Messages

It works for me! The Unbound DNS Reporting is back. If you also have the same old platform and need to use the Unbound reporting function, you can also follow @Rick's method. Don't forget to lock the package when you're done.

Code Select Expand

pkg lock py313-numpy

I'm using OPNsense 26.7.7 with py313-numpy 2.4.6_1 on a system with an AMD Athlon 64 X2 5000+ (super old, but runs OPNsense great) and noticed this yesterday when I tried to enable Unbound logging.

Apparently this error happens because recent versions of NumPy are compiled to use features on newer hardware and the complied code chokes on older hardware.  (Google: numpy illegal instruction)  You can see the stack trace by running "python3 -v stats.py"  I tracked the error to the following dynamic-link library:

/usr/local/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313.so

I worked around this by standing up a FreeBSD 15.1 VM (on my Linux Mint system), installing Python 3.13 and building NumPy for a generic system using the following command-line, and replacing the OPNsense ".so" above with the one generated (in the same location).

python3 -m pip install numpy==2.4.6 -Csetup-args=-Dcpu-baseline="none" -Csetup-args=-Dcpu-dispatch="none"

Unbound logging is working now on my system.
Obviously this is just a workaround for the current version of NumPy.
Hope this helps.

- Rick

Great...!! Thank you, bro. I'll give it a try later :)

If you want to have complete control over third-party plugins, you can create your own local repository.

Okay, then forget about it. I don't want to reinstall all core system packages.

Just like my situation, I encountered this error while upgrading from 26.1.11_10 to 26.7. After running the command:

Code Select Expand

# pkg lock -y pkg
# opnsense-revert pkg
I successfully upgraded to 26.7, but still encountered pkg compatibility issues, and then I try to reinstall it again, still warning!

Code Select Expand

pkg-static: warning: database version 38 is newer than libpkg(3) version 36, but still compatible

The same issue as SQUID, page 'Administration' doesn't load, other pages 'Cache log/Access log/Store log' are good.
After patching 14710e775, the issue was resolved!

Code Select Expand

TypeError: count(): Argument #1 ($value) must be of type Countable|array, null given in /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_layout_partials_base_form.volt.php:9
Stack trace:
#0 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, false)
#1 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'layout_partials...', false, false)
#2 [internal function]: Phalcon\Mvc\View->partial('layout_partials...', Array)
#3 /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_layout_partials_base_tabs_content.volt.php(8): Phalcon\Mvc\View\Engine\AbstractEngine->partial('layout_partials...', Array)
#4 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, false)
#5 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'layout_partials...', false, false)
#6 [internal function]: Phalcon\Mvc\View->partial('layout_partials...', Array)
#7 /var/lib/php/cache/_usr_local_opnsense_mvc_app_views_opnsense_proxy_index.volt.php(338): Phalcon\Mvc\View\Engine\AbstractEngine->partial('layout_partials...', Array)
#8 [internal function]: Phalcon\Mvc\View\Engine\Volt->render('/usr/local/opns...', Array, true)
#9 [internal function]: Phalcon\Mvc\View->engineRender(Array, 'OPNsense/Proxy/...', true)
#10 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php(151): Phalcon\Mvc\View->processRender('', '')
#11 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Dispatcher.php(168): OPNsense\Base\ControllerBase->afterExecuteRoute(NULL)
#12 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(156): OPNsense\Mvc\Dispatcher->dispatch(Object(OPNsense\Mvc\Request), Object(OPNsense\Mvc\Response), Object(OPNsense\Mvc\Session))
#13 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(139): OPNsense\Mvc\Router->performRequest(Object(OPNsense\Mvc\Dispatcher))
#14 /usr/local/opnsense/www/index.php(66): OPNsense\Mvc\Router->routeRequest('/ui/proxy', Array)
#15 {main}

If you need a temporary solution, I have a suggestion. Add a timeout in the Suricata service script:

Code Select Expand

sed -i '' 's|command:/usr/local/etc/rc.d/suricata stop|command:/usr/local/etc/rc.d/suricata stop \|\| (sleep 10 \&\& killall -9 suricata)|' /usr/local/opnsense/service/conf/actions.d/actions_ids.conf


There is no range. It is just a single number that allows for VPN access into OPNsense from the internet.


Bob.Dig, I'm here asking for help and to learn because I'm not a network engineer. Wincent is asking about an 'in' rule. My concern is that I don't understand why I'm seeing outbound traffic to what I thought were private address spaces from my WAN interface.

I thought it was inbound traffic, but if it's outbound, it's normal. As Bob.Dig said, the firewall defaults to sending all non local packets to the default gateway.

If you don't want to see these, set a rule as lmoore mentioned to intercept them.

:)

I think HAProxy is an option for load balancing.

What is the destination address(WAN address) port range for interface WAN rule?

I drew a network topology diagram, and the general structure is like this (the drawing is a bit ugly)
You cannot view this attachment.

Have you created a new one or some in your schedule(Firewall -> Settings -> Schedules)? if so, open the 'advanced mode' in the upper left corner when you add the new rule.

Em...It looks like a broadcast packet, but it shouldn't come from a public network address. Are there any other rules besides DNS NAT rules?

This should be a default rule. Can you provide more information? Interfaces or directions

Is your WAN interface bound to a public IP address? x.x.x.235?