Messages

[...]At this point, I'm wondering why the state table grows so large[...]

What protocol/service? TCP sessions tend to hang around; I usually have a bunch of TCP DNS sessions in TIME_WAIT, as DNS can be a spew. My old Fortigate had granular control of session timeouts, one of its few advantages. Not a functional issue, really - I mostly cut UDP DNS timeouts to reduce clutter when browsing the state table. I don't bother with OPNsense.

As of this morning, all of the _WAIT states are TCP. It's not too bad, 76 wait states out of about 960 total states. However, and this is an ongoing issue, I still can't access some web sites (including this board) without turning on the external VPN. Kind of a pain... almost all of the TIME_WAIT connections are going out to either http (80) or https (443) - only two are going to quad9 DNS (853).

I'd expect sessions to be more of a memory issue than processor, and I wouldn't expect a problem with 16GB. Those session spikes may be more of a symptom than a cause - the protocol may be revealing. (I have static IPs and servers; I average a few hundred sessions, lots of bots/scrapers/whatever can put that up to 5000 or so for hours or days. That doesn't even account for the constant stream of blocked packets.)

I run an external OpenVPN server on a raspberry pi 5. The incoming bot packets are enormous and most of them are targeting VNC on port 5900, etc. There's no VNC port open but that doesn't stop them.

I upgraded to 26.7.9_1 this morning... hmmm...

Update: The aforementioned removal of all IPV6 enables helped for a while but last night, the network began stalling again, mostly on streaming services like SiriusXM, Facebook, and Youtube. So I reenabled the external VPN on my phone and the streaming services worked again. Before reenabling the VPN, I checked the Unbound logs and found no blocks occurring at all so I don't think these streaming stalls are related to DNS. I also noted that when the VPN is on, I don't see any transactions from the device I'm using in the firewall logs - turning the VPN off does show transactions and they're all going through. All this really says is that the use of external VPNs allows packets to sail through the firewall rules as well as DNS.

This morning, all my devices were laggy or unavailable on the internet... I couldn't even retrieve my email. Also, on my Mac, I was unable to log into this board so I reenabled the VPN on both the phone and the Mac. Checking the current the OPNSense state list:

# pfctl -s states | wc -l
    1299

1299 states? Really? Yesterday, the state count was hovering around 300 earlier in the day. Next, I checked the WAIT states:

# pfctl -s states | grep "_WAIT" | wc -l
      49

Not too bad but this doesn't explain where all the other states are coming from after an overnight of very little activity. Looking in the state table for each VLAN (IoT and Guest), I see about 25 states each, not bad at all. Looking at the state table for the LAN however, I see 1226 established states! Past experience with 26.7.x has shown that a large state table really slows down all the LAN/VLANs so on the surface, it seems that these established states may be preventing me from turning off the VPN on my Mac and phone. Note that I don't use any state tracking other than "Keep State" - there are no sloppy states defined in any of my LAN/VLANs.

My experiment just now was to clear the LAN state table completely. Now I see:

# pfctl -s states | wc -l
     143
# pfctl -s states | grep "_WAIT" | wc -l
      77

This is very typical during daytime activity and I don't need to turn the VPN on. The 77 _WAIT states are all on the LAN. Most notable is that after reseting the LAN states, all my streaming services are back up and running without having to turn on the VPN.

At this point, I'm wondering why the state table grows so large over the course of a day, mostly in the evening and overnight. I'm fairly certain that the growing state table ovwe 12-15 hours (both established and _WAIT states), is the cause of my network stalls and streaming service blockages. I have no idea why, I'm simply correlating the size of the state table vs ability to access the internet. The larger the state table grows, the slower my internet access gets and eventually nearly comes to a complete halt without an external VPN enabled.

