Messages

I recally cannot remember if I had the microcode plug-in installed, but if it's a problem can't the upgrade process be configured to remove it to save this happening?

Mike

Have been running 26.1 on a re-purposed Check Point 5800 for some time.

Was using the Firewall (old) Rules which was a blocker to upgrading to 26.7 so finally this evening I did:

1. Back up configuration
2. Run firewall rules migration
   - Exported rules to CSV
   - Reviewed rules
   - Imported to new rules
   - Flushed old rules
   - Saved changes
3. Rebooted system
4. System came back fine, tested networking and rules seemed fine
5. From the Dashboard/lobby did a Check for Updates
6. System upgraded from 26.1.10 to 26.1.11 and said "end of support for 21.1"
7. Manually rebooted
8. System came back and everything working as expected
9. Did Check for Updates again and was offered 26.7 with caveats like "will need multiple reboots"
10. Cancelled and backed up system again (just in case)
11. Resumed upgrade to 26.7
12. System installe new kernel and printed REBOOT surrounded in !!!!!!! and went to reboot but never came back
13. Pluged laptop in to serial console, get message "failed waiting for configd (doesn't seem to be running)" approx every 15 seconds.  Machine wedged.
14. Used long-press on power switch
15. System said uptime 13 min, syncing disks, etc. and shutdown
16. Powered up system again and it booted normally back in to 26.1.11 and is working
17. Check for Updates now broken with tens of error messages about wrong packages and database rebuilds needed

WTF happened?

Mike

So, I flattened the system and re-installed 26.7 but this time allowed the suggested:

    igb0 -> LAN
    igb1 -> WAN

which is kinda backwards to my thinking since igb(0 = Outside) and igb(1 = Inside) so I always put the outside on the lowest numbered interface and in my setups there's always one outside interface and one ore more inside interfaces.

I didn't do any IP address assignments from the installer - I let it use DHCP for WAN and 192.168.1.1/24 for LAN.

I let the installation complete, rebooted, logged in, ran the setup wizard and it worked "out of the box" with the two audo generated source NAT rules being present.

So, now for some more prodding and poking - I'll probably flatten/install again and set just the inside network to 10.100.1.1/24 and see if that works with the wizard. Then I'll again and swap the interfaces back to igb0=outside and igb1=inside and see if that works...

Mike

ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28

If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.

I added 77.**.**.49 as a Gateway... like I said I was able to ping 1.1.1.1 and 9.9.9.9 from a shell on the console - if the default gateway wasn't configured/working I wouldn't be able to get off my local LAN network...

Do you have an ICMP LAN allow firewall rule? Source LAN Network -> Anywhere

No, I assumed the wizard's "allow everything out" with "protocol = *" included ICMP... ?

I've just installed OPNsense 26.7 on a Sophos XG210 and the installation ran fine.

I assigned:

    igb0 -> WAN
    ibg1 -> LAN

I set the IP address on the LAN to 10.100.1.1/24 and logged in to the UI, set dark mode, ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28 and it worked. The wizard completes successfully. DNSmasq is configured as a DHCP server.

A laptop connected to the LAN interface (wired Ethernet) obtains an IPv4 address via DHCP and can ping 10.100.1.1.

Going on the VGA console and starting a shell I can ping 1.1.1.1 and 9.9.9.9 okay.

Under Firewall > Rules the deault rule "Default allow LAN to any rule" is present.

Under Firewall > NAT > Source NAT > Automatic Source NAT Rule Generation shows no rules.  Changing to hybrid and adding a Source NAT rule for "LAN Address" to Any with Source NAT to WAN interface address adds the rule to the table but the laptop on the inside still cannot ping my default gateway or 1.1.1.1 or 9.9.9.9.

Am I missing something? I thought that OPNsense given just two interfaces automatically built the NAT from LAN -> WAN without any additional configuration and it worked "out of the box"?

Mike

I was already planing to replace my unmanned Netgear with a SFP+ one ( I am building a NAS, I don't need 10G network but with everything going so sideways in price and HDD already showing signs, I better do it now before network gears gets bitten by the AI bug also :-) )

I have a MikroTik CRS317 as my 10G core switch, which has 2 x Netgear GS728TXP, 2 x GS110TP and an GS316EP hanging off it along with my NAS (10G interface) and my main Linux R&D box (10G interface).

I did as I suggested and use 10.xx.vv.0/24 subnets where 'xx' is my site ID and I keep the third octet of the IP address the same as the VLAN tag, so if 'vv' is 20 then it's on VLAN20 - just makes it easy to remember.

If you're dual stack and are running IPv6 with a /48 then I parition at the /49 boundary and the bottom half is outside the firewall and the top half is inside, eg. 2001:DB8:1234:8000::/49 is inside. Then I do the same trick an use the VLAN tag in the IPv6 /64s so 2001:DB8:1234:8020::/64 is on VLAN20.

Keeps everything memorable.

I also look after five sites so we use different site codes and use WireGuard to link various VLANs over IPv4 or route over IPv6.

Mike

While the underlying FreeBSD OS supports 'aliases' on network interfaces in a similar way to Linux I'm not sure that all of the plumbing through OPNsense and KEA DHCP is in place to support it.

