HA Sync broken when using proxy to update Opnsense

[fauconjeff]

Important notices

[X] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
[X] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Problem description

When a proxy.conf file is added to /usr/local/opnsense/service/conf/configd.conf.d/, it breaks the HA Sync functionality.

To Reproduce

1. Go to the CLI and create a file named proxy.conf in /usr/local/opnsense/service/conf/configd.conf.d/
2. Restart configd by invoking service configd restart
3. Go to High Availability: Status page on the master and it will hang on Loading.... for a while, then display the error: The backup firewall is not accessible (check user credentials)
4. With a second web page opened with Firewall/Log Files/Live View, there is no network activity for the pfsync interface while going to High Availability: Status

There is a way to sync the node by invoking /usr/local/etc/rc.filter_synchronize with CLI.

That command is working fine and we can see activity in the Live View.

Software version: OPNsense 25.1.7_4-amd64 running on Proxmox v8.3.5

[AdSchellevis]

you probably need this opnsense/docs@1d7d160

[fauconjeff]

you probably need this opnsense/docs@1d7d160

Hi, thanks for that.

I tried adding noproxy= to my proxy.conf master OpnSense but it's not working.

I also added noproxy= on the slave OpnSense and it's still not working.

Both configd service has been restarted.

I also tried to put master xmlrpc ip on the master (itself) and the same on the slave, restarted service but still not working.

[AdSchellevis]

that is unlikely, which exact content was entered? (and configured on the master)

[fauconjeff]

that is unlikely, which exact content was entered? (and configured on the master)

This is my proxy.conf file on the master. 192.168.240.1 is the master xmlrpc interface ip.

[environment]
HTTP_PROXY=http://172.29.174.99:3128
HTTPS_PROXY=http://172.29.174.99:3128
noproxy=192.168.240.1

[AdSchellevis]

noproxy=192.168.240.2

[fauconjeff]

Unfortunately, even if I enter the IP of the backup firewall (192.168.240.2) and restart configd, the problem is the same. It hangs on Loading....

If I rename the file to proxy.conf.bak and restart the service, it work very well. But i'm loosing the ability to upgrade the systems.

I also tried to add this noproxy setting on the backup node as well, with it's own IP, and also the IP of the Master but it's still not working.

Is there any log I can get to help you troubleshoot?

Thanks for your help!

[g7-byte]

Try NO_PROXY instead of noproxy. It worked for me...

[AdSchellevis]

it looks like I forgot the underscore indeed, I'll update the docs on our end (https://curl.se/libcurl/c/CURLOPT_NOPROXY.html)

[fauconjeff]

My issue is resolved! G7_byte was right. Thank you for that !

I don't know who's responsible of that document, but it might be a good idea to add a note about the NO_PROXY as well

https://docs.opnsense.org/development/backend/configd.html

Thanks !

[AdSchellevis]

opnsense/docs@9c553c8