11.2
opnsense
Disable the pf ftp proxy handler.
debug.pfftpproxy
default
Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html
vfs.read_max
default
Set the ephemeral port range to be lower.
net.inet.ip.portrange.first
default
Drop packets to closed TCP ports without returning a RST
net.inet.tcp.blackhole
default
Do not send ICMP port unreachable messages for closed UDP ports
net.inet.udp.blackhole
default
Randomize the ID field in IP packets (default is 0: sequential IP IDs)
net.inet.ip.random_id
default
Source routing is another way for an attacker to try to reach non-routable addresses behind your box. It can also be used to probe for information about your internal networks. These functions come enabled as part of the standard FreeBSD core system.
net.inet.ip.sourceroute
default
Source routing is another way for an attacker to try to reach non-routable addresses behind your box. It can also be used to probe for information about your internal networks. These functions come enabled as part of the standard FreeBSD core system.
net.inet.ip.accept_sourceroute
default
Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect packets without returning a response.
net.inet.icmp.drop_redirect
default
This option turns off the logging of redirect packets because there is no limit and this could fill up your logs consuming your whole hard drive.
net.inet.icmp.log_redirect
default
Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)
net.inet.tcp.drop_synfin
default
Enable sending IPv4 redirects
net.inet.ip.redirect
default
Enable sending IPv6 redirects
net.inet6.ip6.redirect
default
Enable privacy settings for IPv6 (RFC 4941)
net.inet6.ip6.use_tempaddr
default
Prefer privacy addresses and use them over the normal addresses
net.inet6.ip6.prefer_tempaddr
default
Generate SYN cookies for outbound SYN-ACK packets
net.inet.tcp.syncookies
default
Maximum incoming/outgoing TCP datagram size (receive)
net.inet.tcp.recvspace
default
Maximum incoming/outgoing TCP datagram size (send)
net.inet.tcp.sendspace
default
IP Fastforwarding
net.inet.ip.fastforwarding
default
Do not delay ACK to try and piggyback it onto a data packet
net.inet.tcp.delayed_ack
default
Maximum outgoing UDP datagram size
net.inet.udp.maxdgram
default
Handling of non-IP packets which are not passed to pfil (see if_bridge(4))
net.link.bridge.pfil_onlyip
default
Set to 0 to disable filtering on the incoming and outgoing member interfaces.
net.link.bridge.pfil_member
default
Set to 1 to enable filtering on the bridge interface
net.link.bridge.pfil_bridge
default
Allow unprivileged access to tap(4) device nodes
net.link.tap.user_open
default
Randomize PIDs (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())
kern.randompid
default
Maximum size of the IP input queue
net.inet.ip.intr_queue_maxlen
default
Disable CTRL+ALT+Delete reboot from keyboard.
hw.syscons.kbd_reboot
default
Enable TCP extended debugging
net.inet.tcp.log_debug
default
Set ICMP Limits
net.inet.icmp.icmplim
default
TCP Offload Engine
net.inet.tcp.tso
default
UDP Checksums
net.inet.udp.checksum
default
Maximum socket buffer size
kern.ipc.maxsockbuf
default
normal
OPNsense
localdomain
admins
System Administrators
system
1999
- 0
page-all
root
System Administrator
system
admins
$6$$Y8Et6wWDdXO2tJZRabvSfQvG2Lc8bAS6D9COIsMXEJ2KjA27wqDuAyd/CdazBQc3H3xQX.JXMKxJeRz2OqTkl.
0
user-shell-access
2000
2000
Europe/Amsterdam
300
0.nl.pool.ntp.org
https
56b9fb5b8286f
yes
1
hadp
hadp
hadp
monthly
115200
serial
enabled
1
1
1
em1
1
1
172.10.1.1
16
GW
1
em0
192.168.1.1
24
track6
64
wan
0
192.168.1.100
192.168.1.199
public
automatic
pass wan inet keep state IPsec ESP IPsec Tunnels esp

            1

wanip
root@192.168.2.100
1455114204.0256
/firewall_rules_edit.php made changes
root@192.168.1.100
1455096108.0361
/firewall_rules_edit.php made changes
pass wan inet keep state IPsec ISAKMP IPsec Tunnels tcp/udp

            1

wanip
500
root@192.168.1.100
1455096177.3235
/firewall_rules_edit.php made changes
root@192.168.1.100
1455096177.3235
/firewall_rules_edit.php made changes
pass wan inet keep state IPsec NAT-T IPsec Tunnels tcp/udp

            1

wanip
4500
root@192.168.1.100
1455098132.7549
/firewall_rules_edit.php made changes
root@192.168.1.100
1455098132.7549
/firewall_rules_edit.php made changes
pass inet Default allow LAN to any rule lan

            lan

pass inet6 Default allow LAN IPv6 to any rule lan

            lan

pass enc0 inet keep state Allow IPsec traffic to LAN net IPsec Tunnels

            1

lan
root@192.168.2.100
1455102323.9398
/firewall_rules_edit.php made changes
root@192.168.1.100
1455096209.0845
/firewall_rules_edit.php made changes
1,31
0-5
*
*
*
root
adjkerntz -a
1
3
1
*
*
root
/usr/local/etc/rc.update_bogons
*/60
*
*
*
*
root
/usr/local/sbin/expiretable -v -t 3600 sshlockout
1
1
*
*
*
root
/usr/local/etc/rc.dyndns.update
*/60
*
*
*
*
root
/usr/local/sbin/expiretable -v -t 3600 virusprot
30
12
*
*
*
root
/usr/local/etc/rc.update_urltables
ICMP
icmp ICMP
TCP
tcp Generic TCP
HTTP
http Generic HTTP / `200`
HTTPS
https Generic HTTPS / `200`
SMTP
send Generic SMTP 220 *
system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,interface_statistics-container:col1:close,interface_list-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close
root@192.168.2.100
1455114204.0339
/firewall_rules_edit.php made changes
56b9fb5b8286f
webConfigurator default
ikev2
wan main inet myaddress peeraddress aes 256 sha512 14 28800 At4aDMOAOub2NwT6gMHA pre_shared_key Site B off 172.10.2.1 1
1
56ba1241e5d1c
tunnel
14
3600
Local LAN Site B
esp
lan
network

    192.168.2.0

24
aes
256
hmac_sha512
1
wan 172.10.2.1 GW 1 inet Remote Gateway 1