As long as you use a dot between, there should not be any problem. For example, instead of .local you can use .domain.local, so devices should be: device1.domain.local, device2.domain.local and mDNS would still be mdnsdevice.local

Glad it was helpful!

Same. Looking at switching internal network over

I learnt more about ipv4 then I did at a university

The UI is really good! It just has a ton of features packed in that it can be intimidating.

No problem 👍

Working on it!

Tayga is available in OPNsense but not nearly as performant as Jool, which being a Linux kernel module isn't available on OPNsense. But it's definitely an option, and Tayga can act as either side of a 464XLAT setup. Multihoming is a bit more tricky, due to combinations of IPv6 being really designed for you to use BGP instead (the correct way to multihome) and bsd pf having quirks around gateway addressing and source-address-based routing and stuff like that. So both are on the todo list, but behind the more basic stuff. But thanks!

Glad you like it!

Juicy!

Glad I could help!

Both on the list!

Checking the box to use the settings from DHCPv6 will use OPNsense's own IP for DNS and domain, because that's the default for DHCPv6.

It's not something I've talked about yet, but I could probably make a little video on that

I'm working on them!

Thanks!

Could you tell briefly what makes you prefer opnsense over pfsense?

@@Mikesco3 could you tell us your preference and why?

As far as i know you dont need subnetting. Your /48 /54 or whatever would be your prefix provided by your isp, has 64-48bits (2¹⁶) reserved for your subnet. So, u Will have 2¹⁶ subnet and every single One has 2⁶⁴ Client. You could subnetting ipv4 style but Is not necessary/raccomanded/useful.sry for my english.

You don't subnet the same way as in v4 (essentially randomly + NAT), you end up with either a subnet id (for small sites) or a hierarchy of what the nibbles mean (on more complex routed sites). It's much more organized and easy to follow.

@@apalrdsadventures so how do you do network segregation with vlans and ipv6?

@@vaidkun same as ipv4, except you dont need a broadcast ip. You still have a network ipv6 address like 2001:db8:acad:1::/64 - 2001:db8:acad:2::/64 until 2001:db8:acad:ffff/64. I.e. 2001:db8:acad:1::1 Is the router interface and the 2⁶⁴ Minus 1 are the availables host address.

Subnets are /64, and the ISP gives you something larger (/56, /60, ..) so you can create subnets out of the remaining bits in the address. With a /56 you can create 256 subnets for your extra interfaces/vlan interfaces.

DoT is an RFC standard and more widely used than DNSCrypt

Proxmox is a bit of a special thing since it does name-resolving in the cluster (even for a single node) using the hosts file, and isn't really designed to deal with DHCP (even static addresses). So that could be related to your issues.

@@apalrdsadventures thanks for the response! I joined the Discord, and I may ask further questions there about Proxmox soecifically. Would definitely love a continuation of this video with static IP setups in Opnsense.

draw.io

Basically, with SLAAC the router advertises the prefix (/64) and nodes are free to chose their own suffix (last /64 to make a /128) using a number of algorithms of their choice. A very common algorithm used to be EUI64 (basically, take the MAC address and add ff:fe in the middle to make it 64 bits - xxxx:xxFF:FExx:xxxx). A lot of servers and Linux server-focused distros do this, as well as IoT devices with more minimal network stacks. Often you can guess the address for IoT devices based on the MAC address sticker on the box. The other common option is called 'stable privacy', where the host takes the hash of the prefix + some internal and unique but stable identifier like a serial number or uuid or mac address to come up with its suffix. This is stable over time, but can't be guessed, and is also guaranteed to change on new networks (so the suffix can't be tracked as the device moves across subnets). This is the address you want to use for incoming traffic, but it will change if the prefix does. The temporary address are randomly generated and will change regularly. If an OS is using non-EUI64 addresses it should have both a stable privacy and a temporary address. I don't recall what Windows calls them. Linux denotes the 'temporary' addresses in `ip a` and macos denotes the stable addresses as 'secured'.

In general this is how I did the basics of it, but the next video will be on subnetting and network management with subnets. Probably will be ~3 weeks for that video, depending on how many other projects I'm working on.

kzfaq.info/get/bejne/l9Gkf7WavL7KoZs.html

Unless you're using development builds (OPNsense is open-source after all, so you are free to), it's not a rolling release. They publish new versions with feature updates every 6 months and continuously publish security updates for current and several previous versions with support going back ~4 major versions. They are just able to get new features introduced in under a year and release when they say they will.

