grep '^\w' |cut -f1 -d:) )
   5 
   6 for IFACE in "${IFACES[@]}"; do
   7         echo -n "$IFACE: "
   8         MEDIA="$(ifconfig "$IFACE" |grep 'media:')"
   9         if [ "$MEDIA" ]; then
  10                 echo "$MEDIA"
  11         else
  12                 echo
  13         fi
  14         unset MEDIA
  15 done |column -t

Set script execuable
chmod a+x /usr/local/sbin/ifmedia.sh

ifmedia.sh

   1 igb0:          media:  Ethernet  autoselect  (1000baseT  <full-duplex>)
   2 igb1:          media:  Ethernet  autoselect  (1000baseT  <full-duplex>)
   3 igb2:          media:  Ethernet  autoselect
   4 igb3:          media:  Ethernet  autoselect
   5 ixl0:          media:  Ethernet  autoselect
   6 ixl1:          media:  Ethernet  autoselect
   7 ixl2:          media:  Ethernet  autoselect
   8 ixl3:          media:  Ethernet  autoselect
   9 lo0:
  10 enc0:
  11 pflog0:
  12 pfsync0:
  13 lagg0:         media:  Ethernet  autoselect
  14 lagg0_vlan2:   media:  Ethernet  autoselect
  15 lagg0_vlan6:   media:  Ethernet  autoselect
  16 lagg0_vlan9:   media:  Ethernet  autoselect
  17 lagg0_vlan12:  media:  Ethernet  autoselect
  18 lagg0_vlan14:  media:  Ethernet  autoselect
  19 lagg0_vlan1:   media:  Ethernet  autoselect
  20 lagg0_vlan3:   media:  Ethernet  autoselect
  21 ovpns1:

IPMI configuration

• Thomas-Krenn Wiki - IPMI Konfiguration unter Linux mittels ipmitool

• Thomas-Krenn Wiki - IPMI Grundlagen

• Freebsd Wiki IPMI

• Please also see:
  man ipmitool

To configure IPMI from the OS level gain elevated privileges and load the kernel module.

   1 kldload ipmi
   2 kldstat

List channels

   1 foreach CHANNEL ( `seq 0 1 5` )
   2 echo "Channel: '$CHANNEL'"
   3 ipmitool channel info "$CHANNEL" |sed 's/ +$//'
   4 end
   5 Channel: '0'
   6 Channel 0x0 info:
   7   Channel Medium Type   : IPMB (I2C)
   8   Channel Protocol Type : IPMB-1.0
   9   Session Support       : session-less
  10   Active Session Count  : 0
  11   Protocol Vendor ID    : 7154
  12 Channel: '1'
  13 Channel 0x1 info:
  14   Channel Medium Type   : 802.3 LAN
  15   Channel Protocol Type : IPMB-1.0
  16   Session Support       : multi-session
  17   Active Session Count  : 0
  18   Protocol Vendor ID    : 7154
  19   Volatile(active) Settings
  20     Alerting            : enabled
  21     Per-message Auth    : enabled
  22     User Level Auth     : enabled
  23     Access Mode         : always available
  24   Non-Volatile Settings
  25     Alerting            : enabled
  26     Per-message Auth    : enabled
  27     User Level Auth     : enabled
  28     Access Mode         : always available
  29 Channel: '2'
  30 IPMI command failed: Invalid data field in request
  31 Unable to Get Channel Info
  32 Channel: '3'
  33 Channel 0x3 info:
  34   Channel Medium Type   : Serial/Modem
  35   Channel Protocol Type : IPMB-1.0
  36   Session Support       : single-session
  37   Active Session Count  : 0
  38   Protocol Vendor ID    : 7154
  39 Channel: '4'
  40 IPMI command failed: Invalid data field in request
  41 Unable to Get Channel Info
  42 Channel: '5'
  43 Channel 0x5 info:
  44   Channel Medium Type   : IPMB (I2C)
  45   Channel Protocol Type : IPMB-1.0
  46   Session Support       : session-less
  47   Active Session Count  : 0
  48   Protocol Vendor ID    : 7154

Show IPMI lan configuration The channel is "1" but may be omitted, here.

