Messages

If I run this command on 26.7.9_1, I get:

pkg audit -F
vulnxml file up-to-date
python313-3.13.18 is vulnerable:
  Python -- poplib module, when passed a user-controlled command, can have addit                                                                                                            ional commands injected using newlines
  CVE: CVE-2025-15367
  WWW: https://vuxml.FreeBSD.org/freebsd/6d3488ae-2e0f-11f1-88c7-00a098b42aeb.ht                                                                                                            ml

libX11-1.6.12,1 is vulnerable:
  libX11 -- Sub-object overflows
  CVE: CVE-2023-3138
  WWW: https://vuxml.FreeBSD.org/freebsd/734b8f46-773d-4fef-bed3-61114fe8e4c5.ht                                                                                                            ml

  libX11 -- Arbitrary code execution
  CVE: CVE-2021-31535
  WWW: https://vuxml.FreeBSD.org/freebsd/58d6ed66-c2e8-11eb-9fb0-6451062f0f7a.ht                                                                                                            ml

  libX11 -- multiple vulnerabilities
  CVE: CVE-2026-88806
  CVE: CVE-2026-94283
  CVE: CVE-2026-94284
  CVE: CVE-2026-94285
  WWW: https://vuxml.FreeBSD.org/freebsd/fbf59c13-ca23-11f1-ada1-ac5afc632ba3.ht                                                                                                            ml

4 problem(s) in 2 package(s) found.

Hi,

only for information:
I use os-frr for bgp
When I'm inside of the web-gui, I see with 'top' 4 to 6 processes of python combined with netstat running at nearly 100% cpu load.
I think this comes from the dashboard widgets.
But even if I change, for example, to the rules tap, the processes keeps running.
When I logged out from the web-gui, the processes removes.

I agree with you.

But ... why does opnsense simply don't do that?
Handle the access to the web-GUI and SSH by setting system rules and listen general on 0.0.0.0
instead of really doing a bind.

I think this would be the best way.

Yes, of course, I set it to only listen on LAN.

AI mentioned that I should set a route map in the section RIP for redistribution bgp:

router rip
 default-metric 5
 network x.x.x.x/24
 passive-interface vlan0.x
 passive-interface vlan0.y
 passive-interface vlan0.z
 redistribute bgp
 version 2
exit

-> redistribute bgp route-map Only_Default

Else all routes of the internet will flood the internal routers.

But I can not set a route-map in the RIP menue.

Is the AI corect?
How canI achieve this entry?

Hi,

for a special case (frr/bgp) we allowed GUI only on LAN, for the first setup we used DHCP on LAN, with an address from our management network.
I was not able to acces the GUI.
Ping was Ok.

On the console I can see that 443 listen is:
tcp4 127.0.0.1:443
tcp6 ::1:443

But not on the LAN address.
I think that the DHCP address was not available at web_gui start.
An uggly situation.
Ok, I solved it by using a fixed address.
But still, it should also work with a DHCP address on that interface.

Hi,

on the console of the master OPNsense with 26.1.9 I get:

pfr_update_stats: assertion failed.

Every 10 minutes.

Any idea where I can get more informations?

Hi,

If I change the advbase on the master (from 1 to 2) and sync the configuration to the slave,
the interfae on the slave looses CARP.

If I reboot the slave, the interface has CARP with the new advbase.

opnsense 26.1.8_5

Strange that it does not happen always, only sometimes.

I solved the problem now by putting the slave bce3 interface on an other switch.

But how can I see/show the 00:00:5E address on the opnsense?

ifconfig doesn't show it.

Btw. switching master in maintenance and back works correct.

How can I see which OPNsense owns the 00:00:5E mac address?