It would be a much better idea to use VLANs and perhaps delare your site as 10.19.0.0/16 since you used that IP range already and then subnet in to VLANs like:

vlan0.1   [DEFAULT] 10.19.1.0/24
vlan0.2   [MGMT]    10.19.2.0/24
vlan0.10  [LAB]     10.19.10.0/25
vlan0.254 [IOT]     10.19.254.0/24
vlan0.255 [GUEST]   10.19.255.0/24

then everything will fit together nicely ;-)

Mike

I have no idea how that happened, but I took the hint and moved over the Kea DHCP as ISC DHCP is End-of-Life and deprecated.

[unknown-repository]

Okay, so:

   cd /tmp
   wget https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/MINT/26.1.1/latest/All/os-lcdproc-sdeclcd-1.1_1.pkg
   pkg install os-lcdproc-sdeclcd-1.1_1.pkg

works, but System > Firmware > Plugins now shows:

   os-lcdproc-sdeclcd (installed)   1.1_1   982B   4   unknown-repository   LCDProc for SDEC LCD devices

Should I have done something different?

Mike

I am running OPNsense 26.1.1 on a re-purposed Sophox XG230.

With 25.7_11 I had the LCDproc plugin running and had system stats and performance on the 2-line LCD panel.

With 26.1.x System > Firmware > Plugins reports it missing:

os-lcdproc-sdeclcd (missing)   1.1_1   982B   3   OPNsense   LCDProc for SDEC LCD devices[/b]   

Is there a chance that it could make a return?

Regards

Mike

Hi Franco,

Thanks, patch applied and I am now able to add DNAT rules ;-)

I don't know where my previous NAT rules went... this is what I did:

1. Existing Server, working system (25.7_11) ... Backed up config

2. New (temp) server, installed 26.1, imported backup, upgraded to 26.1_4. Didn't explicitly test DNAT but everything seemed to be working.

3. Flattened exiting server, installed 26.1. Backed up temp server, imported to existing server. Upgraded to 26.1_4

Found that DNAT wasn't working. I guess somewhere along the way it broke...

All is good now. Thanks for the help.  Have sent €50,00 donation.

Regards

Mike

Hi Franco,

Pluginctl -v results in a message per interface in the form:

root@gate:~ # pluginctl -v
OPNsense\Firewall\Alias.aliases.alias.__wan_network.name => The name must start with a letter or single underscore, be less than 32 characters and only consist of alphanumeric characters or underscores.

and pluginctl -g nat results in an empy set:

root@gate:~ # pluginctl -g nat
root@gate:~ #

... does that help?

Regards

Mike

System: Firmware: Reporter should have logs. Better paste the PHP errors here than submitting them (it's a bit difficult to find them out of context).


Cheers,
Franco

Hi Franco,

I have run the health check (no problems) and re-installed the opnsense 26.1 package and upgraded to 26.1_4 and rebooted.

I still see the same problem when I try to add the Destination NAT with this PHP stack-trace:

[03-Feb-2026 12:29:19 Europe/London] TypeError: dom_import_simplexml(): Argument #1 ($node) must be of type object, null given in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:755
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(755): dom_import_simplexml(NULL)
#1 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(822): OPNsense\Base\BaseModel->internalSerializeToConfig()
#2 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableModelControllerBase.php(327): OPNsense\Base\BaseModel->serializeToConfig(false, true)
#3 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableModelControllerBase.php(498): OPNsense\Base\ApiMutableModelControllerBase->save(false, true)
#4 /usr/local/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php(122): OPNsense\Base\ApiMutableModelControllerBase->addBase('rule', 'rule')
#5 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Dispatcher.php(166): OPNsense\Firewall\Api\DNatController->addRuleAction()
#6 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(156): OPNsense\Mvc\Dispatcher->dispatch(Object(OPNsense\Mvc\Request), Object(OPNsense\Mvc\Response), Object(OPNsense\Mvc\Session))
#7 /usr/local/opnsense/mvc/app/library/OPNsense/Mvc/Router.php(139): OPNsense\Mvc\Router->performRequest(Object(OPNsense\Mvc\Dispatcher))
#8 /usr/local/opnsense/www/api.php(36): OPNsense\Mvc\Router->routeRequest('/api/firewall/d...', Array)
#9 {main}

What to try next?

Regards

Mike

Re-installation pf "opnsense 26.1_4" package performed:

***GOT REQUEST TO REINSTALL***
Currently running OPNsense 26.1_4 (amd64) at Mon Feb  2 18:23:36 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following packages will be fetched:

New packages to be FETCHED:
   opnsense: 26.1_4 (6 MiB: 100.00% of the 6 MiB to download)

Number of packages to be fetched: 1

The process will require 6 MiB more space.
6 MiB to be downloaded.
Fetching opnsense-26.1_4.pkg: .......... done
opnsense-26.1_4: already unlocked
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
   opnsense-26.1_4

Number of packages to be reinstalled: 1
[1/1] Reinstalling opnsense-26.1_4...
[1/1] Extracting opnsense-26.1_4: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Flushing all caches...done.
Writing firmware settings: FreeBSD OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
=====
Message from opnsense-26.1_4:

--
One step ahead, one step behind it, now you gotta run to get even
Checking integrity... done (0 conflicting)
Nothing to do.
***DONE***


I will now re-boot and try the DNAT configuration again.

Regards

Mike