   1 ipmitool lan print
   2 Set in Progress         : Set Complete
   3 Auth Type Support       : NONE MD2 MD5 PASSWORD 
   4 Auth Type Enable        : Callback : MD2 MD5 PASSWORD
   5                         : User     : MD2 MD5 PASSWORD
   6                         : Operator : MD2 MD5 PASSWORD
   7                         : Admin    : MD2 MD5 PASSWORD
   8                         : OEM      : MD2 MD5 PASSWORD
   9 IP Address Source       : DHCP Address
  10 IP Address              : 0.0.0.0
  11 Subnet Mask             : 0.0.0.0
  12 MAC Address             : 3c:ec:ef:12:34:56
  13 SNMP Community String   : public
  14 IP Header               : TTL=0x00 Flags=0x00 Precedence=0x00 TOS=0x00
  15 BMC ARP Control         : ARP Responses Enabled, Gratuitous ARP Disabled
  16 Default Gateway IP      : 192.168.1.1
  17 Default Gateway MAC     : 00:00:00:00:00:00
  18 Backup Gateway IP       : 0.0.0.0
  19 Backup Gateway MAC      : 00:00:00:00:00:00
  20 802.1q VLAN ID          : Disabled
  21 802.1q VLAN Priority    : 0
  22 RMCP+ Cipher Suites     : 1,2,3,6,7,8,11,12
  23 Cipher Suite Priv Max   : XaaaXXaaaXXaaXX
  24                         :     X=Cipher Suite Unused
  25                         :     c=CALLBACK
  26                         :     u=USER
  27                         :     o=OPERATOR
  28                         :     a=ADMIN
  29                         :     O=OEM
  30 Bad Password Threshold  : 3
  31 Invalid password disable: yes
  32 Attempt Count Reset Int.: 300
  33 User Lockout Interval   : 300

Alter BMC LAN configuration

   1 ipmitool lan set 1 ipsrc static
   2 ipmitool lan set 1 ipaddr 192.168.10.12
   3 ipmitool lan set 1 netmask 255.255.255.0
   4 ipmitool lan set 1 defgw ipaddr 192.168.10.1
   5 ipmitool lan set 1 arp respond on
   6 ipmitool lan set 1 auth ADMIN MD5
   7 ipmitool lan set 1 access on

Interface assignments

IP interfaces can easily be moved between different physically or logical devices using the webinterface. But please keep in mind, that CARP VIPs may not migrate properly, when reassigning the devices.

In my specific case the LAN interface was moved from igb0 to VLAN1 on LAGG1. But the carp VIP stayed on igb0. Therefor the routing table still pointed igb0 for the migrated network and frames and packets were send out to the wrong interface (like ARP).

ON VMware

CARP

When using VMware with CARP.

1. Allow "Forged Transmits"/"Gefälschte Übertragungen" in the port-group.
   

   • This allows frames with a crafted MAC like 00:00:5e:00:01:14 to be forwarded over the vSwitch (and reach the backup node). Otherwise both firewalls are in state "master" (split-brain).

2. Allow "Promiscuous Mode" in the port-proup.
   

   • To receive frames for the crafted CARP-MAC the OPNsense need to put the respective NIC into promiscuous mode (within the guest). This makes only sense if the VMware port-group also allows promiscuous mode.

3. Enable Net.ReversePathFwdCheckPromisc=1 on you hosts
   

   • $HOSTNAME > Configure > Advanced Settings -> Edit (Button) Please see: https://kb.vmware.com/s/article/59235

   • It is not necessary to reboot the host. It's sufficient to reboot the guest or (live) migrate the guest to ahost with the option enabled.

   • Rationale:
     When using a VMware vSwitch with multiple uplinks without Bonding (like LACP), multicast and broadcast frames (BUM-traffic) are flooded back to the vSwitch. The OPNsense that just got "master" and sends out its keep-alives, receives its own frames and falls back to state "backup". The IP-interface is flapping up and down in the log.
     Please check: tail -f /var/log/system/latest.log
     The webguis will show both firewalls in state "backup".

4. Allow "CARP" in the firewall ruleset on the respective interface.

Install VMware-tools

Install extension os-vmware.

Wireguard

If you have important site-to-site connections running that should not be interrupted, you should establish separate listeners. This avoids unnecessary down-times, because misconfiguration happens and the wireguard interface won't come up until the problem has been fixed.

