Messages

When I restart my opnsense or internet goes down on an interface for a short period, network time starts up a second time..
This causes constant conflict between the 2 processes.

bind(23) AF_INET INTERFACEIP:123 flags 0x19 failed: Address already in use

And when I then check CLI, I can see:

39161     1 Wed Nov 11 17:33:14 2026 /usr/local/sbin/ntpd -g -c /var/etc/ntpd.co                                nf
85635     1 Wed Nov 11 17:33:24 2026 /usr/local/sbin/ntpd -g -c /var/etc/ntpd.co                                nf

So it is started twice.

AI basically says:
At boot and on a WAN/IPv6 change, the boot sequence and rc.newwanip(v6) run the ntpd restart at nearly the same time.
Both kill whatever ntpd exists, then both start a new one. You end up with two.

Its btw an recurring issue, even if I kill one of the processes it will eventually spawn a new one.

Support was great and the software is amazing for very specific blocking of applications, easy zero-trust networking and  domain blocking and allowing within 1-2 clicks.

But I have to say that I will not be renewing either.
Now I have to say that I do not have kids (which will put more significance on the easy blocking of sites and categories) so that might influence my choice.

However there were a few things I realised.

1. Zenarmor is focussing more towards business. Which is fine and their choice .. I would do the same if most of the revenue would come from there, but im not a business so im becoming "not the target audience". Every update, more settings get added that give an popup regarding subscription upgrading.

2. How many features do I actually use? Most of the reports/dashboards etc. etc. are fully unused. What did I use? Well, the easy blocking of entire categories etc. However after keeping track of it for a few months, I realised that almost all Zenarmor blocks basically came down to:
- Websites being seen as empty, but actually legitimate websites that host static content or redirects to payment providers.
- Telemetry calls from IoT devices. Which came down to either allow it or block it and have Zenarmor logging be 100% filled by 1-2 blocks per second

3. Zenarmor was bashing my SSD to death. Never realised it but after wanted to replace a disk a few days ago and checking the drive health. Zenarmor was responsible for 80-90% of writes to the drive and was writing 90GB/day. That basically brings a disks lifetime from 100 years to 10 :P

This mostly started becoming more relevant after I started self-hosting an self-created applications with SIEM/SOC and dashboard capabilities meaning that the entire "overview" idea of Zenarmor wasnt needed anymore.

So yeah.. felt like the entire solution didnt add much anymore.
Qfeeds, Crowdsec, UnboundDNS and just to make sure Suricata ... outside of being able to toggle on/off Tiktok or whatever with a click, its just not worth the money and problems anymore for me.

Ended up having to reinstall.
Guess I learned my lesson to always make an ZFS snapshot no matter how small the update looks

That cant be good.. image speaks for itself XD
Wont be the best strart of the weekend ive had.. not sure how ill fix it yet

Tbh, not sure if anyone asked for this change and why this wasnt pushed back against during the RC versions (if it was already implemented there)
The old list was easy on the eyes and has distinct separate parts (aka.. name | controls). And depending on the dashboard space, the list is mostly to long anyway so you need to scroll meaning it has your attention regardless without needing a lot of color.

This is basically someone saying: Ow no, I cant figure out if my hardware isnt running as its only a red light blinking. Lets make it so that when my hardware doesnt work it changes the color of my entire wall. And hides the power button somewhere on that wall as well.

Hi Timeraider, I've reported this issue on github https://github.com/opnsense/core/issues/10546.
Another issue reported earlier that can be related is https://github.com/opnsense/core/issues/10535. This has been already addressed but Franco reopened it because there is a chance that it is also related to this problem.

Ah, I missed that issue. Guess ill wait it out and keep an eye on that one :P
I can luckily sort of work around it now as I did have a security header profile with everything allowed so if actions get blocked I can still switch my site to that before executing the action but I prefer to be able to edit the existing ones ofc. ;D

No errors in the logs of opnsense btw.
There is an HTML page error however im not sure if that causes anything or is related in any way.

