Messages

But this firewall is for home use so paying for the business edition is not something that I would want to consider. What's wrong with those plugins anyway?

@tkreagan I'm just wondering, is your plugin compatible with the latest 26.7.8 opnsense? Also, a couple of questions:

1) Do you recommend enabling full sync?
2) Do you recommend enabling log watcher? If so, how do I change the DEBUG log level of Kea DHCP to 50?
3) How does your plugin compare to the os-kea-unbound plugin by JameZUK?

Which is better between these two plugins?

os-kea-ubnd-ddns
os-kea-unbound

I have the first one installed in my new opnsense box until I saw the second one with a more recent release. The first one has more settings too.

So if I get this right, with the latest opnsense version, just install the microcode plugin and reboot the machine, right? No need to add tunables and stuff.

I just installed 26.7 on a bare metal that has a mellanox cx3 card and the module still did not load. I still had to put it in the tunables. I read in this forum that this is no longer necessary with the newer opnsense versions but why is this still not the case in my experience?

Any help out here? This has been a nightmare for me. My ISP had issues since Friday and when this happens, opnsense doesn't automatically "recover". So when I'm not home when there is a network outage, everybody is affected.

It's in your HOWTO ;-)

That is, if the ZFS "autotrim" feature is not set manually. You can either set this via the OpnSense CLI with "zpool set autotrim=on zroot" or, better, add a daily cron job to to this (System: Settings: Cron) with "zroot" as parameter.
You can trim your zpool once via CLI with "zpool trim zroot".

Oh nice, I didn't know meyergru had a How To guide. Good to use for my environment then.

Based on the dpinger logs I have, dpinger is up and running when this happens. In my case, when the Internet service comes back up it looks like the WAN interface IP address does not renew or something which is why dpinger keeps on failing on the querying the monitor IP. That's just me thinking of possible causes but I'm not sure how to verify this claim in the DHCP logs.

I do not know if autotrim has always been on with OpnSense. Maybe your initial installation did have it disabled?

Did you check with "zpool get all | fgrep autotrim"? All my instances have it enabled.

Yes.

Code Select Expand

root@OPNsense:~ # zpool get all | fgrep autotrim
zroot  autotrim                       off                            default

I forgot the exact version of my initial install but it's pretty recent, like maybe June 2024 version.

Yes, I you have a ZFS pool inside your VM, the VM needs to do the trimming and scrubbing. If this pools happens to be mapped to a file in a ZFS pool of the host, the scrubbing is not needed since it is done by the host. Actually, scrubbing a virtual ZFS pool doesn't make sense.

Sorry, but this is plain wrong or at least ambiguous.. The trimming and scrubbing taking place on the VM host works on its own ZFS pools, not on the OpnSense pools.

Within those pools, you have virtual disks, which are usually ZFS volumes. What the VM OS - in this case OpnSense - does with that, is its own business and the VM host does not look into it. OpnSense could as well be installed on UFS, which Proxmox would not even understand. On the other hand, you could have LVM filesystems on Proxmox and ZFS on OpnSense. You see: Even if both OpnSense and Proxmox use ZFS pools, they are independent of one another. If this wasn't clear already, just look at the names: Proxmox names its root zpool "rpool", whereas OpnSense names its pool "zroot".

Thus taking care of filesystems (or zpools) in an OpnSense VM is just as much its business as without virtualisation. Think of logical errors in the VM itself, which are not manifested on the underlying hardware.

For the default zroot pool, autotrim is on. While you could scrub, it would only be useful if you had multiple disks. If OpnSense is operated as VM, it would be more useful if the underlying Proxmox storage was redundant.

There you go. Thanks for the detailed explanation.

Only thing I'm wondering about is why autotrim in my opnsense zpool isn't enabled?

I haven't looked into the gateway monitoring mechanisms in OPNsense, but have you tried monitoring (pinging) a directly-connected IP (the immediate next-hop) instead of a remote?

I haven't tried it yet but I can. However, I think it's still best to use a remote IP when monitoring an Internet gateway. In fact, it's what I've been doing with pfsense for several years and it's flawless even with multiWAN. That's why I'm baffled why this isn't working with opnsense with a single WAN.

After several months of using opnsense and a couple of firmware updates to it, I still get this issue:

https://forum.opnsense.org/index.php?topic=41676.msg204737#msg204737

I just experienced it today. Is this not yet fixed?

Here are some logs that triggered today:

https://gist.github.com/kevindd992002/bd55652b9847ca0af03e0d3c24f45957

The WAN gateway never went online until either I restarted the VM or manually renewed the WAN connection in the opnsense GUI.

Well, initially I had a non-ZFS FS on my opnsense VM in the ZFS pve host. Then my opnsense VM got corrupted. Did some research and a couple of people suggested that the best way to go is to reinstall opnsense on the VM with a ZFS filesystem as well, and that's what I did. Why is this suboptimal? How do I go about "mounting a host ZFS to the opnsense VM directly"?

Here's that past topic if you're interested on why I did what I did: https://forum.opnsense.org/index.php?topic=42099.msg207468#msg207468

Unless you have attached a ZFS pool to the VM, the machine hosting the zpool should do the trimming and scrubbing.

I do have another pool inside the VM. So does that mean I have to create a cron job for trimming and scrubbing? What is the difference between the trim cron job and the autotrim property?

I have OPNsense 24.7.11_2-amd64 installed in a Proxmox VM and am wondering if it has ZFS trim and scrub scheduled by default? Or do I still need to add both tasks as a cron job?

If they're not enabled by default, why? Is there a reason we don't want these two?