Messages

the firewall itself is not honouring the MTU/MSS settings on the WAN interface and is thus failing in its IPv6 connectivity.

Have you tried deleting the MSS and MTU settings you manually entered? My settings have nothing in the values for MSS/MTU in the WAN config and my Connectivity Audit doesn't fail

I had no issues when Upgrading from 25.7.11 -> 26.1 -> 26.1_4 however after upgrading today to 26.1.1, I had no WAN ipv4 connection.

A software restart via GUI didn't resolve, in fact after the restart many services were not running as could be seen in the Dashboard widget.

I then tried to physically power off my machine (Protectli 2410) and noticed it was extremely hot and it didn't respond to my pressing the power on/off button.

After I pulled the power cable and reinserted it, the system rebooted and everything came up OK including WAN etc. and the temperature went back down to normal levels

Very strange, I've never experienced that before.

This doesn't seem to be related to the Q-Feeds Plugin since you're using AGH. As your screenshot shows it perfectly pulls in the domains? If you try to reach 'cherrypharm.com' (just checked, still in the domains list), can you see any DNS requests for that domain in AGH ?

Yes, you're correct - after a bit more checking, it seems the Warning for that website was generated by my browser natively, or via an add-in (Brave) - I could see within the AGH log that it actually blocked access. When I tried Safari, I didn't get the warning as it must not have the same website checking, and again aGH blocked it. Sorry for my misunderstanding :)

Allright! Will look into it together with Deciso and get back to you. Thanks for digging into it already, very helpful!

FYI - I'm seeing this issue too however I'm using the qfeed Domains blocklist only within AGH and not within Unbound.  I'm running OPNsense 25.7.11_9-amd64  with AGH setup as the main DNS on port 53, and Unbound is on 5335. Within AGH I have 127.0.0.1:5335 setup as a Private reverse DNS server, and for Local resolution via Unbound on 127.0.0.1:5335 - this has been working well for years.

Blocking of sites on the qfeeds Domains blocklist within AGH worked well previously, however it now seems to have stopped as the example problem url's posted earlier in this thread are no longer blocked and they display warnings in my browser.

The widget shows the blocked number incrementing as I have the floating rules setup to block the qfeeds IPs which works properly - it's just the Domain blocklist isn't working anymore

edited to add - this is the url added to the AGH Qfeeds Malware Domains shown in the screenshot:
https://api.qfeeds.com/api.php?feed_type=malware_domains&api_token=tip_xxxxxxx

/boot/efi/efi/freebsd/loader.efi and /boot/efi/efi/boot/bootx64.efi should be identical, although only one will be used. Which one depends on your BIOS and its settings.

I've now ensured that both are identical - I think I should be ok now - thanks for your assistance @Patrick

ZFS pool upgrades are never applied automatically. You need to explicitly use "zpool upgrade zroot". And if you do this, then remember to also upgrade your boot loader.

As further context to my question, coincidentally today the second of two disks in my ZFS Raid pool died, so rather than replace it, I detached it from the pool and did a zpool update. However I didn't upgrade the boot loader as I overlooked that step :(

I tried to reboot but it failed as it couldn't find a bootable disk, so I booted off usb and copied the loader.efi from the usb to /boot/efi/efi/boot/bootx64.efi - thats probably why that file has today's date.

The pool is showing no errors now:

Code Select Expand

# zpool status
  pool: zroot
 state: ONLINE
  scan: resilvered 4.26G in 20483 days 03:18:56 with 0 errors on Fri Jan 30 14:19:00 2026
config:

NAME        STATE     READ WRITE CKSUM
zroot       ONLINE       0     0     0
  ada0p4    ONLINE       0     0     0

errors: No known data errors

So I'm now assuming I'll need to copy it to /boot/efi/efi/freebsd/loader.efi as that file is from 2022?



Thanks

With my installs all being ZFS is it still recommended to do this after a major upgrade:

cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi
cp /boot/loader.efi /boot/efi/efi/boot/bootx64.efi

Sorry to hijack this thread - I just listed these files on my OPNsense 25.7.11_9-amd64 system:

Code Select Expand

root@OPNsense:~ # ls -l /boot/loader.efi
-r-xr-xr-x  2 root wheel 658944 Jan 13 23:26 /boot/loader.efi
root@OPNsense:~ # ls -l /boot/efi/efi/freebsd/loader.efi
-rwxr-xr-x  1 root wheel 890368 May 31  2022 /boot/efi/efi/freebsd/loader.efi
root@OPNsense:~ # ls -l /boot/efi/efi/boot/bootx64.efi
-rwxr-xr-x  1 root wheel 658944 Jan 30 18:28 /boot/efi/efi/boot/bootx64.efi

Looking at the dates, /boot/efi/efi/freebsd/loader.efi is from 2022 and a different filesize, and the others are the same size but different dates and I assume they are the same file.