Code Select Expand

Blocked aria-hidden on an element because its descendant retained focus. The focus must not be hidden from assistive technology users. Avoid using aria-hidden on a focused element or its ancestor. Consider using the inert attribute instead, which will also prevent focus. For more details, see the aria-hidden section of the WAI-ARIA specification at https://w3c.github.io/aria/#aria-hidden.
Element with focus: <div.modal fade modal_draggable in#security_headersdlg>
Ancestor with aria-hidden: <div.modal fade modal_draggable in#security_headersdlg>

nginx plugin -> security header UI not working since 26.7
So under the Nginx plugin -> configuration -> http(s), you have an option for Security headers.
Once I try editing any of them, the UI acts weird and while it shows the tabs it refuses to show any content.
Makes it impossible to update it.
This kinda blocks me from fixing one of my sites XD

# opnsense-patch https://github.com/opnsense/core/commit/14710e775

O, perfect.
Can confirm that patch fixes the issue.

nginx itself works and the other pages also work, but specifically the configuration page (arguably the most important) crashes.
Errors:
[16-Jul-2026 11:51:36 Europe/Amsterdam] TypeError: count(): Argument #1 ($value) must be of type Countable|array, null given in /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_layout_partials_base_form.volt.php:9
Stack trace:
#0 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, false)
#1 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'layout_partials...', false, false)
#2 [internal function]: Phalcon\Mvc\View->partial('layout_partials...', Array)
#3 /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_layout_partials_base_tabs_content.volt.php(8): Phalcon\Mvc\View\Engine\AbstractEngine->partial('layout_partials...', Array)
#4 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, false)
#5 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'layout_partials...', false, false)
#6 [internal function]: Phalcon\Mvc\View->partial('layout_partials...', Array)
#7 /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_opnsense_nginx_index.volt.php(267): Phalcon\Mvc\View\Engine\AbstractEngine->partial('layout_partials...', Array)
#8 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, true)
#9 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'OPNsense/Nginx/...', true)
#10 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php(151): Phalcon\Mvc\View->processRender('', '')
#11 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Dispatcher.php(168): OPNsense\Base\ControllerBase->afterExecuteRoute(NULL)
#12 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(156): OPNsense\Mvc\Dispatcher->dispatch(Object(OPNsense\Mvc\Request), Object(OPNsense\Mvc\Response), Object(OPNsense\Mvc\Session))
#13 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(139): OPNsense\Mvc\Router->performRequest(Object(OPNsense\Mvc\Dispatcher))
#14 /usr/local/opnsense/www/index.php(66): OPNsense\Mvc\Router->routeRequest('/ui/nginx', Array)
#15 {main}

Already did the obvious like reinstalling nginx plugin, restarting etc.

At one hand any extra options are always good so being able to hide specific things would always be appreciated ofcourse.
At the other hand its Zenarmor registering the service so Zenarmor should fix their packages to not set up the Cloud agent service as long as the agent package isnt installed.

Yup, not just you sadly -_-

Always hope they test patches before pushing them out but well...

Hmm.. wasnt this last big update as well that Zenarmor was looking for php 8.1 when OPNSense updated to php 8.2.
Maybe doublechecking dependency versions would be a good one for their checklist ;D

Hi,

This is not the expected behavior, but Zenarmor excludes the firewall itself from any blocking rules. Even if your PC is blocked by a policy, you can still access the OPNsense UI or manage your policies through the Zenconsole (Cloud Management Portal) if Zenarmor is registered there.

Ah, thank you for the confirmation.
Can't hurt to be sure even if nothing will ever happen so its simply good to hear that I can't fully lock myself out :D

"Apologies for taking so long. I was hoping some of the other maintainers would step in while I was away, looks like that didn't happen. :("

Hehe, welcome to open-source. Whereby the creators better never go on a holiday, because the moment the creator is unavailable for a while the entire idea of "being maintained by a community" only goes as far as "Does it affect any of the contributors? Nope.. ok.. guess none of them will mind the issue for now then", none of the creators fault ofcourse but funny how it always ends up somewhere along those lines :D

Though I will be fully honest that I dont really have any credentials to be able to judge anyone ofcourse. Everyone has their expertise and mine certainly is not contributing to Perl script XD
Did make a bash script for myself to have dynamicdns with an directadmin portal (didnt want to have an third-party like noip or some of the other options in between) as that doesnt seem to be built into the ddclient, but thats about the extend of my possibilities XD