Messages

https://forum.opnsense.org/index.php?topic=52429.0

Pah. Next you'll be telling me to read release notes! Apologies for the noise...

Uh, I just realised that (apparently?) this is a 26.7.3 thing (I thought it was older than that), and I've been holding off on updating due to the interface setup issues.

Edit: Still wonding what the situation was supposed to be before 26.7.3, but ... not important, I suppose...

It's not working for me (or I'm being especially dumb) - I'm trying to hover around the area where the star shows in the screenshot in that (updated) doc (as well as various other places), but no star appears...

From the "dumb club"... don't know what I'm missing, but I can't get the star to appear - no amount of hovering over/near/around "Lobby: Dashboard" (etc.) does anything. I've tried Firefox and Edge, as well as Brave, and two different installations of opnsense.....

What were you using for DNS before? Simple DNS doesn't work the way you seem to be expecting - generally, if you can reach the server, you can use the service. If you want to hide your internal domain from Guest and IoT, perhaps you could deploy AdGuard Home in front of dnsmaaq, and use custom filtering rules (which can be applied to CIDR prefixes)...

Interesting. Arguably opnsense probably shouldn't allow you to configure a range (or a static host entry) that overlaps the interface address! Using ".1" for the interface address is sortof a defacto standard, so what you did was "a bit weird", but a validation check might have highlighted the cause...

If you're really only getting a /64 delegated prefix from your ISP (go to Interfaces -> Overview, click on the Details (magnifier) button for your WAN interface, and look for "Dynamic IPv6 prefix received"), you should not set a prefix ID at all for your WAN interface, since you need the one /64 that you have (prefix 0) for LAN. It'd be a bit curious if setting to "1" actually works - does your WAN interface have an address from that prefix now?

If I'm following that sequence right, it sounds like your broke something (probably your dnsmasq DHCP config) before resetting the ISC DHCP config (and maybe the clients were still clinging onto old leases, or something). Maybe you could try resetting the ISC DHCP config again, and hopefully dnsmasq is still functional from the 2-days-ago snapshot.....

It would be "Services: ISC DHCPv4 [legacy] [dhcpd]" - you can just type "isc" in the search box, and it should pop up if it's available.

OK, so I think you have some leftover ISC DHCP config, and that's what's tripping you up. If you have the plugin installed, you could delete the static mappings using the webUI. If you don't have the plugin, I *think* you could use `pluginctl -f dhcpd` to flush the old config, then perhaps reboot (to clear out the static ARP entries)... but I'd generally defer to franco on the proper way to clean up things like this...

Seems there may be multiple different (but similar-ish) issues being discussed here.

For the OP; I *think* that "was killed: failed to reclaim memory" indicates that the system ran out of memory and started killing processes to try to reclaim some. Maybe you have insufficient memory, or some issue (not necessarily unbound) that's consuming more than it should be .... ?

The config snippet looks like it pertains to ISC DHCP, not dnsmasq. Which DHCP server are you actually using? It look like it has static ARP too, so that may be getting in your way. I think there may be some magic code that looks at those static mappings even if ISC DHCP is not enabled (not sure if I'm remembering this right).

You're conflating issues quite a bit (PPPoE, DNS on the firewall itself, DHCP, ...)

Kea DHCP won't affect how the firewall itself accesses DNS services, but FYI anyway; if you want to set explicit DNS servers or router for a subnet in Kea, you'd need to uncheck "Auto collect option data".

If you want to try specifying the DNS servers that the firewall itself uses, you might want to check "Do not use the local DNS service as a nameserver for this system" as well (at System -> Settings -> General). If that allows the firewall itself to resolve DNS names, you have some issue with Unbound. If it doesn't, perhaps your ISP blocks access to DNS other than their own servers? What was your DNS configuration before the problem started?

There would be a version controlled repository in /conf/backup/git if https://docs.opnsense.org/manual/git-backup.html was followed, though. As you suggested before, presumably the plugin is installed. I tend to agree with the OP that it's a bit too easy to shoot yourself in the foot with the enabled-by-default flush...