Messages

[Net-SNMP tailscale on in server (also look similar with apcupsd with only outgoing on LAN net.)]

Hello,

I have managed to figure out what the culprit was for this problem.

Explanation:
When I enabled tailscale client on the server the PowerShute is running, in the tcpdump traces
from opnsense shows that it only sends but never receives on LAN net.

From tcpdump in opnsense could see this behaviour.

But when I disable the tailscale app in .4 server then all comes through OK.

I even saw this when testing with net-snmp snmpwalker. (packets leaving but no response on LAN .20 from 192.168.x.4.
Client however handled it because I got output)

Code Select Expand

root@OPNsense:~ # snmpwalk -v1 -c private 192.168.x.4 .1.3.6.1.2.1.1
SNMPv2-MIB::sysDescr.0 = STRING: PowerChute Business Edition
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.318.1.3.33.1
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (60296) 0:10:02.96
SNMPv2-MIB::sysContact.0 = STRING:
SNMPv2-MIB::sysName.0 = STRING: PowerChute UPS
SNMPv2-MIB::sysLocation.0 = STRING:
SNMPv2-MIB::sysServices.0 = INTEGER: 10
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00
I suspect that the server gets the the command from LAN 192.168.x.20 but
then (because tailscale is also enabled in opnsense) it sends
the response back on the tailscale interface.

Synology (which also has tailscale) seems to handle it.
Net-SNMP plugin in opnsense seems to handle it.
apcupsd in opnsense, NOT so much.  :-/

Not sure when in time they swapped from net-snmp in apcupsd to other snmp client ?

So in the past it is most likely working because 1 - I hadn't enabled tailscale on server yet.
OR 2. they changed from net-snmp to other and then it broke.

Seems like Net-SNMP handles it better though.

Net-SNMP tailscale on in server  (also look similar with apcupsd with only outgoing on LAN net.)

Code Select Expand

root@OPNsense:~ # tcpdump -i em1 host 192.168.x.4 and udp port 161
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on em1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
21:59:54.947059 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(26)  system
21:59:54.948212 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysDescr.0
21:59:54.948706 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysObjectID.0
21:59:54.949247 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysUpTime.0
21:59:54.949683 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysContact.0
21:59:54.950191 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysName.0
21:59:54.950629 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysLocation.0
21:59:54.951030 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysServices.0
21:59:54.951481 IP OPNsense.57487 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.8.0

Net-SNMP tailscale off in server

Code Select Expand

root@OPNsense:~ # tcpdump -i em1 host 192.168.x.4 and udp port 161
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on em1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
22:01:08.907568 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(26)  system
22:01:08.908316 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(55)  system.sysDescr.0="PowerChute Business Edition"
22:01:08.908388 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysDescr.0
22:01:08.908763 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(39)  system.sysObjectID.0=E:318.1.3.33.1
22:01:08.908788 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysObjectID.0
22:01:08.909213 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(31)  system.sysUpTime.0=60296
22:01:08.909235 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysUpTime.0
22:01:08.909562 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(28)  system.sysContact.0=""
22:01:08.909580 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysContact.0
22:01:08.909861 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(42)  system.sysName.0="PowerChute UPS"
22:01:08.909879 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysName.0
22:01:08.910161 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(28)  system.sysLocation.0=""
22:01:08.910177 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysLocation.0
22:01:08.910461 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(29)  system.sysServices.0=10
22:01:08.910479 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.sysServices.0
22:01:08.910810 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(29)  system.8.0=0
22:01:08.910827 IP OPNsense.50746 > 192.168.x.4.snmp:  C="private" GetNextRequest(28)  system.8.0
22:01:08.911209 IP 192.168.x.4.snmp > OPNsense.50746:  C="private" GetResponse(30)  snmp.snmpInPkts.0=499

I will test a bit with some settings in server tailscale client.

But now I have found the main reason at least.