Going back to disabling IPV6 yesterday - the OPNSense GUI is now responsive again, all the time, even when the state table is huge. So there's a direct correlation between disabling IPV6 and usability of the web gui. Also, I did (and still do) have "prefer IPV4 over IPV6" turned on but that didn't help at all when IPV6 was still enabled in the WAN gateway. Simply disabling IPV6 in the gateway was all it took to get the OPNSense GUI responsive again, so this goes back to OPNSense 26.7.x and my ISP not playing nice together regarding IPV6. OPNSense 21.x had no problems getting an IPV6 address from my ISP... why can't 26.7.x?

Back in the 21.x days, I always had both an IPV4 and IPV6 address with my ISP and I never saw any of these OPNSense GUI stalls/extreme slowness. I have to wonder whether the IPV6 state bug was resolved since I can't get an IPV6 address from my ISP afte4r upgrading to 26.7. The one time I did get an IPV6 address was during numerous debug cycles and reboots and that IPV6 address didn't survive the following reboot. For now, I need to focus on why my state table is growing during the day and gets very large at night. Tonight, I'll clear the LAN state table as soon as SiriusXM and Youtube refuse to load without the VPN, and see if doing just this alone restores the streaming services again.

Which makes this bug even more critical to fix, don't you think? OPNSense 26.7 was announced on 7/15/2026. Here I am, after 4 months of grief, finally with a workaround but definitely not a proper solution.

My Apple devices are now "pausing" for a short period of time, I assume trying to reach an IPV6 address and finally realizing they can't so they fall back to IPV4 and complete the connection. SiriusXM takes about 10-15 seconds when I change channels (which is instantaneous when I use the external VPN which CAN reach IPV6) and even attempting to log into this forum paused for about 30 seconds before the login popup appeared. Sigh... I should have stayed on 26.1.x but the EOL warnings prompted me to upgrade.

Noteworthy - exactly one time after updating to 26.7.8_2 and during constant reboots and settings changes, I noticed I did get an IPV6 address for a short time and could even PING6 it. But, that IPV6 connection failed after a short time and never came back.

Also, these CVE's:

***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 26.7.8_2 (amd64) at Mon Nov  9 14:42:46 CST 2026
vulnxml file up-to-date
python313-3.13.16 is vulnerable:
  Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines
  CVE: CVE-2025-15367
  WWW: https://vuxml.FreeBSD.org/freebsd/6d3488ae-2e0f-11f1-88c7-00a098b42aeb.html

sqlite3-3.53.4,1 is vulnerable:
  sqlite3 -- multiple vulnerabilities
  CVE: CVE-2026-119371
  CVE: CVE-2026-119372
  CVE: CVE-2026-119373
  CVE: CVE-2026-119374
  CVE: CVE-2026-119375
  CVE: CVE-2026-119376
  CVE: CVE-2026-119377
  CVE: CVE-2026-119378
  CVE: CVE-2026-119379
  CVE: CVE-2026-119591
  WWW: https://vuxml.FreeBSD.org/freebsd/84cd82e1-d49f-11f1-bae2-3497f65b111b.html

2 problem(s) in 2 package(s) found.
***DONE***

After months of aggravation with OPNSense 26.7 (and now running 26.7.8_2), I and Google Gemini have finally resolved the slowness and stalling of my network since upgrading from 26.1.x. The bottom line is I was forced to disable IPV6 on the WAN interface (and everywhere else) even though my ISP fully supports IPV6. I used to have both IPV4 and IPV6 addresses under OPNSense 26.1.x which worked fine, but ever since upgrading to 26.7 and all its patches, there has been no IPV6 address connection. OPNSense was constantly sending IPV6 solicitations trying to obtain a valid address but never got one.

It should be noted that Apple devices and many streaming providers prefer IPV6 over IPV4 which was slowing down and/or stalling my network unless I turned on an external VPN.

From Google Gemini:
 
1. The 26.7 State-Tracking Regression (state-insert,block)

• What it is: OPNsense 26.7 introduced a known packet filter (pf) state regression where legitimate return traffic or permitted connections get silently dropped or blocked with state-insert,block errors, particularly on setups with multiple VLANs or refactored rule evaluations.
• Where it is documented: You can reference OPNsense Core GitHub Issue #10615 and the OPNsense 26.7 "Xenial Xenops" Release Notes, which detail major under-the-hood changes to FreeBSD 15.1's pf routing (pf_route()) and interface device matching.

