Messages

Hello, I have a problem that i have been tinkering with for some days now.

My goal is authentication openvpn users against ldap. Im using a domain controller as a ldap server and have created local groups in opnsense that I want to sync.

When a user signs in via openvpn, a user is created and added to ALL groups in opnsense except for admins. Im getting crazy at this, I have tried to remove and re-add the server, remove and recreated the users, tried different settings and more, the users cannot auth in the webgui either.

Log from FRR

2026-07-16T17:35:38
Error
ospfd
*** sendmsg in ospf_write failed to 224.0.0.5, id 0, off 0, len 120, interface ipsec10, mtu 1400: Network is unreachable
2026-07-16T17:35:38
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Exchange -> Full (ExchangeDone)
2026-07-16T17:35:38
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Full -> Deleted (InactivityTimer)
2026-07-16T17:34:58
Error
ospfd
*** sendmsg in ospf_write failed to 224.0.0.5, id 0, off 0, len 120, interface ipsec10, mtu 1400: Network is unreachable
2026-07-16T17:34:58
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Exchange -> Full (ExchangeDone)
2026-07-16T17:34:58
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Full -> Deleted (InactivityTimer)
2026-07-16T17:34:18
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Exchange -> Full (ExchangeDone)
2026-07-16T17:34:18
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Full -> Deleted (InactivityTimer)
2026-07-16T17:33:38
Error
ospfd
*** sendmsg in ospf_write failed to 224.0.0.5, id 0, off 0, len 120, interface ipsec10, mtu 1400: Network is unreachable
2026-07-16T17:33:38
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Exchange -> Full (ExchangeDone)
2026-07-16T17:33:38
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Full -> Deleted (InactivityTimer)
2026-07-16T17:32:58
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Exchange -> Full (ExchangeDone)
2026-07-16T17:32:58
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Full -> Deleted (InactivityTimer)
2026-07-16T17:32:28
Error
ospfd
*** sendmsg in ospf_write failed to 224.0.0.5, id 0, off 0, len 120, interface ipsec10, mtu 1400: Network is unreachable
2026-07-16T17:32:28
Notice
ospfd
AdjChg: Nbr 172.28.0.29, NbrIP 172.28.0.21 (default) on ipsec10:172.28.0.20: Loading -> Full (LoadingDone)

Post upgrade I'm seeing an issue with traffic between a firewall running 26.7 and four Draytek 286x routers.

The tunnels are showing as active at both ends, traffic is reported leaving the OPNsense firewall, but I'm not seeing it arrive at the Draytek end.

Anyone else seeing similar?

Kind of, as nero355 linked, I also have some problems with ipsec after the update. Do you use VTI or tunnel mode and does any traffic at all pass thru the tunnels now? I can get traffic passing but not multicast ospf that worked before.

I tried to lower the mtu but it didnt help, hoping someone has a solution for this soon :/

Hi!

I upgraded to 26.7 and now OSPF in IPSEC dosent work for me.

I have an IPSEC VTI tunnel to a cisco router, the cisco router initiates the connection and the tunnel itself works. Since the update, OSPF just stops working some minutes and then comes back to life.

I see this in the OSPF logs - *** sendmsg in ospf_write failed to 224.0.0.5, id 0, off 0, len 120, interface ipsec10, mtu 1400: Network is unreachable

The network type is Point-to-multipoint and eveything worked before the upgrade, any clues?

Hello,

I have tried to solve this for some time now but i can't find a solution to my problem. I want to redistribute all routes except the wan address from OPNsense via FRR OSPF, the wan address is dynamic so i cant exclude a specific address, it needs to be the address of the WAN interface. In pfSense FRR OSPF (which I am in the process of moving from) there is an option called " Accept Filter" to exclude interfaces from being redistributed. Is there any similar option in OPNsense?