​@@apalrdsadventures That release cycle sounds like a desktop OS, for a router i think a slower one is better. Sometimes less is more.... ;)

In general they are doing updates which track with FreeBSD's releases. FreeBSD's releases tend to be yearly in the spring, so they are following that with a summer OPNsense release.

Opnsense does support a alias type called dynamic host. This allows you to specify the second half of the v6 address and opnsense will automatically add the current prefix.

You can also create an alias for a MAC address, and it will resolve to all of the IPv4/IPv6 addresses of that host.

I use draw.io but the desktop app version

In general FreeBSD / OPNsense does not have a lot of functional network drivers. I wouldn't expect to get it working.

With proper zero trust, OPNsense isn't involved at all

@@apalrdsadventuresthanks for the response i've been watching your videos forever, but I meant a complete end to end zero trust network setup from creating the vlans to host the lxc to routing the ports across other vlans to access the resource

Ah that's a bit different than a 'zero-trust network architecture' that's a sorta IT buzzword right now. In that setup, each node is responsible for its own session validation and the network infrastructure does a lot less (since firewalling is end to end and not a box in the middle).

If you're doing PPPoE that specific tunnel driver is still single-thread limited. Other than that, there isn't a single core limitation. I personally don't virtualize the perimeter router since it's so critical to the network that I want it to have dedicated hardware, even if that hardware is small and fanless.

​@@apalrdsadventuresthanks, super helpful video. Your isp gives you a /62 prefix for real? So disgusting! Vodafone do the same here in Europe. Im super lucky with my fully compilant /48.

The standards orgs have decided on /48 as the smallest routable prefix, and suggested ISPs give /48 to customers but /56 to residential (which is still 256 subnets). I actually get a /60 directly from my ISP (which is still small), which I then further delegate to a /62 for the lab network. So you're seeing OPNsense getting a prefix delegation from my main router which got a larger delegation from the upstream ISP.

draw.io

Depending on your needs, there aren't a ton of options. You can build a firewall out of 'bare' iptables / firewalld and `ip route` if you want to do things more manually. For a setup like the video it's not super hard to do with dnsmasq + firewalld, but there is no web UI for guidance. VyOS is Debian-based and tries to create a single CLI to configure, but it's not particularly excellent. OpenWRT (which is not Debian based but is Linux) works well but has a very minimal web UI since it's designed to fit on converted router hardware. The OPNsense UI is much better than either of those options.

You don't need Debian for the firewall. You need something that works AND can be managed. pfSense and OPNsense are BSD-based. The best you can get for security. Sophos has a free-for-home/paid-for-work firewall (Xstream) which is fantastic. Not Debian-based of course. Appliance or VM. We've got 22,000+ Linux instances and around 200 firewalls and we don't know what the firewalls are based on. They're commercial hardware appliances with some hardened Linux (my guess) or BSD. Rolling your own firewall using Linux? For home, sure. Not too hard. For a work environment? LOL Nope. Not if you have many services/people/requirements/ACLs/GPE/yada. ACLs and Group Policies will kill you alone. I used to do it on the OLD Red Hat Linux v7/v9 days. Also remember in a work setup you always want clustered firewalls. It's never a good plan to not plan on something going down, or needing to take it down for administration/updates. I duplicate mine at home for the same reason.

Depends on what sort of network you are building. If you're building out a datacenter or SaaS type backend network and you are doing a lot of dynamic routing, yeah building it all on Linux is probably not a bad good idea. Building an access network for a bunch of client laptops to use Word? yeah no don't roll your own.

@@Doesntcompute2k not with Linux, but BSD with pf isn't actually that difficult.

Thanks for the detailed replies everyone! Good inputs, I will checkout out VyOS, currently there are no immediate plans, but just a thought as the recent move is helping the teams where I work. Thanks again!

Zerotier isn't something I use myself, I actually use Nebula instead

They changed their license, instead do consider Netbird, they are new and have a dfsg approved license.

​@@apalrdsadventures built-in Wireguard is better than nebula right ? Why choosing nebula over wireguard ?

eh it depends on your use case. Nebula is designed to make a point to point routed network without any previous knowledge of the other nodes in the network, other than the lighthouse. It also adds features like identity to its certificate. Wireguard provides the absolute bare minimum to pass traffic and provides nothing else for managing and discovering endpoints and configuring routes. Some platforms like Tailscale build on the Wireguard crypto to provide a lot more, but they also introduce the single point of failure Headscale server. OpenVPN is often hated for being slow, but this is partially because it provides a ton of useful features for managing remote user access like server-side configuration of client routes, enterprise user authentication (usernames/passwords and connections to identity databases), and things like that. Nebula (and OpenVPN) also use AES instead of ChaCha cipher, which is significantly faster if you have hardware acceleration for it. Wireguard stays fast by implementing no features.

