Messages

It's in Services: Unbound DNS: Advanced. The fifth option.

Thank you. Do you know if TLD .internal has the same issue. If not I could rename my TLD from .lan to .internal

Except there is no need for a custom configuration file, since the referenced "Harden Below NXDOMAIN" option is now available directly in the GUI.

Where can I find that option. I have looked in the main and zone configuration?

DNSSEC is disabled in mine unbound, maybe it's a different issue. :-\

I installed the microcode-develop following the procedure in this thread. Today I installed the OPNsense 26.7.1 update. Is this enough to make it permanent or should I (de)install packages?

In the firmware - plugins is shown 1.1_1 os-cpu-microcode-intel-devel (misconfigured)
In the firmware - packages is shown cpu-microcode-intel 20260512_1, cpu-microcode-rc 1.0.2 and os-cpu-microcode-intel-devel 1.1_1

The workaround for the NXDOMAIN issue is to disable Query Forwarding in the GUI for domain1.lan.

A) Add file /var/unbound/etc/local.conf

server:
  domain-insecure: "domain1.lan"
  private-domain: "domain1.lan"

forward-zone:
  name: "domain1.lan"
  forward-addr: 127.0.0.1@53530
  forward-no-cache: yes

B) Restart Unbound service.

Could it be something with forward-no-cache setting difference for the GUI or CLI?

I have an internal DNS zone domain1.lan (local), domain2.net (public registred, split DNS) and reverse zones (192.168.0.0) authoritatively served by a BIND (port 53530) instance on my network. OPNsense's Unbound DNS Resolver (port 53) is configured with a Query Forwarding to forward domain1.lan and domain2.net queries to that BIND server. After reload of Unbound queries for domain1.lan and domain2.net succeed.

After around 6 hours queries for hosts in the zone domain1.lan start returning NXDOMAIN even though BIND itself is healthy and would answer correctly on port 53530. Queries for hosts in domain2.net (and the reverse zone) are not impacted. After reload of Unbound queries for domain1.lan succeed again for a period of 6 hours (refresh timer 21600?).

If i shutdown bind and query for hosts in zone domain1.lan I receive DNS request first timed out and second SERVVAIL, NOT NXDOMAIN.
Registration of DHCP in DNS is disabled.

It looks like related to Unbound DNS Query Forwarding unreliable #7639
https://github.com/opnsense/core/issues/7639
https://github.com/opnsense/core/issues/9736

OPNsense version: 26.7
Issue noticed starting: 26.1.11 (around last 2 weeks)

Domain specified in OPNsense > system: domain1.lan
Domain specified for DHCP clients > domain1.lan
Zone values domain1.lan / domain2.net: TTL 86400, refresh 21600 (default)
Zone values domain1.lan / domain2.net: Allow query (ACL localhost)

No changes have been done to the configuration to be knowledge (added a A/PTR record) that could explain this behaviour and worked correctly for years.

So that's

https://github.com/opnsense/plugins/commit/ac68d4e
https://github.com/opnsense/tools/commit/854a5a8ce

for 26.7.1 then.

This seems to be the AMD version if I look at github, Intel will follow?

I followed the pkg steps and rebooted the system. No microcode messages in /var/run/dmesg.boot after boot after seconds or minutes.

=====
Message from x86info-1.31.s03_1:
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Abandoned upstream, fails to identify anything remotely new according to upstrea                                                                                     m issue reports.

It is scheduled to be removed on or after 2025-06-30.

=====
Message from cpu-microcode-intel-20260512_1:

--
To enable microcode updates at boot time:
cat << EOF >> /boot/loader.conf
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
EOF


-----

A bit early to ask, but what will be the step to have this converted to the final production version of the package?

Press "Inspect". It will show the full ruleset for an interface.

Why not via the filter, it's more obvious. It will also not show up in the other interface view.

[rules (new)]

If I assign firewall rule to multiple interfaces it will not show up in the rules (new) for that specific interface but only if all rules is selected as filter.

It would be nice if the rules (new) filter would show rules that will match the filter for the interface . It would be a good alternative for firewall (interface) group.

Feature request?!

+1

I upgraded Zenarmor to version 1.18 on OPNSense version 24.7.7 today.

I noticed that the idle CPU load in my case went up from 7% to 11%. Do more people notice some increase? It looks also a bit slower but that's difficult to pinpoint.

(EDIT) CPU dropped back to normal. Maybe some background traffic and/or Zearmor housekeeping on the box. This post may be deleted.

Sory Franco, my fault.

I mean get_interfaces_info() and I have corrected my previous reaction.

Thank for all the good (OPNsense) work. Great product.

I fixed the script temporary fixed by copying the get_interfaces_info() ifunction from interfaces.inc (OPNsense 23.7.12_5-amd64) to the custom script. Up to the script owner to change it to work with the new 24.1 functions.

--------------

<?php
require_once("config.inc");
require_once("interfaces.inc");
require_once("plugins.inc.d/dpinger.inc");
require_once("util.inc");

# Added function get_interface_info. Function was removed from interfaces.in in OPNsense version 24.1
function get_interfaces_info($include_unlinked = false)
{
    global $config;
    ....
 

[get_interfaces_info()]

I am using the Grafana OPNsense dashboard from bsmithio that stopped working after upgrading to 24.1

One of the custom (Telegraf) scripts (telegraf_pfifgw.php) does not work because it cannot find the function get_interfaces_info() in the php file functions.inc

Is this function (and others?) removed in version 24.1 and wich function in interfaces.inc does replace this functionality 1 to 1?

Thanks in advance

I have the same issue after upgrading to 24.1.

The Egress connection to Internet work for a couple of minutes when starting the firewall. After this period the traffic to outside stops. After disabling IPS (suricata) the connections are restored. In my case IPS is enabled on the WAN interface.

I have changed my custom file with the help with this post. Now it looks stable for a couple of minutes.

https://forum.opnsense.org/index.php?topic=35130.msg