Messages

There's a reasonably active init7 sub on Reddit, it may be worth also asking your question there?

Thanks for your help.

I switched to pre-shared keys and now it's working. I might try public key again at some point.

I'm trying to set up an IPSeC site to site VPN using the new 'connections' but I'm struggling.

It's probably simple but can someone please explain this part of the instructions?

Key pairs

Go to the VPN->IPsec->Key Pairs option in the menu and create a new key on both hosts, then copy the public part from Site A to Site B and vice versa. Keys may easily be generated with the gear button in the Key type field.

OK, so I have generated a new key on both hosts. But then where do I copy the public part to? From Site A to Site B - where does it go on site B?

Sorry if this is obvious but it's not at all clear to me.

Thanks :)

Note the port assignment is a tool for initial assignment, not for changing configurations on the fly. It can work, but it's not designed to care much and never has been since.


Cheers,
Franco

Thanks Franco. Duly noted. How should
I have done this properly?

For a while I had an old mac mini with additional thunderbolt ethernet ports as a backup for a DEC750. I used to download the config from the DEC750 and run it through sed (global search and replace tool) to replace all interface names, like "s/igb0/bge1/g" and so on. One may even map multiple interfaces from the old setup to one in the new one. Worked like a charm for me.

Just note down the interface names on the originating machine, log into a default installation on the destination machine and you'll see which interface names need to be replaced and how. Modify the config file and restore it on the new hardware. Same in your case, when changing interface adaptor cards.

That's a neat trick  - thanks.

But I couldn't connect to the web interface because I had no network connections - only the console.

I changed the NIC in my OPnsense box from a quad Gbit to a dual 10Gbit card. This meant the interfaces changed - what were previously igb0/1 became ix0/1 after the change.

So I logged in on the console and ran option 1) Assign interfaces.

But this caused Unbound and ISC to be disabled and Dnsmasq to be enabled. It took a lot of faffing around to sort this out. Should this have happened? Or did I do the wrong thing when I changed the NIC? I'd like to learn from this experience... 

Thanks :)

Here's the output of that command.

Thanks Franco. I can provide logs if they might be of help. The system seems to be ok now.

I just got this rather scary message during the update to 25.7.6. The update appeared to stop.

I couldn't log in at the console, I got this error:

Password:
sh: /usr/local/libexec/opnsense-auth: not found
Login incorrect

The GUI then gave a 404 error.

After a couple of minutes it sprang back into life.

I've never seen this behaviour before - is it expected?

The update appears to have now completed successfully, as far as I can tell.

I'm trying to migrate a legacy site-to-site IPSEC VPN tunnel to the new Connections, but the proposal used isn't listed in the dropdown.
How do I get around this?
It's aes192-sha1-modp1024 and I can't change it because of the router hardware at the remote end of the connection.

OK, thanks. I guess it was a daft question.

I'm running 25.1.1 and I want to install a plugin, but when I try I get the message:

***GOT REQUEST TO INSTALL***
Currently running OPNsense 25.1.1 (amd64) at Sun Mar 23 15:11:28 CET 2025
Installation out of date. The update to opnsense-25.1.3 is required.
***DONE***

Is there a way around this? I don't want to update to 25.1.1 on this production system just yet.

As per title. I have no dhcpd log file entries showing in the GUI.

I can see the log files in /var/log/dhcpd.log and the current one is definitely getting written to.

Is there something I need to do to make the log appear in the web page?

Thanks :)

(Deleted, talking nonsense as usual)