Messages

Nope. Its all default. No additional packages, no tuneables.

Thanks.. 👍
What is your WAN connection type? PPoE or other?

Im running opnsense on Protectli Vault FW6E with core boot bios. Since i upgraded to 26.7 i noticed much lower CPU temperatures on all cores. On 26.1 unit was sitting at 55C on idle, and  70C in full load. Its now sitting at 44C at idle and its hitting 66C at full load. To make this even more interesting, its much hotter outside today than it was before. Device is sitting in a small closed rack in a room with no AC. Did anyone else noticed lower temps on passively cooled devices ? Is this because of FreeBSD 15.1 ?

Great job Franco and the gang.

Do you have any tuneables set? Prior or after the upgrade.
Would you mind sharing your tunables settings?

I also have a Protectli (V1210) setup; and it used to run at around 45C on 25.x; but since upgrade to 26.1 (earlier this year) - it started to hover around 55 instead.
I have not yet migrated to 26.7 (thinking of a clean install over the weekend) - so it is good news if the temps are lower.

Would be keen to see your tunables...

Something seems broken with the latest update, blocky cannot be installed anymore.
I removed my blocky 0.28 version, updated via pkg update and tried installing 0.33 version.
After installing via "pkg install os-blocky-guru" or via "System -> Firmware -> Plugins -> os-blocky-guru" it doesn't get installed.
No error message or hint what might be wrong, could you check if it is the same on your system?

I have released an updated version, also for OPNsense 26.7

Please check...

Hi gspannu, thanks for creating the repo but Blocky is outdated by many versions now.
What do you think about an Autobuilder script that creates a FreeBSD package for Blocky automatically when an update is released by the official project?

I have updated the repo for now... with the latest version of Blocky; but I will look at automating this.

i gave adguard a try and i am currently using that and working on adguard plugin, the 3rd party repo adguard home plugin doesn't really have a native interface...

That is some effort that you are putting in... AGH has a ton of options and to capture them all into an OPNsense GUI and then ensure that future updates also work.... Hats off to your effort.

I very much look forward to your plugin... Is there a GitHub link for it?

[that hard to simply check your Pi-Hole Query Log (or the same in AdGuard) and figure out what is being blocked]

To be honest : People should really avoid needing such a feature!

Is it really that hard to simply check your Pi-Hole Query Log (or the same in AdGuard) and figure out what is being blocked and solve the issue once and for all ?!
_{Nothing personal by the way. Talking about people in general!}

And in the worst case you even have the option to use some kind of DoH/DoT feature in Mozilla Firefox for example to check if your adblocker is the issue at all :)

It is not about whether I can analyse and check what websites are being blocked and then whitelist these permanently, its about other users in the home who are not that tech-savvy... and for the times that I am not available to do the same.

Hence, my request for a API call (I know that it exists, as the OPNsense API documentation does refer to adblocking... I just haven't been able to get my head around it to make it work !) - if anyone who understands API can help; then it would be much appreciated.

May I suggest considering to use AdGuard Home instead for DNS blocking? There are nice mobile apps that let you disable filtering with a single tap - for 1 minute, 5 minutes, 1 hour ... etc.

I have been using AGH for a long time, but was keen to start using Unbound and remove all (non-native components from OPNsense). hence, the query...

[Help needed....]

Help needed....

Does anyone know as to how to use the API to enable & disable Unbound Blocklists using an API?

I have Unbound setup with a few blocklists and combination of source nets; so most of the time Unbound Blocklists can keep running.

However, there are times when other family members use laptops/machines (that are a part of the blocklists) but just need Ad-Unblocking for a short duration. Expecting them to login into the GUI in OPNsense to disable this is a bridge too far.


Q: Is there a global API (or some mechanism without having to log into OPNsense GUI) to temporarily disable all blocklists and then enable them later.

Q: Is there a quick way to do this via a simple curl command that can execute a preformed API call?  I can then create a shortcut on these machines that can be used to turn on/off Unbound blocking.

I have tried reading into the API docs, but unable to figure it out...

