Messages

I was using ISC DHCPv4 and ISC DHCPv6 on all networks before. I *thought* that OPNsense was running separate instances per network, but perhaps it behaved always like that and for some reason I just never noticed ...

Hi all,

I successfully upgraded from OPNsense 26.1 to 26.7 and also got rid of all legacy components. I replaced Track Interface with Identity Association, migrated from the old NAT and Firewall rules to the new ones, and replaced my usage of ISC DHCP (v4 and v6) as well as radvd by using only dnsmasq for everything DNS and DHCP with the idea of having fewer software components running and to maintain (also no Unbound DNS, also didn't use it before).

One surprise during that migration was, that I had to configure an RA MTU of 1492 in the dnsmasq's DHCPv6 ranges, as otherwise I was not able to reach some IPv6 sites (notably Microsoft ones) from GNU/Linux and Android devices.

But apart from that and in general, everything is up and running as before.

One thing however is puzzling me and I am not sure whether it is a misconfiguration or expected if dnsmasq is doing everything DNS and DHCP:

I have a separation of networks (e.g. LAN, IoT, Guests), all with their respective configurations for IPv4, IPv6, DNS, DHCP etc.

Now, I can do e.g. `host some-iot-device` on a LAN device and get the IP address of the IoT device within the IoT network resolved. I would have expected name resolution to be restricted to the same network the querying device is in?

Is this a misconfiguration? Can I configure name resolution to be bound to the network? Or is this just the "price" I have to pay when using dnsmasq for DNS and DHCP?

TIA.

Hi all,

I recently upgraded to OPNsense 26.1 and would like to plan for the migration away from old configuration to the newer preferred one, and I am seeking for some help and advise in doing so.

As background:

- I have a German Telekom PPPoE dual stack on WAN-side, IPv4 and IPv6 also configured on LAN side as follows.

- LAN IPv6 interface is set to Track Interface (WAN) with manual adjustment of DHCPv6 and RA.

- In Virtual IP, I have an IP Alias on LAN interface configured to some fd01:xxxx/64 ULA.

- In Router Advertisements for LAN, I have mode Stateless and OPNsense's LAN interface with the Virtual IP Alias prefix set as DNS server.

- ISC DHCPv6 is configured (to some range), also with OPNsense's LAN interface with Virtual IP Alias prefix set as DNS server.

- I am already using Dnsmasq for DNS and not Unbound.

Now my questions regarding how to migrate this setup "into the future":

1) IPv6 Configuration Type: if I understand things correctly, when doing separate DHCPv6 and RA configuration anyway, going from "Track Interface" to "Identity association" should be a simple and even recommended switch without anything else to consider?

2) Switching away from ISC DHCPv6: My question is, whether Dnsmasq is suited for (or even capable of) doing what I am doing.

Dnsmasq documentation reads: "There is support for doing address allocation (both DHCPv6 and RA) from subnets which are dynamically delegated via DHCPv6 prefix delegation."

Would that also include a Virtual IP Alias like the ULA one I am using? If not, would it work with Kea?

TIA.

Greetings,
Stefan

Hi all,

I know this is a very minor issue compared to what functionality the product offers.

However, just having upgraded from 24.7 to 25.1, the font has changed and thus the readability of the web user interface. Compared to 24.7, now with 25.1 the font looks "condensed" in a way that the height/width ratio has changed considerably, making reading information in the UI harder for me.

When I use some browser developer tools I can see that it's due to the font family being declared as "SourceSansProRegular" with highest priority. If I remove that setting dynamically with the browser's dev tools, the font immediately returns to being clearly readable.

Is there any way to configure this within OPNsense itself or do I have to install browser extensions to change that?

BTW: I have checked with both, Firefox and Chrome (most recent versions) on a Debian GNU/Linux box as well as with Chrome Edge on Windows.

Yes, I don't want to derail this thread any further, my assumption was, that such a large increase in states most likely is also correlated with an increase in CPU consumption. As I have seen a reduction in states with 24.7.3 in my setup, I just wanted to suggest also checking the OP's CPU issue with 24.7.3 to verify/falsify whether this also has been resolved.

