Messages

Is anything listening on those ports?

Code Select Expand

sockstat -4 -6 -l | grep :2000
sockstat -4 -6 -l | grep :5060

Silly question maybe, but what speed is being negotiated on the link?

If either of you are using a reverse proxy (kind of sounds like you might be) try disabling KTLS:

Code Select Expand

sysctl kern.ipc.tls.enable=0
I had issues with NGINX reverse proxying (HAProxy was also having problems) after the update, this resolved the issue. You can re-enable it with a =1, or just reboot, as this command will not survive a reboot.


Regarding the legacy firewall plugin, that part was in the release notes that the legacy functionality would be moved to a plugin.

Try disabling KTLS:

Code Select Expand

sysctl kern.ipc.tls.enable=0
I had issues with NGINX reverse proxying (HAProxy was also having problems) after the update, this resolved the issue. You can re-enable it with a =1, or just reboot, as this command will not survive a reboot.

Code Select Expand

# sysctl kern.ipc.tls.enable=0
# configctl webgui restart

That worked for me with haproxy, just give it a try.

This fixes it for me, too. Thanks!

CPU, traffic, and firewall log graphs all functional on the dashboard. Status update working.

perhaps also related to ktls: https://github.com/opnsense/ports/issues/275

Thanks for the response. I took a look at this, but I'm not sure what to make of it. The people in that GitHub issue very clearly know way more about this stuff than I do.

Seconded. Was working fine before 26.7 but now several Web GUI pages don't load completely.
For example the firewall/live view keeps loading with the spinner and the main lobby/dashboard shows nothing apart from the menu on the left.

Same errors in the Web GUI log:

 (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/mod_openssl.c.5005) SSL: addr:192.168.0.108 ssl_err:5 ret:-1 errno:35: Resource temporarily unavailable
(192.168.0.108 is the NGINX proxy.)

Everything works fine when accessing the Web GUI directly.

My main page also fails to load occasionally. I assumed it was weirdness most likely due to caching and my playing with my reverse proxy config trying to find a solution, but now I realize that it was probably the same problem showing up somewhere else. I did not confirm with the logs when it was happening to me.

[Reproduction:]

Greetings,

I am using an NGINX reverse proxy to access OPN - have for many years now, without issue. It's a pretty basic reverse proxy config with TLS active. 26.1 did not present this issue, and 26.7 direct IP access also does not present this issue. This appears to be an issue between NGINX 1.30 and lighttpd 1.4.85. Just wanted to report this in case others run into it.

Reproduction: On 26.7 final, using reverse proxy, navigate to System > Firmware > Status.

Observation: Status spinny-wheel never goes away. Table does not populate.

WebgGUI log: 2026-07-15T10:51:34-04:00     Error     lighttpd     (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/mod_openssl.c.5005) SSL: addr:192.168.20.10 ssl_err:5 ret:-1 errno:35: Resource temporarily unavailable
That IP is my reverse proxy.

Firefox log: NS_ERROR_NET_PARTIAL_TRANSFER


The response appears to terminate early at 65,112 characters, causing the error. NGINX has an adequate client_body_size (100M).

The Settings page within the Firmware section seems to work fine. Update check itself works fine, but the tabs (except Settings) are broken - they produce no data under the tab. Has anyone else seen this on 26.7 final with a reverse proxy? Anyone else using NGINX have a working setup?

This issue appears to be resolved in this patch:

opnsense-patch https://github.com/opnsense/core/commit/c3a24de1b

franco,

Very strange. It doesn't even show that I sent the PM. I sent an email this time, subject=Track interface / Identity association - IPv6 prefix ID already in use.

Edit: I have misremembered, that since I am doing a total gateway bypass from the AT&T gateway, I no longer need the script. You only need that script if you still have the gateway upstream. I kept it for potential future needs, but it's no longer in use on the OPN system. Therefore, my dhcp6 settings are "Basic", no advanced settings or config file overrides in use.

I restored my 25.7.11_2 snapshot, and the issue does not exist there with the same configuration.

Thanks all, I missed this additional patch, solves the issue.

I am curious about this also. From what I can tell, the difference is in the way Floating rules are assigned.

Floating rules are no longer directly specified as Floating. Now, instead you simply assign your rule to more than one interface, and this automatically makes it a Floating rule vs a typical interface rule.

You can see the order process of all rules on a specific interface by pressing the new Inspect button at the top of your rule table. This shows you ALL rules associated with this particular interface, and the sequence they are processed in (you may need to enable the "sequence" option in the filter). This shows Floating rules still processing first, as they always have in the past.

Greetings,

After some testing, I've found that I am unable to Edit or Clone rules that have multiple protocols selected - ie. TCP+UDP. Rules with single protocol - ie. TCP, UDP, ICMP, or * I am able to edit. But all my rules that use TCP+UDP as protocol, I am unable to Edit or Clone. Delete seems to work, though.

When I click the Edit or Clone button on one of these rules from the interface rule list, nothing happens. This behavior does not seem to be producing any log messages, so I'm not sure how to dig down further to find the actual issue.

I have applied these patches:

opnsense-patch ba8194de
opnsense-patch 94081fd82f
opnsense-patch d1519593

But only AFTER I already transferred my rules over, so they didn't do much for me. I decided manually fixing them would be faster than restoring a snapshot and updating again to start over.

franco,

I enabled this option when it became available, but I mistakenly thought the option was moved/removed/set to default in 26.1, because I forgot where it was hiding. I thought it was somewhere else. My mistake, thank you for the correction.

franco,

I have sent via PM the interface dump and my AT&T PD script (it's the same as posted in the GitHub issue linked). I bypass the AT&T device altogether, so I have access to all PDs (16), but only use a handful.

This does very much seem like a validation error. I can go into the interface settings and change something unrelated to IPv6, and I still get the error saying the PD is already in use. I know that it's in use - it's supposed to be.

Greetings,

I switching to Kea IPv4 when it came out, and then IPv6 when that version came out, been using them ever since. I noticed that with IPv6, Kea would assign new addresses in numerical order - ie. ::1, ::2, etc.

There was a patch pushed to GitHub to allow random allocations, and this patch made it into a more recent release (don't remember which one, exactly), which would assign you "random" addresses, but they would remain "sticky", similar to how ISC DHCPv6 server worked.

This option seems to be missing in 26.1. Is it default now?