2. IPv6 Prefix Delegation & Gateway Issues in 26.7.x

• What it is: Users upgrading to 26.7.x reported broken IPv6 gateway tracking, stalled firmware/connectivity checks over IPv6, and radvd / dhcp6c initialization failures when delegating prefixes across interfaces. In fact, the OPNsense 26.7.8_2 Hotfix Notes specifically reverted a dynamic gateway change affecting dual-stack IPv4/IPv6 interfaces.
• Where it is documented: You can point to the OPNsense 26.7.8 Release Thread (specifically the 26.7.8_2 hotfix note), the OPNsense Forum Thread on IPv6 Prefix Delegation & Boot Errors, and discussions on r/opnsense where disabling WAN IPv6 is the community workaround for stalled connections.

• Environment: OPNsense 26.7.8 on Comcast/Xfinity dual-stack (WAN_DHCP + WAN_DHCP6 link-local gateway) with multiple VLANs (igc0, igc2, vlan01, vlan02).
• Symptoms: Outbound IPv6 SYN packets from LAN clients (Apple Music, Web GUI) left the interface without completing handshakes, causing TIME_WAIT socket buildup and UI stalls.
• Resolution: Disabling WAN_DHCP6 immediately restored normal IPv4 routing, DNS resolution, and Web GUI responsiveness.

Any idea when this bug will get fixed?

Maybe try for a time without any Quad9 DNS ? I saw some weirdness in OPNsense, put ControlD/Cloudflare instead of Quad9 servers and it's been fine since

Also, what are your CPU temps ?

It's not Quad9 DNS. I let the network continue running on Quad9 for the past 21 hours and DNS resolves are fast. The CPU temps (in those rare times when I get lucky enough to get the web GUI to actually open), settle in around 38-42C during normal network activity. I don't know what's wrong with the GUI but since upgrading to 26.7.7 two days ago, it's become almost totally unusable.

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

More like out of sockets ?!

I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net.

Maybe the webGUI simply did not load the settings properly because of all the issues ?!

Did you have a look at the Unbound things I suggested ?


To be honest I am running out of suggestions so here are two last ones :
- Test the RAM.
- Check the adapter/power supply.

That's all I got for now...

Good luck! :)

I think it was the web GUI not loading properly. I don't know how to change the Unbound logging level other than selecting the status level from the pull down menu.

Interesting experiment today. Last night, the GUI was completely useless and it was late so I did two things:
First, I went back to a config file from a few days ago and rebooted the router from the CLI.

Second, I didn't open the GUI following reboot and went to bed.

Tonight, after 21 hours uptime, the network seems to be holding up fairly well with the older config file. I opened the GUI to have a look at things and it's still slow as molasses but it did open after letting it sit for this long time. However, when I went to look at the Unbound settings, the GUI completely stalled again and threw a page-loading timeout error. A while back, I noted that slow/unreliable network performance seemed to be related to the Web GUI stalls/timeouts but I can't really prove this out yet. Once the GUI stalled, I gave up and closed the browser window. At this point, I can't really use the GUI at all so I guess I'll have to learn all the CLI commands to do maintenance and make changes moving forward.

I attached a difference file between the current (older) config.xml file (<), and the newer config file I was using up until late last night (>). I'm not versed in XML language so maybe you can look at these differences and spot something.

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

More like out of sockets ?!

I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net.

Maybe the webGUI simply did not load the settings properly because of all the issues ?!

Did you have a look at the Unbound things I suggested ?


To be honest I am running out of suggestions so here are two last ones :
- Test the RAM.
- Check the adapter/power supply.

That's all I got for now...

Good luck! :)

I think it was the web GUI not loading properly. I don't know how to change the Unbound logging level other than selecting the status level from the pull down menu.