The Wireguard interface may not get up if

• the destination address is not resolveable
  • Keep that in mind when forwarding DNS-traffic over wireguard
• the Wireguard "allowed_ip" address collides with a local address

For the Wireguard interfaces to be query-able by DNS, a access list has to be added to the Unbound service.
SERVICES: UNBOUND DNS: ACCESS LISTS

OPNsense creates a firewall interface group "WireGuard (group)". So there's no need to manually create one. The processing order can be looked up here.
OPNsense Docs - Firewall Processing order

Basically:

1. Floating
2. Group
3. Interface

siproxd

Siproxd is only a proxy for old PBXs, which strictly require source port 5060. With siproxd multiple phones can connect to the remote PBX over a Masquerading firewall.

Please see:

• Siproxd - a masquerading SIP Proxy Server

• PFsense - Siproxd package

You probably don't need this plugin.

MultiWAN

• OPNsense Docs - Gateway groups / Multi WAN

• OPNsense Docs - Multi WAN HowTo

Notes

• A load-balancing setup with multiple Gateways in Tier 1, does not cope well with sticky connections. Random Websites do not load.

  With tcpdump you can see a packet coming in to LAN, but not leaving on WAN1 or WAN2.

• Be careful with groups when using MultiWAN.

  OPNsense Docs - [Interface] Groups

DNS

Dynamic DNS by DHCP

Works like a charm!

• Services: Unbound DNS: General
  Register DHCP leases: true

• Services: Unbound DNS: General
  Register DHCP static mappings: true

• Services: Unbound DNS: General
  Register DHCP leases: true

• In the zone e.g. Services: DHCPv4: [LAN]
  Dynamic DNS -> Enable registration of DHCP client names in DNS: true

• In the zone e.g. Services: DHCPv4: [LAN]
  Domain name: intern.dezentrale.space

configd

List configd actions

   1 configctl configd actions list

Restart ssh-daemon

   1 configctl openssh restart

Upgrades

• docs.opnsense.org - Updates

Security Updates

The bi-weekly security upgrades should be installed automatically using the cron-job Automatic firmware updates, which is factory provided under
System: Settings: Cron.

This is generally a good idea!

You should think a about redundancy and fast storage (like NVME-SSDs).

Major Upgrades

OPNsense demands for a major upgrade twice a year. Please see:

• OPNsense.org Releases

• https://endoflife.date/opnsense

Multiple Major Upgrades

First step is always to backup your configuration.

• Perform the upgrades serially in order.

  • Latest security release -> major upgrade -> Latest security release -> major upgrade (-> Latest security release -> major upgrade -> …)

• Use a live medium
  • Create a live medium with the target release
  • boot the live-medium and load the config during startup
  • persist the config when it performs well

ALLOW_RISKY_MAJOR_UPGRADE

If you want to drive firewall in a more hazardous way, there is also a way to automate upgrades across major releases

• OPNsense Release Note 17.1 “Eclectic Eagle” 17.1.11 (July 25, 2017)

• https://github.com/opnsense/core/commit/93072dd807d0115a0586f9cb6345079e930e174f

• firmware: cron-parameter ALLOW_RISKY_MAJOR_UPGRADE for auto-update

There is now a switch for the brave, which allows for targeted major release upgrades and release name agnostic major upgrades. Please see:
/usr/local/etc/rc.firmware.subr

   1 #!/bin/sh
   2 
   3 # Copyright (c) 2015-2021 Franco Fichtner <franco@opnsense.org>
   4 #
   5 # Redistribution and use in source and binary forms, with or without
   6 # modification, are permitted provided that the following conditions
   7 # are met:
   8 #
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 #
  12 # 2. Redistributions in binary form must reproduce the above copyright
  13 #    notice, this list of conditions and the following disclaimer in the
  14 #    documentation and/or other materials provided with the distribution.
  15 #
  16 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26 # SUCH DAMAGE.
  27 
  28 set -e
  29 
  30 RELEASE=$(opnsense-update -vR)
  31 
  32 if [ "${1}" = "upgrade" -a -n "${2}" ]; then
  33         RELEASE=${2}
  34 elif [ "${1}" = "ALLOW_RISKY_MAJOR_UPGRADE" -a -n "${RELEASE}" ]; then
  35         : # ok, conditional major upgrade
  36 else
  37         # nope, only perform stable update
  38         RELEASE=
  39 fi
  40 
  41 if [ -z "${RELEASE}" ]; then
  42         # already locked here, ok to call without launcher.sh
  43         /usr/local/opnsense/scripts/firmware/update.sh sync
  44 else
  45         # already locked here, ok to call without launcher.sh
  46         /usr/local/opnsense/scripts/firmware/upgrade.sh
  47 fi

So, it basically allows for timed and generally automatic major upgrades.

