Messages

But a memtest86+ overnight also produced this: https://photos.app.goo.gl/7ErMivVG8Rx1cbe67

There you go. Your memory is dead. I hope its not DDR5 because thats worth more than gold today.

"Read only file system" is weird. It's likely causing all your trouble, but no idea what triggers it.

Some SSDs are going into read only mode before they completely die. Thats basically last chance to backup your data before it completely stops working.

Your storage or your memory is dying.

The VPP support definitely sounds interesting, especially for a Linux-based firewall. I'm curious to see how this project develops.

VyOS has VPP support.

Has the source code/repository been made public yet?

Not yet.

It will support VPP, and thats something that BSDs dont have.

The obviously AI generated logo I admit doesn't inspire much confidence in the project.

Im dont want to defend use of AI, but you do realize this guy is not some random dude that just decided to vibe code his own firewall. This is the co-creator of pfsense.

I think this is completely new project from the scratch. Its not a fork of anything. I think they forked pf from OpenBSD to Linux. Yes this is Linux based firewall. Not to be confused with nfSense.

Don't. Simple as that.

Why not? Im using opnsense for god knows how long, and i allow webgui access only on LAN interface. And my LAN interface has DHCPv4 server running on it. Never ever had issues accessing it. These options exist for a reason.

[Rules [new]]

Decided today to migrate the rules, but if I click on Rules [new] that's already populated with floating rules and interface rules: does it mean OPNsense migrated the rules already?

No. Thats just a preview with links to legacy rules. Just follow instructions in migration assistant and keep in mind that transition is not done until you delete your legacy rules. Once the migration assistant is gone from the menu, that means that transition is fully completed. Dont forget to migrate your NAT rules too.

A screenshot would be nice.

Everything is explained in migration wizard. You need to follow each step carefully. Once you complete the process as it is instructed, your rules will become editable and removable.

What is your WAN connection type? PPoE or other?

Other.

Unbound DNS
Kea DHCPv4
Wireguard Client VPN

Do you have any tuneables set? Prior or after the upgrade.

Nope. Its all default. No additional packages, no tuneables.

Would you mind sharing your tunables settings?

