Messages

Hello,

any feature that might use it falls back to NDP and ARP when disabled.

If it's that way forever is unclear right now.

Thanks @Monviech for the clarification.

I have the service turned off because I don't perceive a need for it in my case. AIUI only Captive Portal and MAC based aliases/firewall rules currently require it. Is that correct and what other OPNsense functions may come to depend on it in the future?
Cheers.

What it also is very clever at, is making suggestions at how I can add and improve things. It wasn't my idea to add all of the monitoring

I only have experience of the free online LLMs and very recently running local models with LM studio. So far, I have only used it to generate (hesitate to use the word create!) standalone or loosely coupled shell or python scripts. I'm now hoping to attempt some larger projects, so I asked AI what's the best approach for specifying project requirements: An overview with use cases expressed entirely in natural language vs additionally specifying requisite technologies, libraries etc. The AI favoured the second approach. Moreover it recommended specifying details such as database schemas. In order to avoid project drift and unnecessary complexity! ;-)
Regarding the monitoring, I would have preferred a solution that integrated the service typed you wanted monitoring in to an existing monitoring system. e.g. by creating nagios plugins for those services not already covered by available plugins.

Very impressed with Google AI, I have never written Powershell scripts, but they are all working perfectly. I'm glad I've retired!

I worked on and off in surveying, IT operations and ecommerce. I can honestly say I derived most job satisfaction from coding and task automation. Now AI can do all of it. I really cannot see it ending well but that's age based skepticism, I hope!

@OPNenthu Dealing with the problem before the queries hit a DNS server is the favourite solution IMO. Thanks for posting (post #25).

Thanks @franco. I can confirm 26.7.2 fixes the Loaded# counts in the alias list table.

Following the upgrade to 26.7, telegraf requires running as root in order to read pf stats.

telegraf 1.39.1_1
os-telegraf 1.12.15

Sorry to hear it's had a relapse. Mine has been furiously querying the same hosts in logs.roku.com ever since your OP. Consequently it spends 21 hours a day turned off via smart plug! From the hostnames concerned, it would seem associated with the Roku OS itself rather than some errant app. Idiotic behaviour.

The example alias I gave is referenced in a destination NAT rule, a corresponding (unlinked/manual) firewall rule, and also in another firewall rule. All configured on WAN interface only.

Some aliases (network aliases as far as I can tell) show an unexpected #Loaded value.
e.g. I have a networks alias currently containing a single CIDR 82.132.128.0/17. This shows #Loaded=5. Gemini AI suggests the higher than expected #Loaded may be due to pf internal alias optimisation and that a corresponding breakdown (5 entries) would be visible under diagnostics. That doesn't seem to be the case. Diagnostics just shows the same single CIDR for that particular alias.

@OPNenthu, I need to keep reminding myself how non-quick (which as you say is the pf default) work. However the last match concept has proven diffcult to grasp, so I just look at it as evaluated last! That seems to serve me in so far things have worked as I wished.
My upgrade last week to 26.7 was super smooth despite a moderately customized setup. The final test, ACME certs renewal. completed successfully this weekend. Great job @Franco and OPNsense team.

Viewing firewall rules, with inspection column enabled, and rules ordered in the default (evaluation) order: My understanding is the per rule evaluation counts should generally reduce as you go down the table. Other than non-quick rules which may be displayed higher than their actual evaluation occurs.

What reasons might you see rules in the list with higher evaluation counts than rules preceding them?
Does state lifetime affect these counts? When are those counters reset?
Also, if a packet is not on the specified interface, presumably it is not evaluated against the rule. (But that is the only exception)?

Thanks for any insights.

I'd like to see an option to exclude static leases for the Kea dashboard widget.

@franco Sorry I was slow catching on. I attributed auto-generated rules not appearing as an artifact of having not used the migration tool. Instead I have a PPPoE WAN so am likely affected by #10479 as you have pointed out earlier.

What about a rule permitting the redirected traffic?
Also, assuming you have not permitted DNS elsewhere, that floating block rule may be redundant.