Messages

You can create a pass rule so it will pass that port and stop processing. Put it above the qfeeds rule.  Once qfeeds resolve the issue you can delete that port rule

I searched the qfeeds block file and 43.131.7.8 isn't contained there.

virustotal.com also shows zero reported security issues wirh that ip

Vendors Analysis:
No security vendors flagged this URL as malicious
Final URL:
http://43.131.7.8/
Domain:
43.131.7.8

Look at your logs to see why it's being blocked for you?

Do you have logging enabled in your QFeeds rules?

Just an appreciation post to the hard work done to get 26.7 released.

I followed Patrick's instructions to copy the Boot loader https://forum.opnsense.org/index.php?topic=52441.0

- uninstall os-cpu-microcode-* plugin
- upgrade to 26.7
- update your boot loader
- install 26.7.1, os-cpu-microcode-*, whatever ...

The updated NUT and Adguard plugins work as well

Thank you Patrick,

Re your second option, if the three files

Code Select Expand

/boot/loader.efi /boot/efi/efi/boot/bootx64.efi /boot/efi/efi/freebsd/loader.efi are identical in size, can I assume there's no need to update the boot loader?

I'm a little confused after reading this thread as I am currently running 26.1.11_10 with the os-cpu-microcode-intel v1.1 plugin and have held off updating to 26.7

To help me fully understand the current recommendation, can you please confirm that if I want to update to 26.7.1 I need to perform the following:

• create a snapshot just in case
• uninstall the os-cpu-microcode-intel plugin
• update to 26.7.1
• reinstall the os-cpu-microcode-intel plugin

I thought Michael updated this to work with 26.7 in both the single and full repo? So no need to comment that out anymore?

Until a hotfix or 26.7.1 is released, opnsense-patch 14710e7 will fix the crash on Nginx, NUT and Squid menues

How do I apply this patch please?

Thanks for the help @dseven - I realised I made a typo when renaming - I used mimugmail_full.conf instead of mimugmail-full.conf

After renaming it correctly to mimugmail-full.conf, the ipv6 connectivity audit now works, and the mimugmail repo passes under ipv4.

Code Select Expand

Checking connectivity for repository (IPv4): https://pkg.opnsense.org/FreeBSD:14:amd64/26.1
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: .......... done
Processing entries: .......... done
OPNsense repository update completed. 928 packages processed.
Updating mimugmail repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: .... done
Processing entries: .......... done
mimugmail repository update completed. 189 packages processed.
Updating ntop repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: . done
Processing entries: . done
ntop repository update completed. 6 packages processed.
All repositories are up to date.

mimugmail repo update fails under ipv6, which I think is correct as the mimugmail url is only accessible via ipv4.

Code Select Expand

Checking connectivity for repository (IPv6): https://pkg.opnsense.org/FreeBSD:14:amd64/26.1
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: ......... done
Processing entries: .......... done
OPNsense repository update completed. 928 packages processed.
Updating mimugmail repository catalogue...
pkg: An error occurred while fetching package: No error
pkg: An error occurred while fetching package: No error
repository mimugmail has no meta file, using default settings
pkg: An error occurred while fetching package: No error
pkg: An error occurred while fetching package: No error
pkg: An error occurred while fetching package: No error
pkg: An error occurred while fetching package: No error
Unable to update repository mimugmail
Updating ntop repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: . done
Processing entries: . done
ntop repository update completed. 6 packages processed.


Thanks guys, yes I'm running AdGuard Home - strange as I've been running AGH and ipv6 for a long time and the ipv6 Connectivity Audit always worked for ipv6 until recently.

I just tried renaming mimugmail.conf to mimugmail-full.conf and the ipv6 Connectivity Audit then worked, however it wasn't able to perform the mimugmail repository update as it couldn't find the mimugmail.conf, so I reverted the name back to mimugmail.conf

I also noticed I had the priority: for mimugmail.conf set to 5, so I changed that to 150 however the ipv6 connectivity audit still failed.

I wonder if it is possible to force the ipv6 connectivity audit to use the same config that is used for ipv4?

I've noticed a connectivity audit indicates I have no ipv6 connection, even though I have ipv6 working fine on my system. I can ping6 and traceroute6 from opnsense ssh and from a client without issue, and the correct ipv6 firewall rules are enabled.

test-ipv6.com also reports ipv6 is working.

Here is the output - is opn-repo.routerperformance.net the correct repo for ipv6 as a google search indicates it only has an ipv4 address?

