meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
sw:opnsense:issues [2019/04/04 13:03] – niziaksw:opnsense:issues [2025/08/20 12:12] (current) – niziak
Line 1: Line 1:
-====== multi wan: lan gw was chosen ======+====== OPNSense issues ====== 
 + 
 +===== WAN bandwidth limited ===== 
 + 
 +4 port ''Intel(R) PRO/1000 Network Connection'' 
 + 
 +  * last post in: [[https://forum.opnsense.org/index.php?topic=17277.0|[Help] troubleshooting high latency issues]] 
 +  * [[https://forum.opnsense.org/index.php?topic=39763.0|Bandwidth cut in half when traversing system but direct bandwidth test is fine]] 
 +  * [[]] 
 +https://forum.opnsense.org/index.php?topic=15019.0 
 + 
 +https://forum.opnsense.org/index.php?topic=9693.0 
 + 
 +[[https://forum.opnsense.org/index.php?topic=6590.0|Performance tuning for IPS maximum performance]] 
 + 
 + 
 +===== flowd ===== 
 +flowd.log is 5GB. 
 +flowd_aggregate.py died (Insight Aggregator service). 
 +Workaround is to use monit: 
 + 
 +{{:sw:opnsense:pasted:20200513-140645.png}} 
 + 
 +===== Multiwan ===== 
 + 
 +==== multiwan: when primary WAN fails, local connectivity stops ==== 
 +Primary WAN fails: 
 +  - Local (from OPNSense host) DNS doesn't work 
 +  - local connectivity also doesn't work ``No route to host`` 
 +  - internet for LAN users works (switched to WAN2) 
 +  - one LAN device cannot connect to 8.8.8.8 DNS server, because this request is still forwarded to WAN1 
 + 
 +SOLUTION ? 
 +PROPOSALS:  
 +  - Allow DNS server list to be overridden by DHCP/PPP on WAN = CHECKED  <– uncheck this 
 + 
 + 
 +==== multiwan: port reflection not working ==== 
 +**Scenario:** 
 +  * Not possible to connect to port-forwarded service using WAN IP 
 +**Problem 1** 
 +  * Problem caused by Policy based routing with Multi WAN setup: 
 +    * Firewall-->Rules-->LAN, when all LAN traffic has gateway set. LAN to LAN traffic should use default gateway. 
 +**Solution 1** 
 +  * Add rule before default gateway rule: LAN net --> LAN net to use Gateway default 
 + 
 +**Problem 2** 
 +  * When interface group is used as interface in **Firewall --> NAT --> Port Forward**, reply-to rules are not generated. 
 +**Solution 2** 
 +  * Do not create NAT rule for **interface group**. Use duplicated rules for each WAN interface 
 + 
 +==== multiwan: port forwards ==== 
 + 
 +**Scenario:** 
 +  * Interface group WAN created, to group to WAN1 and WAN2 interfaces. 
 +  * Prot forward defined from WAN to WAN:NETWORK TCP/UDP port 2196. to host 192.168.0.231:2196. 
 +**Problem:** 
 +  * Connection from world to WAN1 IP port 2196 works. 
 +  * Connection from world to WAN2 IP prot 2196 doesn't work. It is correctly forwarded to LAN host, but response is sent using wrong WAN1 interface (src IP is WAN2 IP). 
 +**Solution ** 
 +  * Do not create NAT rule for **interface group**. Use duplicated rules for each WAN interface 
 + 
 + 
 +===== multi wan: lan gw was chosen ====
 If gateway switching is used, it is needed to set all not WAN gateways as forced down. If gateway switching is used, it is needed to set all not WAN gateways as forced down.
  
Line 28: Line 91:
 Firewall --> Settings --> Advanced: Tick **Disable force gateway** (Outgoing packets from this firewall on an interface which has a gateway will normally use the specified gateway for that interface. When this option is set the route will be selected by the system routing table instead.) Firewall --> Settings --> Advanced: Tick **Disable force gateway** (Outgoing packets from this firewall on an interface which has a gateway will normally use the specified gateway for that interface. When this option is set the route will be selected by the system routing table instead.)
  
 +
 +====== cannot reach another VLAN from VPN ======
 +
 +Check for asymetric routing. Firewall cannot track one way packet flow so packets are blocke by default rule.
 +Solution is to add pass rule without connection tracking enabled (tracking ''none'').