I should I copy /boot/loader.efi to /boot/efi/efi/freebsd/loader.efi to fix this? I wonder why I haven't (yet?) seen any issues?

Thanks

Any thoughts on if my router should be accessible via example.com and why I am getting an error?

The help for the setting "Alternate Hostnames" under System > Settings > Administration says this: "Alternate Hostnames for DNS Rebinding and HTTP_REFERER Checks
Here you can specify alternate hostnames by which the router may be queried, to bypass the DNS Rebinding Attack checks. Separate hostnames with spaces."

Perhaps you could enter this in there and see if you still get the error?

Code Select Expand

example.dyndns.org example.com

Thanks guys for clarifying

Sorry if the following are obvious questions, hopefully someone can clarify please.

• I'm using native ISC DHCP on 25.7.11_2 and don't intend to migrate (yet) to the alternatives.
  I see the release notes for 26.1 says "ISC-DHCP moves to a plugin. It will be automatically installed during upgrades."
  
  Does this mean the existing ISC-DHCP configurations for IPv4 and IPv6 will be "imported" into the plugin, so I won't need to do any configuration changes?
  
  
• Regarding the release note comment which seems a bit ambiguous:
  
  "To accommodate the change away from ISC-DCHP defaults the "Track interface" IPv6 mode now has a sibling called "Identity Association" which does the same except it is not automatically starting ISC-DHCPv6 and Radvd router advertisements to allow better interoperability with Kea and Dnsmasq setups."
  
  As I'm remaining on ISC-DHCP, will I need to make any changes to "Track interface" as I'll need ISC-DHCPv6 and Radvd to autostart.
  
  

Many thanks

I just tested with Wireguard and it does block if you add the Wireguard interface into the two Qfeeds floating rules:

It blocked a known malicious IP on my LAN and Wireguard interfaces:

If I install a VPN on her machine she will probably wind up leaving it on, bypassing Qfeeds

I thought Qfeeds would filter the VPN (if you added within the floating rule) the interface list that currently has WAN?

I've noticed that viewing the Events page is starting to take a while before the page is filled as my log file must be getting larger every day. I understand that the log file is cleared after a reboot which then allows the Events to display quickly, until it again gets larger.

Which logfile is Qfeeds using to populate the Events page?

Sorry didn't check that thoroughly. Seems that somehow your filter_*.log got corrupted. Did you have any system crashes, disk full, or power loss events lately? I think its best to log a bug report on the GitHub plugin repository: https://github.com/opnsense/plugins/issues

No crashes, disk full or power loss - all running fine. I restarted the host that OPNSense is running on and it's now working. Strange that it was working during the day, then overnight the log somehow was corrupted. I'll keep an eye on it.

How frequently is the widget "Blocked" number updated ?

That's very interesting, but we're glad that issue is solved now. Now regarding the events tab, that's an interesting find as well. Just to be sure, you haven't disabled logging on the rules? And you do see blocks in the dashboard widget?

Does this command dump logs ? "/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py logs"

The rules have the logging enabled - I shared a screenshot in my previous reply of the live logs showing my test was blocked. Yes the dashboard widget shows a large blocked number.

The command gives an error:

Code Select Expand

root@OPNsense:~ # /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py logs
Traceback (most recent call last):
  File "/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py", line 50, in <module>
    for msg in getattr(actions, action)():
  File "/usr/local/opnsense/scripts/qfeeds/lib/__init__.py", line 187, in logs
    yield ujson.dumps({'rows': PFLogCrawler(feeds).find()})
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/opnsense/scripts/qfeeds/lib/log.py", line 75, in find
    result.append(self._parse_log_line(line))
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/opnsense/scripts/qfeeds/lib/log.py", line 64, in _parse_log_line
    return [parts[1], fw_line[4], fw_line[7]] + [x for x in fw_line if is_ip_address(x)]
                      ~~~~~~~^^^
IndexError: list index out of range
Thanks