Messages

Hi,

I recently noticed that adding a new snapshot and activating it so that it becomes active after a reboot, it feels like the reboot process is taking at least another minute or so to fully boot, I didn't exactly count but it felt longer. Is this expected to happen as in the reboot taking longer and also what is happening during the reboot when someone adds and activates a new snapshot?

Thanks,
BigFreddy

What I had in mind when I was making this post was that it would be a good idea to divide the changelog into more readable sections, in my mind, these three would make more sense: Security, Breaking Changes, Developer Notes then under them, list the changelogs that apply per each section.

I can see the value, but, traditionally, journalism was a way for digested information to be readily available in the past. There's not a lot of tech journalism still around and interested in networking projects. And we don't want to spend too much time doing blog-post analysis of things that are going on which few people will read no matter how good it is written.

We also can't stop publishing the release notes in the format we have because the development digest has the biggest value for looking for regressions.  Breaking changes are only really intended for major upgrades and are listed as "migration notes". Security issues vary wildly in scope.  You'll have links to most security issues.  Things may change on the front, but there are no concrete plans yet.


Cheers,
Franco

Hi Franco,

I noticed in the latest release this entry:

Code Select Expand

o firmware: add simple prompt to console changelog viewer
Is this anything to do with how changelogs can be viewed, meaning, you can switch to more simplified list or viewer?

Hi,

When I was upgrading firewall from version 26.1.2 to 26.1.11, I got the red pop-up window saying there were unexpected errors and to check logs. The upgrade went fine and I haven't had this message pop-up again. I was looking into the logs for a few hours and didn't find any errors around the time when that red pop-up window appeared and I also haven't had any such errors pop-up again.

However, I noticed that during the upgrade in the GUI window there were some conflicts but they were resolved, could this have caused this error to pop-up and if not, were there any issues with the updates between those two versions of OPNsense that could cause this error? I'm just trying to understand why I received the mentioned error.

Thanks

You can look up the commit, or we can omit them. I don't think omitting adds value, especially if regressions occur.

If it doesn't sound interesting it's probably just that.


Cheers,
Franco

What I had in mind when I was making this post was that it would be a good idea to divide the changelog into more readable sections, in my mind, these three would make more sense: Security, Breaking Changes, Developer Notes then under them, list the changelogs that apply per each section.

Hi,

When I was browsing logs I tried using Maximize Grid which is a new feature and I'm not sure if this is by design or actual bug. What I observed is that if I select in the standard logs window to show me 1,000 entries per page then when I click on Maximize Grid icon, the amount of entries reduced to maximum of 40 entries by default and not the value that I selected, in this instance it was 1,000 entries per page.

Any idea if the shown amount of entries per page in Maximize Grid can be adjusted?

Thanks

Hi,

Does anyone know if you can reorganize the changelog list you get during the updates and upgrades to be more readable either natively or via some sort of plugin? Most changelog entries appear to be for developers and I'm only interested in security and changes that can break my setup, changelogs like:

interfaces: provide "uuid" in legacy_config_get_interfaces()

or

o src: bind: lookup local address in current FIB if '*.bind_all_fibs' is active

or

o src: net: add fib-aware ifa_ifwithaddr()

Don't tell me much and seems to be more directed for developers or people who contribute into the codebase of the firewall.

Thanks

Hi,

I seen online that there is a new Unbound DNSSec Validator vulnerability prior to version 1.26.1, does anyone know which version is OPNsense using and if this vulnerability was patched yet?

Thanks 

Hi,

The major new feature in version 26.7 is the new firewall rules and I'm still used to the old way how firewall rules were working. Does anyone know if there is or can recommend any type of in-depth write-up or YouTube video explaining the differences and what's new and how it works now compared to the old way? I tried searching for it on YouTube but couldn't really find much.

Thanks

Does the said monitoring infrastructure would give an option to deliver alerts when the S.M.A.R.T percentage of usage is below a certain treshold via various messaging apps or SMS messages?

Scrutiny can send notifications to Uptime Kuma, which in turn supports dozens of different notification channels. Alternatively two channels named "Shoutrrr" and "Apprise", respectively seem to be builtin. I use Uptime Kuma - another Docker container, but once you have the fundamental infrastructure in place, a container more or less is cheap.

