Messages

Cloudflare 1.1.1.1 Incident on July 14, 2025 - https://blog.cloudflare.com/cloudflare-1-1-1-1-incident-on-july-14-2025/

Hi!

Is it known that Dnsmasq returns only IPv4 addresses for Aliases?


host OpenMediaVault.localdomain
OpenMediaVault.localdomain has address 192.168.X.Y
OpenMediaVault.localdomain has IPv6 address 2a0Z:X::Y

host omv.localdomain
omv.localdomain has address 192.168.X.Y

Thanks, I tried and got this:

sudo opnsense-patch 4381fe4903ecbeff19ebd1e04b789628e51124ef; configctl webgui restart
Fetched 4381fe4903ecbeff19ebd1e04b789628e51124ef via https://github.com/opnsense/core
1 out of 1 hunks failed while patching opnsense/service/templates/OPNsense/Dnsmasq/dnsmasq.conf
OK

OPNsense 25.1.7_4 - The setup is according to the official documentation.

Everything works fine until Unbound to dnsmasq returns 5(REFUSED), restarting dnsmasq solves the issue

the issue is fixed in OPNsense 25.1.7_2, /var/etc/dnsmasq-hosts is populated correctly

Though it works for some time, the latter resolution is again faulty. Restarting Unbound fixes the problem for a short time.

Hi!

OPNsense v25.1.7 host aliases no longer working:

>host omv.localdomain
Host omv.localdomain not found: 2(SERVFAIL)

>host openmediavault.localdomain
openmediavault.localdomain has address XXX.XXX.XXX.XXX

cfg was not changed since 25.1.6_4

I'm having the same issue

   AcmeClient: validation for certificate failed: XXX.XXX.XXX
2024-06-05T14:42:54   opnsense   AcmeClient: domain validation failed (dns01)
2024-06-05T14:42:54   opnsense   /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php: AcmeClient: The shell command returned exit code '2': '/usr/local/sbin/acme.sh --renew --syslog 6 --log-level 1 --server 'letsencrypt' --dns 'dns_cf' --dnssleep '120' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/6244690401b582.96545326' --certpath '/var/etc/acme-client/certs/6244690401b582.96545326/cert.pem' --keypath '/var/etc/acme-client/keys/6244690401b582.96545326/private.key' --capath '/var/etc/acme-client/certs/6244690401b582.96545326/chain.pem' --fullchainpath '/var/etc/acme-client/certs/6244690401b582.96545326/fullchain.pem' --domain 'XXX.XXX.XXX' --days '1' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/624465c1ebd1a0.95366960_prod/account.conf''
2024-06-05T14:42:53   opnsense   AcmeClient: using challenge type: Cloudflare DNS Validation
2024-06-05T14:42:53   opnsense   AcmeClient: account is registered: YYY WEB GUI Cert Accoiunt
2024-06-05T14:42:53   opnsense   AcmeClient: using CA: letsencrypt

Thank you!

Hi!

I have noticed that there is a double "block all targeting port 0" Automatically generated rules on the WAN interface - OPNsense 23.7.7_3-amd64

   IPv4+6 TCP/UDP   *   *   *   *   *   *   *   block all targeting port 0   
     IPv4+6 TCP/UDP   *   *   *   *   *   *   *   block all targeting port 0

Might be a bug?

do you have custom tunables in your config?

check this https://forum.opnsense.org/index.php?topic=32017.15

can confirm - removing dev.igb.X.eee_control solved the problem.

Hi there

as there is a PPPoE problem in FreeBSD and it doesn't look like it will be solved in a reasonable timeframe I'm thinking of putting a router/bridge in front of my setup like this:

Code Select Expand


      WAN / Internet
            :
            : FTTH provider
            :
      .----+------------.
      |  PPPoE Router  |  (or Bridge, whatever)
      '-----+-----------'
            |
          WAN
            |
      .-----+------.
      |  OPNsense |
      '-----+------'
            |
          LAN


Internet is provided with PPPoE and VLAN ID.
I have fixed IP's I want to use with opnSense.

Is there any cheap router/Bridge/whatever available to just do this:
"transform" the ISP's signal to use with a regular WAN port of my opnSense router?
If necessary I can also put a fiber converter in front, too.
It may even use one of my public IP's.

Thank you for all hints!

Were you able to find a solution? I'm looking for the same appliance.

Hi! I think I know what you are talking about. I have apu2 with the very same specs as you.

Just seconds after reboot I run a speed test and can get up to 800Mbps, a couple of minutes later it drops to ~200-300Mbps max.

I understood that if I disable the Shaper, which was helpful when I had a VSDL connection, the speed stays in the 800Mbps range.

      Server: Active Cloud - XXXXXXXXXX
         ISP: XXXXXXXXX
Idle Latency:     3.95 ms   (jitter: 0.19ms, low: 3.81ms, high: 4.10ms)
    Download:   816.02 Mbps (data used: 1.2 GB)
                 10.18 ms   (jitter: 9.49ms, low: 3.70ms, high: 235.02ms)
      Upload:    84.49 Mbps (data used: 100.5 MB)
                 27.24 ms   (jitter: 6.91ms, low: 5.67ms, high: 88.46ms)
Packet Loss:     0.0%

suggest checking if this is your case.

Have a nice day!

Thanks, didn't notice that :(

[75]

Hi!

My OPNsense is blocking connections from address 100.75.* with labeling "block private networks from WAN"  while "Block private networks" is checked under the WAN interface.

though help for this option states: "When set, this option blocks traffic from IP addresses that are reserved for private networks as per RFC 1918 (10/8, 172.16/12, 192.168/16) as well as loopback addresses (127/8) and Carrier-grade NAT addresses (100.64/10). This option should only be set for WAN interfaces that use the public IP address space."

I will appreciate any help.

Thanks in advance