But my assumption may be wrong and I won't hijack this any further.

Do you happen to use any firewall aliases with large table entries loaded?

I discovered that by disabling Maxmind Geoblock, I'm able to reduce my temperatures and utilization to pre-24.7 levels. Since I made no alteration to any of mine between 24.1 and 24.7, I think python 3.11 introduced a bug.

Yes, I *do* use Maxmind Geoblock with country aliases that result in large table entries.

But then again, it all went back to pre-24.7 behaviour when upgrading to 24.7.3 as you can see in my state graph.

24.1.10 -> 24.7.1 on 2024-08-08
24.7.1 -> 24.7.2 on 2024-08-21
24.7.2 -> 24.7.3 on 2024-08-29

You can see this correlates perfectly with the graph. I'm pretty sure this is due to the FreeBSD ICMP issue and not Python.

Just here to +1 everything you said. I had precisely the same symptoms and with 24.7.3 everything is back to normal again.

The attached screenshot shows my "States" with the *EXACT* some configuration over the whole time of the plot.

You can clearly see the change when I upgraded from 24.1.10 to 24.7.1 on 08.08.2024 ... and the pattern also changes after the upgrade to 24.7.2 on 21.08.2024.

And guess what, now that I upgraded to 24.7.3 just yesterday, it is back to old behaviour (not easy to see yet in the screenshot, but if I adjust the axis scaling it can be clearly seen).

So, my assumption is, that this change in states also comes with a change in CPU utilization.

PS: and also my weird Android Wifi disconnects that I was chasing over the last weeks have miraculously vanished since I upgraded to 24.7.3 yesterday.  ;D

I still have the theory that this is also connected to the ICMPv6 issue in 24.7.1 and 24.7.2 which was reverted in 24.7.3.

When you upgrade to 24.7.3 ... is it still the same or is it reverted to pre-24.7 behavior?

Not saying this is related, but I agree that I see a change in the graphs after having upgraded to 24.7.1 and then after 24.7.2 as well. For me it's not the CPU temperature because I'm running that on a Proxmox VE and don't have that available inside OPNsense, but I can see how the usage of the "States" clearly (!) changed with the upgrade from 24.1.10 to 24.7.1 and then again to 24.7.2 as you can see from my attached screenshot (upgrade to 24.7.1 was on 08.08.24 and upgrade to 24.7.2 was on 21.08.24 - both clearly visible in the graph without further explanation).

I am not saying this change is a problem nor worth investigating, I'm just saying that I can clearly see this change in behaviour and this may very well have effects on CPU usage and/or memory usage and perhaps as a result even CPU temperature.

Oh, and yes, configuration has NOT changed AT ALL over this period of time.

Bei mir updated ddclient "native" mit Service desec sowohl IPv4 als auch IPv6.

Hallo zusammen,

ich hab auch den Vigor 167 an einer OPNsense (virtualisiert auf Proxmox VE) mit Telekom Dual IP Stack. Ich lasse auch den Vigor das VLAN-Tag 7 setzen und habe ohne Probleme Dual IP Stack. Ich weiß, das hilft jetzt nicht weiter, aber daran, wer das VLAN-Tag setzt, liegt es also wohl nicht.

Gruß
Stefan

I only get it working without pppoe0 not getting detached, if WAN2 is DHCPv6 and "Request only an IPv6 prefix" enabled. If I untick "Request only an IPv6 prefix" or configure SLAAC, then the pppoe0 inet6 immediately gets detached again (with all its consequences).

Yes, I have already configured WAN interface with "Request only an IPv6 prefix" and "Use IPv4 connectivity".

But I had *not* configured those two on WAN2.

Now I have configured "Request only an IPv6 prefix" and "Use IPv4 connectivity" for WAN2 as well and it seems to work (incl. the gateway monitoring on WAN IPv6)!

I'll now try to get rid of the gateway groups as you suggested and try a failover situation.

Thanks for your helps so far, that helped a ton!