Here you go

Code Select Expand

net.inet.tcp.drop_synfin
runtime
0
1
Drop TCP packets with SYN+FIN set
hw.syscons.kbd_reboot
runtime
1
0
enable keyboard reboot
net.inet.icmp.drop_redirect
runtime
0
1
Ignore ICMP redirects
net.pf.share_forward
runtime
0
1
If set pf(4) will defer IPv4 forwarding to the network stack.
net.inet.carp.senderr_demotion_factor
runtime
240
0
Send error demotion factor adjustment
net.inet6.ip6.redirect
runtime
1
0
Send ICMPv6 redirects for unforwardable IPv6 packets
net.enc.out.ipsec_filter_mask
runtime
1
1
IPsec output firewall filter mask
net.enc.out.ipsec_bpf_mask
runtime
3
1
IPsec output bpf mask
net.inet.ip.sourceroute
runtime
0
0
Enable forwarding source routed IP packets
net.inet.tcp.tso
runtime
1
1
Enable TCP Segmentation Offload
debug.kassert.warn_only
runtime
1
1
KASSERT triggers a panic (0) or just a warning (1)
net.link.tap.user_open
runtime
0
1
Enable legacy devfs interface creation for all users
net.inet.tcp.delayed_ack
runtime
1
0
Delay ACK to try and piggyback it onto a data packet
net.inet.icmp.log_redirect
runtime
0
0
Log ICMP redirects to the console
net.inet6.ip6.use_tempaddr
runtime
0
0
Create RFC3041 temporary addresses for autoconfigured addresses
net.inet.tcp.sendspace
runtime
32768
65228
Initial send socket buffer size
net.inet.udp.checksum
runtime
1
1
compute udp checksum
net.local.dgram.maxdgram
runtime
8192
8192
Maximum datagram size.
hw.ixl.enable_head_writeback
boot-time
0
0
For detecting last completed TX descriptor by hardware, use value written by HW instead of checking descriptors
net.inet.icmp.reply_from_interface
runtime
0
1
ICMP reply from incoming interface for non-local packets
net.inet.ip.forwarding
runtime
0
1
Enable IP forwarding between interfaces
vfs.read_max
runtime
64
32
Cluster read-ahead max block count
net.route.multipath
runtime
1
0
Enable route multipath
kern.coredump
runtime
1
0
Enable/Disable coredumps
net.inet.ip.random_id
runtime
0
1
Assign random ip_id values
net.link.bridge.pfil_local_phys
runtime
0
0
Packet filter on the physical interface for locally destined packets
net.link.vlan.mtag_pcp
runtime
0
1
Retain VLAN PCP information as packets are passed up the stack
net.inet.udp.maxdgram
runtime
9216
57344
Maximum outgoing UDP datagram size
net.inet.icmp.icmplim
runtime
200
0
Maximum number of ICMP responses per second
net.inet.ip.redirect
runtime
1
0
Enable sending IP redirects
vfs.zfs.dirty_data_sync_percent
runtime
5
5
Dirty data txg sync threshold as a percentage of zfs_dirty_data_max
vm.numa.disabled
boot-time
0
1
NUMA-awareness in the allocators is disabled
net.link.bridge.pfil_onlyip
runtime
0
0
Only pass IP packets when pfil is enabled
net.inet6.ip6.log_cannot_forward
runtime
1
0
Log packets that cannot be forwarded
security.bsd.see_other_gids
runtime
1
0
Unprivileged processes may see subjects/objects with different real gid
net.inet.tcp.blackhole
runtime
0
2
Do not send RST on segments to closed ports
net.inet.tcp.log_debug
runtime
0
0
Log errors caused by incoming TCP segments
net.inet.ip.accept_sourceroute
runtime
0
0
Enable accepting source routed IP packets
net.inet6.ip6.rfc6204w3
runtime
0
0
Accept the default router list from ICMPv6 RA messages even when packet forwarding is enabled
net.inet6.ip6.prefer_tempaddr
runtime
0
0
Prefer RFC3041 temporary addresses in source address selection
net.enc.in.ipsec_filter_mask
runtime
1
2
IPsec input firewall filter mask
security.bsd.see_other_uids
runtime
1
0
Unprivileged processes may see subjects/objects with different real uid
hw.vtnet.csum_disable
boot-time
1
1
Disables receive and send checksum offload
net.link.bridge.pfil_bridge
runtime
0
0
Packet filter on the bridge interface
kern.msgbuf_show_timestamp
runtime
1
1
Show timestamp in msgbuf
net.inet6.ip6.forwarding
runtime
0
1
Enable forwarding of IPv6 packets between interfaces
kern.randompid
runtime
0
1
Random PID modulus. Special values: 0: disable, 1: choose random value
net.inet.udp.blackhole
runtime
0
1
Do not send port unreachables for refused connects
net.inet.tcp.syncookies
runtime
1
1
Use TCP SYN cookies if the syncache overflows
net.inet6.ip6.intr_queue_maxlen
runtime
256
1000
Maximum size of the IPv6 input queue
net.link.bridge.pfil_member
runtime
1
1
Packet filter on the member interface
kern.ipc.maxsockbuf
runtime
8388608
4262144
Maximum socket buffer size
vfs.zfs.txg.timeout
runtime
90
90
Max seconds worth of delta per txg
net.inet.ip.portrange.first
runtime
10000
1024
net.enc.in.ipsec_bpf_mask
runtime
1
2
IPsec input bpf mask
net.pf.share_forward6
runtime
0
1
If set pf(4) will defer IPv6 forwarding to the network stack.
net.inet.ip.intr_queue_maxlen
runtime
256
1000
Maximum size of the IP input queue
net.inet.tcp.recvspace
runtime
65536
65228
Initial receive socket buffer size

I also have a Protectli (V1210) setup; and it used to run at around 45C on 25.x; but since upgrade to 26.1 (earlier this year) - it started to hover around 55 instead. I have not yet migrated to 26.7 (thinking of a clean install over the weekend) - so it is good news if the temps are lower.

 Your temps will also go down once you upgrade/reinstall.

Im running opnsense on Protectli Vault FW6E with core boot bios. Since i upgraded to 26.7 i noticed much lower CPU temperatures on all cores. On 26.1 unit was sitting at 55C on idle, and  70C in full load. Its now sitting at 44C at idle and its hitting 66C at full load. To make this even more interesting, its much hotter outside today than it was before. Device is sitting in a small closed rack in a room with no AC. Did anyone else noticed lower temps on passively cooled devices ? Is this because of FreeBSD 15.1 ?

Great job Franco and the gang.