Hm ...

as written: the DUP! happens only when I ping from a server which is in the same net:

Code Select Expand

64 bytes from 192.168.254.248: icmp_seq=537 ttl=64 time=0,400 ms
64 bytes from 192.168.254.248: icmp_seq=538 ttl=64 time=0,338 ms
64 bytes from 192.168.254.248: icmp_seq=539 ttl=64 time=0,286 ms
64 bytes from 192.168.254.248: icmp_seq=540 ttl=64 time=0,202 ms
64 bytes from 192.168.254.248: icmp_seq=541 ttl=64 time=0,261 ms
64 bytes from 192.168.254.248: icmp_seq=541 ttl=64 time=0,350 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=542 ttl=64 time=0,275 ms
64 bytes from 192.168.254.248: icmp_seq=542 ttl=64 time=0,328 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=543 ttl=64 time=0,389 ms
64 bytes from 192.168.254.248: icmp_seq=544 ttl=64 time=0,421 ms
64 bytes from 192.168.254.248: icmp_seq=544 ttl=64 time=0,477 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=545 ttl=64 time=0,305 ms
64 bytes from 192.168.254.248: icmp_seq=546 ttl=64 time=0,319 ms
64 bytes from 192.168.254.248: icmp_seq=547 ttl=64 time=0,395 ms
64 bytes from 192.168.254.248: icmp_seq=548 ttl=64 time=0,319 ms
64 bytes from 192.168.254.248: icmp_seq=548 ttl=64 time=0,373 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=549 ttl=64 time=0,267 ms
64 bytes from 192.168.254.248: icmp_seq=550 ttl=64 time=0,336 ms

So it happens not for every ping.

If I ping 248 from my local PC which is not in the same net, it works correct, no DUPs


Master:

Code Select Expand

ifconfig bce3
bce3: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: MANAGEMENT (opt1)
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether 1c:c1:de:06:46:a2
        inet 192.168.254.252 netmask 0xfffffc00 broadcast 192.168.255.255
        inet 192.168.254.248 netmask 0xfffffc00 broadcast 192.168.255.255 vhid 16
        groups: CARP_Group
        carp: MASTER vhid 16 advbase 1 advskew 0
              peer 224.0.0.18 peer6 ff02::12
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Slave:

Code Select Expand

ifconfig bce3
bce3: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: MANAGEMENT (opt1)
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether 1c:c1:de:06:38:42
        inet 192.168.254.253 netmask 0xfffffc00 broadcast 192.168.255.255
        inet 192.168.254.248 netmask 0xfffffc00 broadcast 192.168.255.255 vhid 16
        groups: CARP_Group
        carp: BACKUP vhid 16 advbase 1 advskew 100
              peer 224.0.0.18 peer6 ff02::12
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>


This interface is on a dedicated 1GB port. No other stuff (VLANs) are involved.

Both opnsense are connected to the same (none stacked) switch.
As already written: clearing the mac address cache changed nothing.

It is very strange.
Even if the packet receives the slave, since the interface tells us 'backup', why is it sending a reply?

We have several interfaces in CARP.
If we ping the VIP address from one of them (no VLAN)
I get sporadic a DUP! and I can see that the slave, which is in backup mode, get the request and replies.
Not on every request, only sometimes.
We already cleared the arp cache of the involved switches.

As you can see, both opnsense send a reply:

Code Select Expand

17:19:32.363137 1c:c1:de:06:46:a2 > a4:bf:01:16:b1:db, ethertype IPv4 (0x0800), length 98: 192.168.254.248 > 192.168.254.167: ICMP echo reply, id 3595
64
17:19:32.363335 1c:c1:de:06:38:42 > a4:bf:01:16:b1:db, ethertype IPv4 (0x0800), length 98: 192.168.254.248 > 192.168.254.167: ICMP echo reply, id 3595
64

But this happens only on the interface without VLAN and on an other interface.
And only when we ping from a server which has also an interface in the same network.

In dmesg I can not see any change of the CARP mode, so it is not 'flipping'.

We are running out of ideas.

Any other idea?

A second try was working without problems.

Hi,

I succesfully updated Slave and Master (CARP) opnsense to 26.1.6
After this I did some changes on the Master and tried to do a HA sync.
Suddenly I got an e-mail from monit of the Slave: CARP status changed
Master was no longer accesible via web GUI. With iLO I came to the console, but no prompt.
I was only able to send a CTRL+ALT+DEL and it started to reboot.

Now it stucks after >>> Invoking backup script 'netflow'

Ok, after a long time it went to the next step and comes up.
But ... a problem with CARP is detected and Master stays on backup.

I had to enter and leave maintenance mode to bring things back to normal.

Can someone confirm such a behaviour?