Messages

https://forum.opnsense.org/index.php?topic=51959.0
https://forum.opnsense.org/index.php?topic=29304.0
https://forum.opnsense.org/index.php?topic=48145.0
https://www.reddit.com/r/opnsense/comments/1v7qqhn/26111_267x_upgrade/

Here are some links and bookmarks I kept from earlier.

Code Select Expand

sha256 /boot/loader.efi /boot/efi/efi/boot/bootx64.efi /boot/efi/efi/freebsd/loader.efi

Code Select Expand

efibootmgr -v

Code Select Expand

strings /boot/efi/efi/freebsd/loader.efi | grep "EFI loader"
Those commands look like they will be helpful as well.
However, what is the reason OPNsense itself doesn't update the bootloader when performing a firmware upgrade?

It looks like the bootloader upgrade went smoothly.
Do I need to upgrade the bootloader with every OPNsense major upgrade? (ex. v26.7 -> v27.1)

https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

https://github.com/ikow/php2shell-poc

Not Kea, but nut always fails to start automatically after a reboot. I have to start the service manually. In dmesg, the USB connection is shown as normal during boot.

https://www.netgate.com/blog/ding-dong-ditch-the-doorbell-prank-in-freebsds-iflib
Is it possible to backport this patch to OPNsense, or should we wait until FreeBSD applies it?

Entering the OTP directly on the login screen is extremely inconvenient.
I don't understand why it was designed this way.
It should follow standard practice on other websites: Enter Password -> Proceed to OTP prompt without prior password validation -> Enter OTP -> Validate account credentials (ID, PW, OTP).

127.0.0.1 is the loopback interface. It is not reachable from anywhere but the firewall itself.

Yes. I'd just like to disable the local port as well.

You cannot view this attachment.

Code Select Expand

$ sockstat -4 -l | grep chrony
chronyd chronyd    69981   5 udp4  127.0.0.1:323         *:*
Is it a bug that port 323 is open even though I didn't set 'Allowed Networks'?

When 'Allowed Networks' is configured, it opens as `*:323`, but when it's not set, the port opens as `127.0.0.1:323`.

Code Select Expand

$ cat /usr/local/etc/chrony.conf

port 323
driftfile /var/db/chrony/drift
pidfile /var/run/chrony/chronyd.pid
makestep 1 3

ntsdumpdir /var/lib/chrony
ntstrustedcerts /usr/local/etc/ssl/cert.pem
nosystemcert


server time.cloudflare.com iburst nts
It would be great to have an option to set the port to 0 or disable it completely.

Code Select Expand

/usr/local/opnsense/scripts/wireguard/wg-service-control.php: The command </usr/bin/wg syncconf 'wg0' '/usr/local/etc/wireguard/wg0.conf'> returned exit code 1 and the output was "Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.00 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.20 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.44 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.73 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.07 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.49 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.99 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 3.58 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 4.30 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 5.16 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 6.19 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 7.43 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 8.92 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 10.70 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 12.84 seconds...
Name could not be resolved at this time: `my-domain.com:51820' Configuration parsing error"
After upgrading to 26.7.4, I encountered the WireGuard log error shown above.
I'm using AdGuard Home, and I suspect this issue occurs because the AdGuard Home service fails to start on reboot.

https://freebsdfoundation.org/blog/freebsd-ai-assisted-vulnerability-discovery-project-launch/

https://www.reddit.com/r/technology/comments/1vkjpxh/linus_torvalds_says_ai_has_made_huge_linux_kernel/


Even if not for vibe coding, it would still be useful for security vulnerability scanning of OPNsense core and plugins, performance tuning, and WebUI development.

https://rclone.org/downloads/

Since rclone uses a FreeBSD binary, you can run backups directly using a shell script.
I currently back up to Dropbox and S3 via rclone.

You cannot view this attachment.

Code Select Expand

$ cat /etc/resolv.conf
# This file was automatically generated by system_resolvconf_generate()
# If you want to append configuration here use /etc/resolv.conf.local
domain xxxxxxxxxxxxxxxx
nameserver 192.168.1.1
nameserver 1.1.1.1
nameserver 1.0.0.1
search xxxxxxxxxxxxxxx

Code Select Expand

$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 41425
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com.  IN      A

;; ANSWER SECTION:
google.com.     114     IN      A      xxxxxxx
xxx
;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 192.168.1.1

# --

$ drill google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 13948
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; google.com.  IN      A

;; ANSWER SECTION:
google.com.     281     IN      A       xxx
xxxx
;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 4 msec
;; SERVER: 1.1.1.1
I am currently using AdGuard Home as my main DNS server.
AdGuard Home responds immediately and works without issue.
However, whenever a DNS query is made, my device alternates between AdGuard Home (192.168.1.1) and Cloudflare DNS(1.1.1.1).

Is it possible to set it up so AdGuard Home is used as the sole primary DNS, 
and Cloudflare DNS is only used as a fallback when AdGuard Home is delayed or unresponsive?

👍

This looks like a bug.

Q: What value should I enter for the monitor IP in the System Gateway settings?

I am using Mullvad, and according to their documentation, I should enter their DNS address (10.64.0.1).

However, since I have set up multiple selective routings (3 or more), I can only use 10.64.0.1 as the monitor IP for a single gateway due to a duplicate IP error.