Code Select Expand

***GOT REQUEST TO AUDIT CONNECTIVITY***
Currently running OPNsense 26.1.8_5 (amd64) at Sat May 30 11:45:49 AEST 2026

Current repository configuration:
/usr/local/etc/pkg/repos/FreeBSD.conf:
FreeBSD: { enabled: no }
FreeBSD-kmods: { enabled: no }
/usr/local/etc/pkg/repos/OPNsense-aux.conf:
OPNsense-aux: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/OPNsense",
  url: "https://pkg.opnsense.org/${ABI}/26.1/aux",
  signature_type: "fingerprints",
  priority: 11,
  enabled: no
}
/usr/local/etc/pkg/repos/OPNsense.conf:
OPNsense: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/OPNsense",
  url: "https://pkg.opnsense.org/${ABI}/26.1/latest",
  signature_type: "fingerprints",
  priority: 11,
  enabled: yes
}
/usr/local/etc/pkg/repos/mimugmail.conf:
mimugmail: {
  url: "https://opn-repo.routerperformance.net/repo/${ABI}",
  priority: 5,
  enabled: yes
}

/usr/local/etc/pkg/repos/ntop.conf:
ntop: {
  fingerprints: "/usr/local/etc/pkg/fingerprints/ntop",
  url: https://packages.ntop.org/FreeBSD/${ABI}/latest,
  signature_type: "fingerprints",
  priority: 100,
  enabled: yes
}

Checking connectivity for host: opn-repo.routerperformance.net -> 46.16.78.247
PING 46.16.78.247 (46.16.78.247): 1500 data bytes
1508 bytes from 46.16.78.247: icmp_seq=0 ttl=48 time=251.814 ms
1508 bytes from 46.16.78.247: icmp_seq=1 ttl=48 time=251.098 ms
1508 bytes from 46.16.78.247: icmp_seq=2 ttl=48 time=251.640 ms
1508 bytes from 46.16.78.247: icmp_seq=3 ttl=48 time=251.238 ms

--- 46.16.78.247 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 251.098/251.448/251.814/0.291 ms

Checking connectivity for repository (IPv4): https://pkg.opnsense.org/FreeBSD:14:amd64/26.1
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: .......... done
Processing entries: .......... done
OPNsense repository update completed. 928 packages processed.
Updating mimugmail repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: ... done
Processing entries: .......... done
mimugmail repository update completed. 189 packages processed.
Updating ntop repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: . done
Processing entries: . done
ntop repository update completed. 6 packages processed.
All repositories are up to date.

No IPv6 address could be found for host: opn-repo.routerperformance.net

Checking server certificate for host: opn-repo.routerperformance.net
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = E7
verify return:1
depth=0 CN = opn-repo.routerperformance.net
verify return:1
DONE
Checking server certificate for host: pkg.opnsense.org
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = AT, O = ZeroSSL, CN = ZeroSSL RSA Domain Secure Site CA
verify return:1
depth=0 CN = pkg.opnsense.org
verify return:1
DONE
***DONE***


Thanks Franco,

To avoid any doubt, could the message be:

"Version x.y.z is correct for OPNsense a.b.c_d" ?

Cheers

Excellent - many thanks.

I should have mentioned that my initial attempt to update to 28.1.8_5 from 28.1.7 hung, so I tried the update again from the ssh menu and it worked there.

I wondered if the aborted update had "broken" the kernel.

I recently updated to 26.1.8_5 and the health audit I just ran displayed the kernel is 26.1.7 - is this correct?

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.1.8_5 (amd64) at Sat May 23 19:50:23 AEST 2026
>>> Root file system: zroot/ROOT/know_working
>>> Check installed kernel version
Version 26.1.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.1.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
mimugmail (Priority: 5)
ntop (Priority: 100)
>>> Check installed plugins
os-adguardhome-maxit 1.16
os-cpu-microcode-intel 1.1
os-gdrive-backup 1.0_1
os-homeassistant-maxit 1.0
os-isc-dhcp 1.0_4
os-lldpd 1.2
os-net-snmp 1.6_1
os-ntopng 1.3
os-nut 1.9_1
os-openvpn-legacy 1.0_1
os-q-feeds-connector 1.6
os-redis 1.1_4
os-smart 2.4
os-speedtest-community 0.9_6
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: ....
os-adguardhome-maxit-1.16: checksum mismatch for /usr/local/AdGuardHome/AdGuardHome
os-adguardhome-maxit-1.16: checksum mismatch for /usr/local/AdGuardHome/AdGuardHome.sig
Checking all packages....
os-speedtest-community-0.9_6: checksum mismatch for /usr/local/opnsense/scripts/OPNsense/speedtest/opn_speedtest.py
Checking all packages........ done
>>> Check for core packages consistency
Core package "opnsense" at 26.1.8_5 has 68 dependencies to check.
Checking packages: ..................................................................... done
***DONE***


you mean unbound- advanced area correct?

No - I mean within the Security --> Q-feeds Connect --> Events tab

That's what you posted in your first screenshot?