Messages

Hello,

We upgraded our OPNsense firewall from 25.7 to 26.1.11_10 and noticed a significant increase in memory usage immediately after the upgrade.

System specifications:

OPNsense 26.1.11_10
8 GB RAM

Before the upgrade, total memory usage was typically around 20–30%. After the upgrade, it increased to around 76–90%.

To troubleshoot the issue, I disabled the HostWatch service, which reduced memory usage from approximately 90% to 78%, but it is still much higher than before the upgrade.

According to the top output, the Suricata process is consuming approximately 5.8 GB of resident memory, making it the largest contributor to the overall RAM usage.

Has anyone experienced similar behavior after upgrading to 26.1.11_10?

Thank you for your reply.

This system is running OPNsense. I disabled "HostWatch," which reduced RAM usage from approximately 90% to 78%. However, memory usage was previously only around 20–30%.

The attached top output shows that the suricata process is using about 5.8 GB of resident memory, so it appears to be the main contributor to the high RAM usage.

Could you please advise what may be causing this and how I can reduce the memory consumption?

Hello,

We upgraded our OPNsense system from version 25.7 to 26.1.11_10 yesterday and noticed a significant increase in memory usage.

The system has 8 GB of RAM. Since the upgrade, memory usage has been around 76% and sometimes reaches 90%. Before the upgrade, it was usually between 20% and 30%.

How can we identify what is causing the high memory usage?

Hello,

Sometimes OPNsense (running as a VM on Proxmox VE) becomes unreachable (no Web UI / no ping), which causes all VMs behind it to lose internet connectivity.

The issue is only resolved by opening the OPNsense console and either reloading all services or rebooting the VM. After that, everything works normally again.

Notes

• Issue appeared after upgrading to 25.7
• Did not happen on older versions

Question:
Has anyone encountered this issue? Is there a known solution or workaround?

Does anybody have the same issue?

Hello everyone,

After updating my system to OPNsense 25.7.6, I can no longer access either the Web GUI or the console menu. The system boots, but gets stuck right after Suricata initialization errors.

Here are some of the error lines from /var/log/suricata/suricata.log and the console output:

Error -- signature can't match as required content length 13 exceeds bsize value 12
Error -- error parsing signature ...
from file /usr/local/etc/suricata/opnsense.rules/emerging-phishing.rules
Error -- vtnet0: interface is down
Error -- Engine initialization failed, aborting...

The problem started immediately after the 25.7.6 update.

Any help, confirmation from others, or workaround would be much appreciated.
Thank you.

Hello. Could you please review my post? We having a problem with a IPsec after the upgrade.

Has anyone experienced the same issue?

Has anyone experienced the same issue?

Hello,

After updating from v24.1 to v24.7, we have encountered a problem with the IPsec VPN service. We are currently using OPNsense v24.7.10_2.

The issue occurs when I attempt to restart the IPsec VPN service from the dashboard. Clicking the restart button causes a loading icon to appear, indicating that the service is restarting. However, the process never completes. If I click the button again, a new loading icon appears, and this continues for every additional click.

I also tried restarting the service from the "VPN: IPsec: Tunnel Settings [legacy]" page, but the same behavior persists, the restart process does not conclude. After refreshing the page, I can see that the service is marked as running, but this was not the case in previous versions.

Has anyone else experienced this issue?

Hi. Maybe you can stop the service "Suricata - Intrusion Detection" and test the speed again.

Hello,
I have a question, and maybe you'll find it strange, but I have worked with several firewalls before.
When I create or change any rule in OPNsense, I click the Apply button. However, the Apply button always remains visible, which can be really confusing. Sometimes, people think they haven't clicked Apply. It is not so in Pfsense.
How to fix it, is there any settings for it?

Hello Franco,

I've read that the latest OpenVPN server no longer needs to export Data Ciphers, as OpenVPN now supports cipher negotiation between the server and client. That's great news.

I also checked the OpenVPN server logs and confirmed that it uses AES-256-GCM when a client is connected, which is fine.

When I use OpenVPN Connect, there are no errors. However, when I use the OpenVPN client, it complains about missing Data Ciphers, even though the OPNsense OpenVPN log shows that AES-256-GCM is being used.

It would be much better if the issue causing the OpenVPN client to generate this message could be resolved.

Thank you for your replies.

In the client logs, I couldn't see "PUSH' line ...".

In the server logs, when the client is connected, it shows that the client uses AES-256-GCM.

Code Select Expand

openvpn_server1 xxx.xxx.xxx.xxx:55396 Data Channel: cipher 'AES-256-GCM', peer-id: 0

However, in the Client logs, it complains that the Data Ciphers are missing. I will create a ticket.

Code Select Expand

Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case.
If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.

Could you please answer my last question?