Interesting is that Net-SNMP for sure handles it even if the response came back on tailscale interface. (as seen further up)

I tested to use the tailscale IP to the server instead of the LAN net and then it works with apcupsd with tailscale enabled in server. 😊

Best regards
Dan Lundqvist
Stockholm, Sweden

[Would it be possible to change the bottom "Automatically generated rules" to something moreexplanatory like "Automatically generated NAT rules" or "NAT Automatically generated rules"]

Hello,
I am running latest 26.7 i stumbled on a thing that is a bit confusing.

In NAT you have 3 settings to use:  Manual, Pass and Register rule.
- Manual = Choose this if you want to create your own Firewall ‣ Rules [new] manually. No linked filter rule is created.
- Pass = A filter rule will be automatically added and updated. This rule cannot be seen or edited in Firewall ‣ Rules [new].
- Register rule = Adds a linked filter rule in Firewall ‣ Rules [new] that is automatically updated when the NAT rule is updated. The created filter rule cannot be manually edited.

I created a brand new NAT rule called "TEST" with following:
- WAN, IPv4, TCP
- Source = Any
- Destination = WAN address, Single port or range, 1234
- Translation = 192.168.x.y, Single port, 1234

And then I selected "Register rule" (so I should see a linked rule in Rules even if not possible to modify.)
BUT, when I did that I still can't see the readonly rule in rules list.  (Running the new rules engine.)

I then changed to a lighter skin and realized that the readonly NAT generated rules was hiding
under one more "Automatically generated rules" at the bottom that is named exactly as the one
at the top which is a bit misleading (even if it is correct).

Would it be possible to change the bottom "Automatically generated rules" to something more
explanatory like "Automatically generated NAT rules"  or "NAT Automatically generated rules"

Dan Lundqvist
Stockholm, Sweden

Hi,

are you sure this was changed in the last update?

I'm using rebellion for a long time, and thats like its normal design, which I really appreciate.

I'm working at night alot, and all the colours are somehow darker than in other themes.

I have not tested Rebellion for a very long time so I could not say if this was
as before upgrade. Was just baffled by an overall dark theme to suddenly having
what background that poked the eyes a bit. :-)

But if it is nothing new since before 26.7 then we could just close this thread.

//Dan

Hello,
I just tested Rebellion theme on 26.7 and also got some funky color scheme
on input boxes giving white background with black text background and white text.

//Dan Lundqvist
Stockholm, Sweden

I see the same issue in mine as well.
I have sent an email to the guardian of the cicada theme and we'll see what they say.

//Dan Lundqvist
Stockholm, Sweden

How many Interfaces does your NAS have ?

Usually this kind of stuff leads to A-Sync Routing issues that need to be solved...

2
But second one is right now not in use.

Danne

These packets should not go through the firewall at all if 192.168.x is the same x for both systems. I'd first check the netmasks/prefix-lengths of both systems.

Both OpnSense (.20 LAN) and NAS (.64) is in same net and do have same netmask in both machines.
Also the NAS has .20 as default GW and it is working. Running both from outside in to webserver (NAT) but also from inside to other Synology NAS remote.

//Dan

Could you post the details of a blocked packet?

Sure. But see my updated comments as well in main thread.

__timestamp__   2026-07-15T22:01:22
ack   3617553731
action   [block]
anchorname   
datalen   0
dir   [in]
dst   192.168.x.20
dsthostname   
dstport   80
ecn   
id   13194
interface   em1
ipflags   none
ipversion   4
label   Default deny / state violation rule
length   40
offset   0
protoname   tcp
protonum   6
reason   match
rid   02f4bab031b57d1e30553ce08e0ec131
rulenr   5
seq   
src   192.168.x.64
srchostname   
srcport   47713
status   2
subrulenr   
tcpflags   A
tcpopts   
tos   0x0
ttl   44
urp   1024

//Danne

Hello,
I have an issue that I could not find the culprit to that is driving me crazy.