If they are meant to cascade, is there a way to make the policies work like pf 'quick' rules, on first match?  Alternatively, can anyone think of a creative hack to make this scheme work as intended and still support dynamic prefixes? :)

I am looking for the same info.... It would be great if the Blocklists rules worked like firewall, the first match wins. Also would be great if dynamic prefixes could be used as source lists.

Thanks for the help, everyone.  I guess we'll wait and see....

I guess it may have been implemented in 26.1, I haven't had chance to read the changes notes (or install 26.1 yet), but I have an inclination, it has been included...

I have created a #5170 feature request on Github for the same.

I use Verizon 5G Home Internet and their XCI55AX cell router. My journey to OPNsense started when I decided I wanted to use Pi-hole but the XCI55AX router will not allow the end user to change the DNS settings, so what I must do is put their router in passthrough mode and use my own router instead.

If anyone has already done this, I would appreciate whatever you are willing to share regarding the appropriate configuration settings. I've gotten as far as installing OPNsense VM on my Proxmox installed mini-pc (a Beelink SER5 Ryzen 7 5825U) and poking around a bit to get oriented.

Any and all advice/pointers will be appreciated.

Install another VM on Proxmox, either Alpine Linux or Debian. Install PiHole in this VM. Make sure this VM gets assigned a static IP.
Now in OPNsense, assign the PiHole IP as your DNS.

This is good info.

I have been running OPNSense as a guest under Proxmox on a small server that has one other VM on it (basic linux install for pihole) but I have found that WireGuard requires WAY more CPU than I expected at gigabit speeds, so I am considering doing away with Proxmox, running OPN Sense bare metal, and moving the pihole VM into bhyve on OPNSense instead to make sure OPNSense can talk straight to the hardware and be more efficient.

In my config the one VM would not be externally exposed, but instead get its own entirely virtual local network on the LAN side of the OPNSense firewall, so I am not terribly concerned about security, but I'll port scan it from the WAN side just to make sure.

I probably won't get around to this right away, but when I do I'll definitely post back here.

Thanks for sharing.

I intend to run a similar setup (a PiHole running on Alpine Linux in a VM under bhyve).

Did you ever manage to get this setup working properly? Can you share your complete/ detailed instruction set.. would be much appreciated.

Thanks.

Chipping in from some experience with my setup.

netgraph networking works very well with bhyve.

I use the following script to setup a bridge to link the virtual machine directly to the OPNSense LAN interface:

Code Select Expand

# Setup ng_bridge if required
if ! ngctl status bnet0: >/dev/null 2>&1; then
  ngctl -f- <<END
    mkpeer igc0: bridge lower link0
    name igc0:lower bnet0
    connect igc0: bnet0: upper link1
    msg igc0: setpromisc 1
    msg igc0: setautosrc 0
END
fi

This creates a bridge linked to igc0 (my OPNsense LAN interface) and prepares for bhyve to attach.

bhyve can subsequently attach to the bridge as follows:

Code Select Expand

bhyve \
-c sockets=1,cores=8,threads=1 \
-m 16G \
-s 0,hostbridge \
-s 2,virtio-blk,/vm/hdd.img \
-s 3,virtio-net,netgraph,path=bnet0:,peerhook=link2 \
-s 4,virtio-9p,data=/zdata/vm \
-s 5,virtio-rnd \
-s 31,lpc \
-l bootrom,/vm/BHYVE_UEFI.fd,/vm/efi-vars.fd \
-l com1,stdio \
-u \
-H -P -S \

This has provided very stable and performant networking on the bhyve instance.

Thanks...

Few questions:
1) Can you post your entire setup instructions of running bhyve on OPNsense. I tried to follow the previous posts, but am unable to get an Alpine VM to install.

2) Your networking script - does this auto start at boot up of OPNsense or how to manage this?

Some help in setting up a complete bhyve (Alpine Linux VM) from scratch would be very helpful. Thank you.

https://github.com/opnsense/core/milestones

Thank you, so the date looks to be 28 Jan...