Perform a targeted upgrade

ALLOW_RISKY_MAJOR_UPGRADE

Use on your own risk.

OPNsense calls it a support nightmare. :-D

ALLOW_RISKY_MAJOR_UPGRADE Cron Schedule

How should a cron schedule look like for usage with ALLOW_RISKY_MAJOR_UPGRADE?

Assumptions:

• A major upgrade also installs the latest security release and updates plugins. TODO: Proof this.

Constraints:

• Primary is im CARP preemption mode
• Secondary prior to primary

• The upgrade performs a random delay of up to -r 1500s (25min) when updating.

  • Which can probably be changed

    by adding another option -r 1 or whatever value you have in mind to parameters

• The upgrades of primary and secondary should not overlap, to avoid outage. There should be some margin.
• Upgrade time depends on resources (especially on fast CPU and storage)
  • Daily security upgrades are much faster than major upgrades.
• Daily security upgrades may end up in a reboot.
• Major upgrades end up in a reboot.
• The time specification is bound to the cron format
  • OPNsense relies on cron written by Paul Vixie
  • There is a specialty when limiting both DoM and DoW

    they are processed with logical OR instead of AND

  • Please see man 5 crontab for datails of the time spec. Short version:
    # m h tdm mon tdw

• Firewall upgrades and reboots should not interfere with production and backup window.
• Primay and secondary should not be updated on the same day.
• IMHO friday, saturday and sunday

  are not a good idea for ALLOW_RISKY_MAJOR_UPGRADE – poor people on standby.

The meaning:

• Firmware update check prior to everything.
• Automatic firmware update with one hour delay between nodes and an offset of 5min to Firmware update check.
• Major upgrades on alternating weeks and if it's every 4th day of the week (thursday).

WAF

• OPNsense docs - nginx: Web Application Firewall

• The WAF plugin is based on nginx with the naxsi (Nginx Anti XSS & SQL Injection) plugin.

• Please keep in mind,

  that if no default_server is specified, the first server is chosen as the default server.
  Nginx docs - How nginx processes a request

FreeBSD

Change keyboard mapping

Please see this great post
Tobias Koschinski - FreeBSD: Set keyboard layout

To change the keyboard layout

   1 ### OPEN A MENU
   2 kdbmap
   3 ### SHOW THE SUPPORTED LANGUAGES
   4 kbdmap -s
   5 ### SHOW THE SUPPORTED KEYMAPS AND FONTS
   6 kbdmap -p
   7 ### SELECT THE LANGUAGE DIRECTLY
   8 kbdcontrol -l de

