Messages

my vp2420 has no sfp+ ports
it has 4 i225-v (revision 3)
it is absolutly possible that some tunable values exist due to former upgrades; it was not a fresh install.
the interesting part is, that the not optimal settings worked under 26.1.11

they are not there per default.
you have to create them.
in the opnsense webgui go to system/settings/tunables
in the right bottom section click the plus button.
an edit tunable window appears.
tunable is the name of the tunable variable
value of course the value
and description what ever you like

t.

just wanted to leave a short note because i ran in an issue after upgrading from 26.1.11 to 26.7.1 on a protectli vp2420.
after upgrading i noticed that the download throuput was roughly half of befor the upgrade.
i also noticed a increased rtt, rttd times during the speedtest.
first i blamed the internet provider of course ;) . as an old it vetran i have learnd that the root cause is always the network (just a joke).

turned out that following settings solved the problem:
net.isr.bindthreads: 1
net.isr.numthreads: 4
net.isr.maxthreads: 4


the original values:
net.isr.bindthreads: 0
net.isr.maxthreads: 1
net.isr.numthreads: 1

if i think about it, the original values dont make much sense for a 4 core system but worked for 26.1.11. However they did not for 26.7.1

keep in mind this is for a protectli vp2420 4 cores.

have a good time

t.

first of all, i like opnsense and i am an absolute supporter, my comment was meant to be absolutely constructive... i personally wasn't aware that a rather simple looking feature can have a nearly 50% performance impact and i have a feeling as if i couldn't be the only one, so i just wanted to share information.

can you give as some information about your usecase and the services you want to use (IPS, Proxy, Tor....).
If your requirements are not to high maybe this hardware may suite your needs:
https://www.supermicro.com/en/products/system/Box_PC/SYS-E50-9AP-N5.cfm

i personally use a e100-9ap and i am quite happy with it

A quick follow up. I am routing about 20 vlans. I read a lot about performance tuning and in one post the captive portals performance impact was mentioned. Recently i changed my WiFi setup and at some point i have tried the captive portal function for a guest vlan. So i gave it a try and disabled the captive portal (was active for one vlan) . I could not beliefe my eyes when i tested the throughput again.

captive portal enabled for one vlan:
530 Mbit/s

captive portal disabled:
910 Mbit/s

just for the record. i am also experiencing degraded throughput. lan routing between different vlans only with firewall enabled, no IPS etc. is around 550 Mbit/s. the setup is switch -> 1Gbit trunk -> switch -> 1Gbit trunk -> opnsense fw. Low overall traffic.

Have you checked the watchdog settings in your bios?

these are standard messages.
The opnsense gui shows the servertime and the sync source under dashboard\lobby in the section network time.

for me to work correctly, i had to set kern.timecounter.hardware in the system\settings\tunables
i have set the value to "HPET"

t.

happend to me too.
The very short version:

Download image (vga version)
sha256 check
Unzip
Take usb stick and clean with:
diskpart,list disks,select disks (‼ be sure its the USB stick), clean

Use rufus to create bootable image: dd image (the extracted opnsense file), GBT UEFI, 8192(default),fat32

Login with installer and pw opnsense
Install

Connect via cable to 192.168.1.1
Login with root and your pw from the install process
Restore backup
Modify your needed variables in tunables via the GUI or set in /boot/loader.conf.local

t.

Just in case someone is on the same hardware.
Upgraded my firmware for the supermicro E100-9AP to 1.2.
For some strange reason and to my surprise the system bootet into an sdhci pci X-slot 0  timeout.
After several timeouts the system continous to boot.

#I had to set the following in /boot/device.hints - looks like the file is overwritten by the latest update
So i set the following in /boot/loader.conf.local

hint.sdhci_pci.0.disabled="1"
hint.sdhci_pci.1.disabled="1"
hint.sdhci_pci.2.disabled="1"

t.

[restart unbound]

today i was able to take a closer look at the problem.
after i found out about /usr/local/opnsense/scripts/dns/unbound_dhcpd.py i looked into the scipt.
unbound_control is used to list and read the local data.
So to further isolate my problem i started with:

Code Select Expand

unbound-control -c /var/unbound/unbound.conf list_loca_data
I was greeted by an error message:

error: SSL handshake failed
2586055198312:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verfify failed:s3_clnt.c:1269:

the reason my /var/unbound/dhcpleases.conf is empty, is because the command (unbound_control) that wants to read my local data fails.

so i asked my second best friend google and found:
https://forum.ipfire.org/viewtopic.php?t=18906

inspired by this post and after reading https://www.unbound.net/documentation/unbound-anchor.html i:

sshed into the opnsense box

Code Select Expand


cd  /var/unbound
mv root.key _root.key
mv unbound_control.key _unbound_control.key
mv unbound_control.pem _unbound_control.pem


restart unbound in the opnsense gui under System/Diagnostics/Services

unbound restarts and the files root.key, unbound_control.key and unbound_control.pem get regenerated.

Now # unbound-control -c /var/unbound/unbound.conf list_loca_data works and /var/unbound/dhcpleases.conf can be written.

i now can resolve my local dhcp-clients.

Jupidu!

thanks for your reply. yes the dns-server the clients via DHCP is the opnsensebox.

Hi,

i have setup dhcp and unbound.
Under System/General/Domain, a domain is set.

Unbound is enabled and "Register DHCP leases in the DNS Resolver" and "Register DHCP static mappings in the DNS Resolver" is set.

My clients do get an ip, dns-server,gateway, dns suffix... via dhcp
I can see the leased IPs under DHCPv4/Leases

However i cant resolve the hosts in my environment.
I have noticed that /var/unbound/dhcpleases.conf is empty!

What i have already tried ist:
set "System\Settings\Administration\Disable DNS Rebinding Checks"
set "Unbound DNS\General\Local Zone Type\static"

Any ideas?

Thx t.

offensichtlich ein bekanntes Verhalten und die Art und Weise wie der PF arbeitet:
https://forum.pfsense.org/index.php?topic=39895.0
http://freebsd.1045724.x6.nabble.com/PF-quot-keep-state-quot-for-ICMP-td4183717.html

LG
t.