In the live log I get a "Default deny / state violation rule" from a my local NAS that
is on my LAN network and should not block this port.
64 = NAS
20 = OpnSense LAN interface

LAN  In  2026-07-15T21:40:22  TCP  192.168.x.64:56672  192.168.x.20:80  block  Default deny / state violation rule

Other IPs in my LAN does not have any issues accessing port 80 on .20

I am using the latest OPNsense 26.1.11_10-amd64 and is using the new upgraded style rules.

I even have a "Default allow LAN to any rule" enabled but also tried a separate LAN_HOME to LAN_HOME alias firewall for both in and out.
And have also made a specific to .64 but still same issue.

Is there anyone that could point me in the right direction why this only happens from one device and not all ?

I do have CrowdSec and Q-Feed plus a few others but have tested to switch off Intrusion Detection (suricata)

I have talked a bit with ChatGPT and it gave me some hints.
As the entry in the live log contains only A (ACK) it could be:
An ACK packet means:
It is not the start of a TCP connection (which would be a SYN packet).
It is trying to continue an existing TCP session.
OPNsense/PF is saying: "I don't have a state for this connection," so it logs Default deny / state violation rule and drops the packet.
1. The state expired.  This is very common with browsers that reuse keep-alive connections.
2. NAS kept the connection alive - Many NAS devices (especially Synology and QNAP) maintain persistent HTTP/HTTPS sessions.

This is most likely the culprit.

In other words, PF expected a state entry that no longer exists.

//Dan Lundqvist
Stockholm, Sweden

>- Add option to clean out configuration data in config.xml for plugins not longer installed.

How about System: Configuration: Defaults: Components: all the entries that are annotated with "(not installed)".  :)


Cheers,
Franco

Nice. I didn't know about this one.  :-)
I have been running OpnSense now for quite many years but you never learns it all.
New things to discover.  hehehe

I will check but I think that one will most likely do what I want.

//Danne

I think we need to close this thread as it, for an unexplained reason started to work.
I could now see that packets sent, that earlier never got a reply now suddenly started to respond.

I did one thing though.  I uninstalled the apcupsd plugin and re-installed and now it works.

/Dan

Hello,

Feature request
- Add option to clean out configuration data in config.xml for plugins not longer installed.

It is a bit annoying to have data for plugins, that has since long been removed, in the config.xml.
I would like an option to completely or selected plugin data on config to be removed.
This include the normal place but also things in other sections like widget config.

I removed apcupsd but it still remained

- <plugins>...os-apcupsd
- <widgets>
    <sequence>...apcupsd-container:00000010-col5:show
- <apcupsd version="0.0.2" persisted_at="1783448822.19" description="APC UPS configuration">
.
.

Also uninstalled NUT
- <Nut version="1.0.4" persisted_at="1782338757.75" description="Network UPS Tools">

If I really want a clean slate where everything is removed.

This also goes into logfiles.
root@OPNsense:/var/log/apcupsd # ls
apcupsd_20260707.log    apcupsd_20260711.log    apcupsd_20260712.log    apcupsd_20260714.log    latest.log

//Dan Lundqvist
Stockholm, Sweden

No news here, but I was just thinking 26.7 may be a good data point to add. No rush, but we could just have been missing a kernel-side commit since we couldn't find an issue with userspace.


Cheers,
Franco

Thanks. I will try to monitor this in my system if I find the same issue.

Also has some other issues with IDS (libpcap) as well as it feels like the data does not reach suricata.
But that is another ballgame I will touch upon later. I would prefer to use the Divert as this will
remove a lot of the load by only sending through stuff that is not catched by the normal firewall.

However, i will try to see if I could reproduce again.

I think I need to get att better NIC with more than 1/1 channels as I get a lot of
netmap: tx ring full messages


Best regards
Dan Lundqvist

Please see the updated "UPDATE" in main post for more information.

