Messages

I would really very much like to keep my devices from doing anything more than using my network to access the WAN. I do not have wifi anymore

For that requirement for the TV you need a basic IoT setup as meyergru said, the TV on its own port or VLAN, configured for outgoing internet access only. Does it matter whether other devices can see each other? If so, you need a VLAN for each, otherwise just the two.

Alternatively, it is possible to lock down the TV so that it can reach nothing but the time of day, and is accessible only from the internal network. A small Mikrotik router can be configured to do this.

I maintain a dumb TV with AppleTV in front like connervt, and imprison an NVR as described in the previous paragraph. Having to VPN in to check what the cameras are seeing is the trade-off when I am out of the house.

I found this explanation pretty good: Opnsense firewall rules

Are you planning an initial setup or preparing to migrate? Following the relevant dialogs works with only rare exceptions.

Alas, I am in a still smaller minority. Visually it is good except that it is back to a single column rather than the compact two-column display. Options?

Having to scroll an important status display is an anathema to me. Back to trying to rearrange the dashboard so the entire column is visible while other components are in their place.

Interestingly, the sentence starting "However" in the second paragraph said all that was necessary as an opening and probably sufficient question.

Given it looks like a question to or by AI, I decided to give just the critical sentence (with contextual "In OPNsense") to a local model (Qwen3.6 35B A3B in this case). After thinking strenuously for 1.2s (a minute elapsed) it came up with a lengthy explanation and correct answer, together with validation tests and informative notes for beginners.

That is not how I do OPNsense myself, but it seems that simple clear questions work either way.

When you replace the battery, use an SR44 / 357 silver oxide rather than the alkaline LR44. They are less likely to leak and last much longer. I found this decades ago in my HP32SII (still in use, incidentally).

Que ce soit par segmentation par interfaces ou par utilisation de VLAN sur une seule interface, je séparerais sans hésiter la comptabilité de la réception et des autres fonctions administratives. Le contrôle d'accès aux serveurs relève généralement de leur gestion et non de celle du routeur.

Le choix entre VLAN et segmentation d'interfaces dépend de la configuration actuelle ou prévue du câblage, des commutateurs et du réseau Wi-Fi. Les commutateurs sont-ils compatibles VLAN ? L'OPNsense est-il une solution prête à l'emploi permettant de dupliquer l'infrastructure existante ?

(Traduit)

I prefer the new widget in part because I rarely have need to check the Dashboard, so do not have a firm mental image from which to see discrepancies immediately. I experienced that problem recently in the old columnar widget, where the fact a service was off (hence a problem) did not stand out. With the new widget it is clear at once.

I also prefer not to have to scroll merely to check states rather than when reading text. Any warning should be visible immediately so again, the new widget wins. I try not to clutter my Dashboard, and with the new widget and some other rearrangements it is single screen, organised and clear on a large display or a Macbook Air.

It may have helped in my case that my theme is opnsense-dark where it seems to fit quite well, so I was not triggered by unexpected contrast. In any case I tend to run with low screen brightness and contrast. I can see from some other people's screenshots that in other contexts the display tones may need tuning.

Adding this by way of explanation rather than merely sitting back happily.

Some do, some don't.

Count me in the apparent minority who think the new services widget is an improvement. I like it. For context I use Opnsense's dark theme.

I've read that too but like you, I have found Kea works perfectly well in my small network.

I also install nano, much better experience :) Editor wars 2.0

:-)

I first used Unix in the 1980s and only occasionally since then, enough to be familiar but never regular. At that time vi was clearly better to use than ed so I did, and have ever since. Also, ZZ is quicker than :wq

Weird.

As noted above, I had made no changes at all to my configuration for months before I upgraded from 26.1.8 to 26.1.9, when DNS stopped.

Today I spent some time exploring for problems. The Unbound log showed enquiries were being blocked, yet I have no blocklist set in Unbound. Re-upgrading after returning to the prior snapshot (which also now failed) was marked by the same upgrade oddity that the normally verbose output did not show at all until the entire upgrade had completed. Still DNS did not work although the internet remained accessible by IP address.

I upgraded a reserve machine. It was fine, and displaying the usual output along the way.

I switched off to think about it a while, switched back on (far from the first power cycle in this) and, DNS woke up.

I am nonplussed. I did nothing to stop it working and nothing to fix it again. Cosmic rays from the Universe? Might Q-feeds have interfered for a while?

I will run the internal router for another day or so before nervously upgrading the edge.

I upgraded my internal (not edge) router to 26.1.9 this morning (AEST), promptly losing DNS resolution

Did you try a health check?

Anything unusual in unbound debug logs ?

Will try, and check. Currently it is unplugged. Tomorrow I will have time to set up to test those things without breaking internet for anyone else in the process.

I upgraded my internal (not edge) router to 26.1.9 this morning (AEST), promptly losing DNS resolution although I could still ping external IP addresses. Reverting to the 26.1.8_5 snapshot did not resolve the problem. Absolutely nothing else was changed, this was a routine upgrade process. Has anyone else encountered this, such that I should report it formally?

All DNS is through Unbound on the edge. The internal router's Unbound points to the edge router.

For clarity I did not upgrade the edge router, so the other nets which do not pass through the internal router continued to behave normally. When I replaced the internal router with a switch then normal behaviour returned as expected.

@brandywine.
You missed the ascii emoji.