Interesting experiment today. Last night, the GUI was completely useless and it was late so I did two things:

First, I went back to a config file from a few days ago and rebooted the router from the CLI.
Second, I didn't open the GUI following reboot and went to bed.

Tonight, after 21 hours uptime, the network seems to be holding up fairly well with the older config file. I opened the GUI to have a look at things and it's still slow as molasses but it did open after letting it sit for this long time. However, when I went to look at the Unbound settings, the GUI completely stalled again and threw a page-loading timeout error. A while back, I noted that slow/unreliable network performance seemed to be related to the Web GUI stalls/timeouts but I can't really prove this out yet. Once the GUI stalled, I gave up and closed the browser window. At this point, I can't really use the GUI at all so I guess I'll have to learn all the CLI commands to do maintenance and make changes moving forward.

I attached a difference file between the current (older) config.xml file (<), and the newer config file I was using up until late last night (>). I'm not versed in XML language so maybe you can look at these differences and spot something.

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

No, not at all. I have 14GB free ram of the installed 16GB. I managed to reboot via the GUI. I waited 5 minutes after the Login page came up and the first attempt to log in failed with a page timeout error. I tried a second time and the Dashboard finally came up but was completely blank. A few minutes later, it finally populated. Overall, the web GUI is EXTREMELY slow. I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net. I just reloaded the Dashboard page and it went blank for almost 10 minutes!

After upgrading to 27.7.7, the GUI is almost completely dead. I'm having trouble logging into the GUI now and I've restarted web gui multiple times. If I do get to the dashboard on a login, going to any other page is slow and attempting to look at firewall liveview log or states results in a complete stall of the GUI with the spinning icon. I have rebooted OPNSense from the command line multiple times, but the GUI is virtually useless at this point.

Looking at the lighttpd log via the ssh shell, I'm seeing these errors. You can see the forced restart of the GUI from the command line and the lack of socket connections. I did manage to login once after this restart and will reboot from the GUI now.

 # tail -f latest.log
<27>1 2026-10-13T13:44:40-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="9"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-3: Connection refused
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="2"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-3: Connection refused
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="3"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="4"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-0: Connection refused
<29>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="5"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.1272) [note] graceful shutdown started
<29>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="6"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.2384) server stopped by UID = 0 PID = 21007
<29>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="7"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.1973) server started (lighttpd/1.4.85)
<27>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="8"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-1: Connection refused
<27>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="9"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-2: Connection refused

Attached is the smartctl output.

Looks clean, but these are unknown :

Code Select Expand

170 Unknown_Attribute       0x0003   100   100   010    Pre-fail  Always       -       171
173 Unknown_Attribute       0x0012   100   100   000    Old_age   Always       -       7930004And since it seems to be a SSD rebranded by Protectli I can't find any manufacturer documentation about it...

Also note there is no ioctl command on my system??

iotop is a command for checking storage activity but maybe OPNsense does not have it by default.

Unbound logging level is set at error.

What happens when you completely disable it ?

Switching to debug mode, all I see are information and notices, no warnings and no errors.

That's good, but I think disabling it should avoid the storage issues that I have mentioned before!

Yes, I'm using Stevens Blacklist with about a dozen domains whitelisted that affected the Mac laptops and phones.
No unusual blocks being seen in the Unbound logs.

Most of my settings are the same as they were in the final release of 21.x. I had absolutely no problems at all under 21.x, all of my problems started after upgrading to the first and subsequent releases of 26.7.

I have a feeling that all of this is related to Unbound targeting quad9 DNS servers because a key point is that turning on Proton VPN in any LAN device instantly restores fast connectivity to the internet. Turning Proton off causes stalls on some sites which I can sometimes get to by reloading the page. The browsers constantly throw "page took too long to load" errors regardless of the browser I'm using.

The OPNSense web gui is very slow to load at all times, even after a reboot. Logins can take 30-60 seconds and changing pages in the GUI is also very slow. After a day or two of running, I can't even get into the GUI and typically reboot the router at the command line. External web sites may or may not load immediately after a reboot so I turn on Proton. After reboot today, I couldn't get to this site without turning Proton on.