UPDATE:  I draw conclusion to fast.  Still has the issue and have, after some debugging,
most likely found some incompatibility between os-apcupsd and its use of 10+ year old snmplite.

I installed Net-SNMP which is much later and have used snmpwalk to communicate perfect
with the APC Serial Shutdown but when used with snmpwalk it does not get any response.

I will send an email to the assigned support for it through email or shared ChatGPT link.

I have installed the Net-SNMP plugin in OpnSense to be able to do a lot of testing to compare
what happens with communication and works OK with Net-SNMP where I used snmp

My suggestion is to replace the built-in (very old 10+ snmplite) with the "Net-SNMP" plugin
that is available in plugins. Or possible add functionality to configure which snmp to use
(Internal snmplite or plugin Net-SNMP.)

https://chatgpt.com/share/6a5359b4-95fc-83ed-8bbe-5db0933cbf56

Through tracings I could see that it uses snmp-v1 and when I use:
snmpwalk -v1 -c private 192.168.<x>.4 .1.3.6.1.4.1.318.1.1.1.1.1.1
SNMPv2-SMI::enterprises.318.1.1.1.1.1.1.0 = STRING: "Smart-UPS 750"

root@OPNsense:~ # snmpwalk -v1 -c private 192.168.<x>.4 PowerNet-MIB::upsBasicBatteryStatus
PowerNet-MIB::upsBasicBatteryStatus.0 = INTEGER: batteryNormal(2)

root@OPNsense:~ # snmpwalk -v1 -c private 192.168.x.4 .1.3.6.1.4.1.318
SNMPv2-SMI::enterprises.318.1.1.1.1.1.1.0 = STRING: "Smart-UPS 750"
SNMPv2-SMI::enterprises.318.1.1.1.1.1.2.0 = STRING: "APC UPS"
SNMPv2-SMI::enterprises.318.1.1.1.1.2.1.0 = STRING: "UPS 18.0 / COM 18.0 (1027 - 45)"
SNMPv2-SMI::enterprises.318.1.1.1.1.2.2.0 = STRING: "11/7/23"
SNMPv2-SMI::enterprises.318.1.1.1.1.2.3.0 = STRING: "3S2344X14916"
SNMPv2-SMI::enterprises.318.1.1.1.2.1.1.0 = INTEGER: 2
SNMPv2-SMI::enterprises.318.1.1.1.2.1.2.0 = Timeticks: (0) 0:00:00.00
SNMPv2-SMI::enterprises.318.1.1.1.2.1.3.0 = STRING: "3/12/26"
SNMPv2-SMI::enterprises.318.1.1.1.2.2.1.0 = Gauge32: 100
SNMPv2-SMI::enterprises.318.1.1.1.2.2.2.0 = Gauge32: 38
SNMPv2-SMI::enterprises.318.1.1.1.2.2.3.0 = Timeticks: (192800) 0:32:08.00
.
.
root@OPNsense:~ # snmpwalk -v1 -c private 192.168.x.4 .1.3.6.1.4.1.318.1.1.1.1.1.1
SNMPv2-SMI::enterprises.318.1.1.1.1.1.1.0 = STRING: "Smart-UPS 750"

root@OPNsense:~ # snmpgetnext -v1 -c private 192.168.x.4 .1.3.6.1.4.1.318.1.1.1.1.1.1
SNMPv2-SMI::enterprises.318.1.1.1.1.1.1.0 = STRING: "Smart-UPS 750"

Best regards
Dan Lundqvist
Stockholm, Sweden

//Dan Lundqvist

I have some dynamic data where most of the time it is limited but at certain times I run backups from Synology to external systems
and at other times I have a friend who backups to my storage.

Unfortunatley I had to revert to non-VM now as I hade a lot of other issues caused me to pause the Unraid and use same machine
as standalone OpnSense.  I will check if I still get same issue.

I do have 1000/1000 connection and at times both runs much UL and sometimes much DL to system that has similar speeds as me.

//Dan Lundqvist