It does, and it can do policy routing across the tunnel. The UI for individual clients isn't fantastic, but you can add peers and assign them to tunnel adapters.

@ServeTheHomeVideo has a lot of great reviews on mini boxes depending on what you need. I'll refer you to him.

Okay, I'll take a look at his articles (those are usually pretty good), I just can't stand his videos.

He's the only one I know that has thoroughly tested a large number of mini-PCs with a wide variety of IO for mini servers and networking. If you're doing SFP+ fiber you can also just use a managed switch and bring in WAN on a VLAN. Like any other interface, create the vlan, then move WAN to that interface.

I finished the bulk of my network re-work last night. After a lot of research and thought I decided to run OPNSense in a VM, It has a dual NIC passed through for the WAN port (and a spare if I need it later) With my LAN interface on a Proxmox bridge to my 10gb switch (along with a few more interfaces for DMZ, an old forum I host, and my own services). One of the main reasons I switched was to implement IPv6, of course I now know my damn ISP doesn't support it. But despite that I can say I like OPNSense a lot more then the UBNT router it replaced, Your videos have bean some of the most straightforward ones I've found. if you ever setup a patreon I'll support you on that (I'll send you a bit on ko-fi for now). Thank you.

Internal (OSPF / friends) or external (BGP)?

The prefix 100.64/10 is formally assigned to be used by ISPs for carrier grade NAT. Tailscale is squatting in an improper IPv4 semi-private range (they should be using the RFC1918 space, 10/8, 172.16/12, and 192.168/16). But no, it's only a filter on packets entering/leaving that interface, not via tunnels which run over that interface.

@@apalrdsadventuresThanks for the quick and clear reply! Your video and style of explanation is by far the best I've found on these topics here. You're clear and explain what's important without wasting time or skipping important stuff. Really looking forward to more of this. I looked at Tailscale's FAQ, and their explanation for the use of the ISP CG-NAT space is "Philosophically, Tailscale is a service provider creating a shared network on top of the regular Internet."

My experience with OpenWRT is that the functionality is all there in packages but the UI is severely lacking compared to OPNsense. There are Linux programs which will do almost anything, and you can install them, but that doesn't mean it's well integrated into the UI / distribution.

@@apalrdsadventures No, it is not. It's a mixed bag, since it's designed for embedded devices, there's no decent way of performing upgrades compared to OPNSense. Also, I need Unbound for getting multiple domain resolution which is not working in OpenWRT's dnsmasq and using unbound under OpenWRT has to be done with some kind of wizardry to get it working without messing up dnsmasq+DHCP... I will go with OPNSense this winter, as I will use the integrated HAProxy with it. Need to get it running in my lab these days for debugging/testing all my config until it's perfect for day to day usage. Also, love the diagnostics and reporting tools in OPNSense, makes everything more "visible" instead of just "working"... or not.

If it's a 64-bit PC platform it should work.

/59 is such a weird size! At least make it line up with the nibbles!

@@apalrdsadventures Absolutely, but at least Telekom (DTAG) gives me a /56

It’s likely you’ll have to use SLAAC on WAN. The mobile router is probably doing nat and v6 router advertisement itself, at least that’s what mobile hotspots usually do. That also means you only get a single preset, because that’s all the mobile router will pass through.

@@apalrdsadventures Hi, I followed your advice. It had add a new entry in the gateway's lobby, called LAN_TRACK6. I reboot it, and it seems to work. I will add a comment if i experience a new issue. Thanks for your answer.

Yes, that's true. They should be using 100.64/10 (which is designated for CGNAT) instead of 10/8, but some ISPs do it wrong. In any case though you'll need to uncheck the RFC1918 box.

@apalrdsadventures ok thanks and is there anything else I may have to do?

unchecking the box should be all you need to do. Also I would avoid using the 10 subnet range on your own if your ISP is also using parts of it.

@apalrdsadventures ok I unchecked that box. It shows my wan connection is up and my tv is working through wifi but my pc won't connect to the internet. It shows I am connected. Any ideas?