You may enable the wiki comments to view a list of layouts

   1 INDEX.keymaps                   kk.pt154.kst.kbd
   2 be.iso.acc.kbd                  latinamerican.iso.acc.kbd
   3 be.iso.kbd                      latinamerican.kbd
   4 bg.bds.ctrlcaps.kbd             lt.iso4.kbd
   5 bg.phonetic.ctrlcaps.kbd        norwegian.dvorak.kbd
   6 br275.cp850.kbd                 norwegian.iso.kbd
   7 br275.iso.acc.kbd               pl_PL.ISO8859-2.kbd
   8 br275.iso.kbd                   pl_PL.dvorak.kbd
   9 by.cp1131.kbd                   pt.iso.acc.kbd
  10 by.cp1251.kbd                   pt.iso.kbd
  11 by.iso5.kbd                     ru.cp866.kbd
  12 ce.iso2.kbd                     ru.iso5.kbd
  13 colemak-dh.iso15.acc.kbd        ru.koi8-r.kbd
  14 colemak.iso15.acc.kbd           ru.koi8-r.shift.kbd
  15 cs.latin2.qwertz.kbd            ru.koi8-r.win.kbd
  16 cz.iso2.kbd                     si.iso.kbd
  17 danish.cp865.kbd                sk.iso2.kbd
  18 danish.iso.acc.kbd              spanish.dvorak.kbd
  19 danish.iso.kbd                  spanish.iso.acc.kbd
  20 danish.iso.macbook.kbd          spanish.iso.kbd
  21 dutch.iso.acc.kbd               spanish.iso15.acc.kbd
  22 eee_nordic.kbd                  swedish.cp850.kbd
  23 el.iso07.kbd                    swedish.iso.kbd
  24 estonian.cp850.kbd              swissfrench.cp850.kbd
  25 estonian.iso.kbd                swissfrench.iso.acc.kbd
  26 estonian.iso15.kbd              swissfrench.iso.kbd
  27 finnish.cp850.kbd               swissgerman.cp850.kbd
  28 finnish.iso.kbd                 swissgerman.iso.acc.kbd
  29 fr.dvorak.acc.kbd               swissgerman.iso.kbd
  30 fr.dvorak.kbd                   swissgerman.macbook.acc.kbd
  31 fr.iso.acc.kbd                  tr.iso9.q.kbd
  32 fr.iso.kbd                      ua.iso5.kbd
  33 fr.macbook.acc.kbd              ua.koi8-u.kbd
  34 fr_CA.iso.acc.kbd               ua.koi8-u.shift.alt.kbd
  35 german.cp850.kbd                uk.cp850-ctrl.kbd
  36 german.iso.acc.kbd              uk.cp850.kbd
  37 german.iso.kbd                  uk.dvorak.kbd
  38 gr.elot.acc.kbd                 uk.iso-ctrl.kbd
  39 gr.us101.acc.kbd                uk.iso.kbd
  40 hr.iso.kbd                      us.dvorak.kbd
  41 hu.iso2.101keys.kbd             us.dvorakl.kbd
  42 hu.iso2.102keys.kbd             us.dvorakp.kbd
  43 hy.armscii-8.kbd                us.dvorakr.kbd
  44 icelandic.iso.acc.kbd           us.dvorakx.kbd
  45 icelandic.iso.kbd               us.emacs.kbd
  46 it.iso.kbd                      us.iso.acc.kbd
  47 iw.iso8.kbd                     us.iso.kbd
  48 jp.106.kbd                      us.iso.macbook.kbd
  49 jp.106x.kbd                     us.pc-ctrl.kbd
  50 kk.pt154.io.kbd                 us.unix.kbd

Scrolling

On the TTY please use Scroll Lock and navigate with PageUp/Down or the arrow keys Up/Down.
In Linux you usually would use Shift + PageUP/Down or Shift + Up/Down.

Show device information

Show device info via (Common Access Method)

   1 camcontrol identify /dev/ada0

Resize disk

• FreeBSD Handbook

• FreeBSD Handbook 20.3. Resizing and Growing Disks

• FreeBSD Manual Pages - growfs

• Please also see:
  libvirt - Resize qcow2 image

   1 gpart show
   2 gpart resize -i 1 vtbd0
   3 
   4 ### FAILED SOMEHOW
   5 growfs /dev/vtbd0a
   6 It's strongly recommended to make a backup before growing the file system.
   7 OK to grow filesystem on /dev/vtbd0a from 3.0GB to 8.0GB? [yes/no] yes
   8 growfs: /dev/vtbd0a: Operation not permitted
   9 cat /etc/fstab
  10 
  11 growfs /dev/ufs/OPNsense_Nano
  12 Device is mounted read-write; resizing will result in temporary write suspension for /.
  13 It's strongly recommended to make a backup before growing the file system.
  14 OK to grow filesystem on /dev/ufs/OPNsense_Nano, mounted on /, from 3.0GB to 8.0GB? [yes/no] yes
  15 super-block backups (for fsck_ffs -b #) at:
  16  6867136, 7848128, 8829120, 9810112, 10791104, 11772096, 12753088, 13734080,
  17  14715072, 15696064, 16677056

Downgrade a package

Here on the example of nginx

   1 opnsense-revert -r 22.1.8 nginx

OPNcentral

• OPNcentral ist eine Art Plugin für OPNsense zur Verwaltung mehrerer Firewalls
• Business License auf OPNcentral und angeschlossenen Clients (zwei für einen Cluster) notwendig.
  • Getestete Upgrades
  • Unterstützung der Entwicklung
• Recht beschränkt

Features

• Zentraler Status
  • Ressourcen Verbrauch
  • von laufenden Diensten
• Zentrale Firmware Upgrades
  • OPNcentral muss eine neuere Version als der Client haben
  • Achtung bei produktiven Systemen
• Synchronisiserung von
  • Sollte selektiv ausgewählt werden
  • Sinvoll sind: Aliases, Authentisierungsserver, Zertifikate, Floating ACLs, …
    • Lokale nicht zentral verwaltete Aliase werden gelöscht?