I've now turned off Stevens Blacklist and will test under these conditions. Unbound continues to route to Quad DNS.

There was a topic a while ago that mentioned something about the way Unbound does the processing of the blocklist and how inefficient it is compared to let's say Pi-Hole and AdGuard.

Since I am a Pi-Hole user and follow their Discourse Forum frequently I have read something about the whole processing flow of the blocklists/whitelists not too long ago and after comparing it to the Unbound version it once again proved that Unbound is simply the wrong choice for network-wide adblocking functionality :)

So I would say consider leaving Unbound for what it is : A Recursive Resolver that only talks to the Root DNS Servers.
And use something else for adblocking...

This is interesting. In OPNSense 21.x, I had both Stevens Blacklist and Adguard turned on and never saw any network stalls or slow performance. I rarely even logged into OPNSense because I had no reason to.

So after 21 hours since the last reboot, with the blacklist disabled, I'm noticing network slowdowns and stalls again. Additionally, the OPNSense GUI is slowing down again but not nearly as bad as with the blacklist enabled. Turning on Proton VPN restores the network to normal speed. From what I've been reading, Unbound is bypassed when a device is using an external encrypted VPN so this seems to make sense. Another clue is that my IoT and Guest VLANS use public DNS - only the LAN uses encrypted Unbound/Quad9 - and I haven't seen any slowdowns on the IoT or Guest VLANS.

I'm going to run for another day without rebooting the router and see if the LAN degrades further.

iotop is a command for checking storage activity but maybe OPNsense does not have it by default.

Use

Code Select Expand

iostat 2

instead, of if running on ZFS

Code Select Expand

zpool iostat 2


 # iostat 2
       tty           mmcsd0           mmcsd0           mmcsd0             cpu
 tin  tout KB/t   tps  MB/s KB/t   tps  MB/s KB/t   tps  MB/s  us ni sy in id
   0     3  3.2     0  0.00  2.9     0  0.00  2.9     0  0.00   1  0  0  0 99
   0   118  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 99
   0    39  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   0    41  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   5  0  2  0 93
   0    39  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   0    41  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   0    39  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  1  0 99
   0    40  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  1  0 99
   0    38  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   5  0  2  0 93
   0    42  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   0    40  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   0    40  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100
   3   269  0.0     0  0.00  0.0     0  0.00  0.0     0  0.00   0  0  0  0 100

I suspect Unbound is the culprit since my IoT and Guest networks bypass Unbound and run fine with DNS servers 8.8.8.8 and 1.1.1.1. Only the LAN is affected because Unbound passes its traffic to Quad9 servers. Unbound logs show all DNS traffic going out since I added bypasses from servers blocked by Steven's Blacklist.

Are you using blocklists with Unbound? Try without them. Monitor Unbound with logs, ps, etc.
Although is best to find the hogging process or activity and zoom in, that's what I would do if Unbound appears fine. We're only following a hunch after all.

and unnecessary services (ClamAV, Netflow) are turned off

Good. These are relatively heavy processes.

Yes, I'm using Stevens Blacklist with about a dozen domains whitelisted that affected the Mac laptops and phones. No unusual blocks being seen in the Unbound logs.

Most of my settings are the same as they were in the final release of 21.x. I had absolutely no problems at all under 21.x, all of my problems started after upgrading to the first and subsequent releases of 26.7. I have a feeling that all of this is related to Unbound targeting quad9 DNS servers because a key point is that turning on Proton VPN in any LAN device instantly restores fast connectivity to the internet. Turning Proton off causes stalls on some sites which I can sometimes get to by reloading the page. The browsers constantly throw "page took too long to load" errors regardless of the browser I'm using.

The OPNSense web gui is very slow to load at all times, even after a reboot. Logins can take 30-60 seconds and changing pages in the GUI is also very slow. After a day or two of running, I can't even get into the GUI and typically reboot the router at the command line. External web sites may or may not load immediately after a reboot so I turn on Proton. After reboot today, I couldn't get to this site without turning Proton on.