So, coming back, Raspberry Pi + Scrutiny should be efficient as a monitoring solution?

A monitoring solution for what? Scrutiny only monitors HDD/SSD drive and Zpool health. Not CPU/system temperature, memory, disk usage, fan RPM, reachability, ... etc. There are other tools for that. I am not aware of a single one stop solution that does everything in one product. But a Pi with Linux is a good platform to start with, IMHO.

Thanks for the recommendations, I checked out Uptime Kuma and it looks like a cool monitoring tool that's free to use. That's what I meant, the monitoring of HDD/SSD drive and Zpool health.

You are welcome,

Its really nice, and seamless to integrate. Basically I have all my LCXs, and whole network (expect mikrotik) in there.

Pic Of OPNsense ZFS pool monitoring.


Regards,
S.

This looks quite useful, mind sharing any links or insights how you setup and built the dashboard? I presume that dashboard is hosted on a spare device with some sort of agent installed on OPNsense?

I seen that post but the mentioned solution requires a second device to setup where I'm looking for something that could run directly on the same firewall itself and perhaps display S.M.A.R.T readings via the dashboard. I did further research online and had trouble finding such monitoring plugin, it's really strange why there is no third party plugin to achieve this, obviously I don't know the limitations around it but generally speaking, it's something that should be possible to do.

Tools to do this exist and they all require Docker. Also is your OPNsense your only device with an SSD which would benefit from monitoring the drive's health?

I mean, if your network consisted of a single LAN, a laptop, a printer, a tablet and a phone, you would probably be running a Fritzbox and not OPNsense? You don't have any virtualising host (hypervisor?). No leftover RasPi?

I can really recommend building yourself dedicated monitoring infrastructure and not running Upmtime Kuma, Scrutiny, Prometheus, Grafana, LibreNMS, Elastiflow ... on the firewall.

Does the said monitoring infrastructure would give an option to deliver alerts when the S.M.A.R.T percentage of usage is below a certain treshold via various messaging apps or SMS messages? I do have a spare Raspberry Pi kicking around that's quite old so not sure if that would be suitable. So, coming back, Raspberry Pi + Scrutiny should be efficient as a monitoring solution?

So, if you have a config file from the time when UFS was active but you restore it at the time when ZFS is active, it technically shouldn't cause any issues?

No, none at all. The OPNsense configuration is not concerned with the underlying file system. There is even a bootstrap script turning a stock FreeBSD installation into an OPNsense - should you want to install on a RAIDZ2 topology or whatever ...

Thanks for confirming :)

Monitoring is not very comfortable in my opinion, but maybe one of the available full blown monitoring tools also found in the plugins has integration for disk health.

Second thread today in which I mention that I already wrote up an easy to follow HOWTO with all bells and whistles included. Extra files on OPNsense are kept to a bare minimum and do not intervene with or might be deleted by an OPNsense update.

https://forum.opnsense.org/index.php?topic=48101.msg242617#msg242617

I seen that post but the mentioned solution requires a second device to setup where I'm looking for something that could run directly on the same firewall itself and perhaps display S.M.A.R.T readings via the dashboard. I did further research online and had trouble finding such monitoring plugin, it's really strange why there is no third party plugin to achieve this, obviously I don't know the limitations around it but generally speaking, it's something that should be possible to do.

Hi,

I have seen that ZFS offers snapshots feature as well as from my understanding doing research on this topic, ZFS requires slightly more RAM but is way less prone to corruption upon unexpected power loss. My question is about restoring the config file and I thought I would check just in case.

So, if you have a config file from the time when UFS was active but you restore it at the time when ZFS is active, it technically shouldn't cause any issues? I presume that the config file only contains configuration data related to the firewall and its settings and there is nothing in the config file about the file system that is currently used?

Thanks

Hi everyone,

I was recently thinking about drive storage and how it is used in OPNsense, how often the drives should be changed and how much data OPNsense writes to it which I don't have a clear answer on. What comes with this topic is drive storage failures and my question is how do you guys handle that part of the firewall?

What's your philosophy or approach to drives used in OPNsense? Do you monitor drives for failures, if so, how and if not, how do you make sure that the failure of the drive doesn't cause any issues or opens up the firewall on the WAN side upon the failure?

Let's discuss about this topic and everything that comes with it.
Thanks