I've now turned off Stevens Blacklist and will test under these conditions. Unbound continues to route to Quad DNS.

I only want to change one thing at a time to ease troubleshooting. The network slowed to a crawl again so I'm attaching a process dump file immediately after a reboot and one that took about a day and a half to reach enough slowness to cause me to do another reboot.

I don't see anything weird either so it got me thinking : Maybe it's the storage ?!

You also did not mention anything about the Unbound logging level setting that I mentioned earlier ?

Can you post the output of :

Code Select Expand

# smartctl /dev/<whatever you HDD/SSD is> -aand if possible also

Code Select Expand

# iotop Hopefully that's it and replacing the HDD/SSD will be enough to fix this...

Please note that /var and /tmp are running in a ramdisk. I moved to ramdisk a couple of weeks ago thinking the SSD was too slow but now I doubt it.

Attached is the smartctl output. Also note there is no ioctl command on my system?? Unbound logging level is set at error. Switching to debug mode, all I see are information and notices, no warnings and no errors.

There are no OPNSense processes hogging CPU time

Post your 'top' output anyway :
- One after reboot.
- One when everything has slowed down.

And if you haven't already : Disable HostWatch

I suspect Unbound is the culprit since my IoT and Guest networks bypass Unbound and run fine with DNS servers 8.8.8.8 and 1.1.1.1. Only the LAN is affected because Unbound passes its traffic to Quad9 servers. Unbound logs show all DNS traffic going out since I added bypasses from servers blocked by Steven's Blacklist.

A while ago someone had issues because the Unbound Logging Level was set too high and the SSD could not keep up with it IIRC so you could take a look at that too!

Ok, first things first. I only want to change one thing at a time to ease troubleshooting. The network slowed to a crawl again so I'm attaching a process dump file immediately after a reboot and one that took about a day and a half to reach enough slowness to cause me to do another reboot. I haven't changed any settings yet as Hostwatch was using almost 0 time and occupying only 16M of memory.

Ever since upgrading from 21.x to 26.7.x, I've been experiencing gradually deteriorating internet performance. Specifically, after a router reboot, internet performance is great but over a period of a few hours it begins slowing down. LAN devices have trouble accessing the internet and at times, they can't connect at all. The OPNSense web GUI also slows down simultaneously with the internet slowdown to the point where I can't open the GUI at all. Typically, I log into an SSH shell and restart the web gui which sometimes helps but not always. Eventually, the only solution is a complete reboot of the router which then brings performance back to normal for a few hours and this cycle repeats.

The temporary fix I've found so far is to enable Proton VPN on the affected LAN devices which restores internet performance but does nothing for the OPNSense web GUI. After sitting overnight, the web GUI becomes somewhat responsive again but still slow and gradually degrades again after a few hours. Unfortunately, internet performance remains severely degraded and almost useless without the external VPN turned on. Rebooting the router restores LAN internet performance but only for a few hours.

I've noticed posts here about similar issues with earlier OPNSense releases after upgrades but haven't seen anything about this happening after upgrading from the final 21.x release to  26.7.x. Is anyone else experiencing this?

I'm currently running OPNSense 26.7.6 on a Protectli VP2420 with 16GB of ram. There are no OPNSense processes hogging CPU time, free ram is running about 13GB, the firewall state table hovers in the low 300's, and unnecessary services (ClamAV, Netflow) are turned off which helps a bit but not permanently. I suspect Unbound is the culprit since my IoT and Guest networks bypass Unbound and run fine with DNS servers 8.8.8.8 and 1.1.1.1. Only the LAN is affected because Unbound passes its traffic to Quad9 servers. Unbound logs show all DNS traffic going out since I added bypasses from servers blocked by Steven's Blacklist.

Gemini and Grok recommend I wipe the Protectli flash and install OPNSense 26.7 from scratch, and then restore the router from the backed up config.xml but I don't know if this will work. Advice would be appreciated as I've been battling this slowly degrading performance cycle for a couple of months.