Messages

I have been on the Community Edition (CE) but want to reduce the chance of bugs and breaking things due to frequent CE updates. Although I want to receive security updates soon after release. It sounds like Business Edition is a better fit for me.

Can anyone advise on the best and safest way to update from the Community Edition to the Business Edition? Is there an easy, trouble free way to do it? Can you take me through the process? Or is it as simple as changing the target in the System>Firmware>Settings?

The switch is relatively straightforward and normally doesn't require a fresh installation. First, make a full configuration backup, then go to System → Firmware → Settings and change the firmware type to Business Edition. Enter your subscription key, save the settings, and check for updates. One thing to watch out for is version compatibility: your current CE version must not be newer than the latest available BE release for an in-place upgrade. I'd also recommend having local console access available just in case something goes wrong during the update.

Dear OPNSense Community,

I'm trying to use one of our Business OPNSense in transparent bridge mode in one of our DMZ. The Bridge will work until I reboot the system. The appliance is an official Deciso OPNSense DEC3842.
The topology is not so complex but more complex than what we find on internet and forums in general. It's a 3-tier environnement and OPNSense isn't used for NATing. I've tried to integrate the OPNSense to scan the traffic (IPS/IDS, CrowdSec and the firewall) between the 1st and 2nd HOP of our Networks.
Every time I restart the appliance, I have to save the bridge interface again to restore to connections behind the OPNSense. If I don't do that, I can't access the various applications, remote sessions and https interfaces. It works for about 2 or 3 days then the connection is lost again. I press the "save" button and it works again.
The online applications are working without that because they're proxied by the OPNSense, but our intern connection between the network not. What is really strange and that's why I believe that's a problem from the OPNSense, I can access the UI of the OPNSense and nothing behind (the last time), sometimes I can access some of the UIs / RDP.

I've found a second problem and I think it's an effect of this bridge's problem. If I don't save the parameter from suricata again (IPS/IDS) the logs are filled with thousands of those lines: [101142] <Error> -- bridge0: error reading netmap data via polling: No buffer space available
Some times it's written also with bridge0^. I've found something about on internet but it doesn't match my case.
I just need to save the suricata configuration and it's gone and works as it should.

The topology looks something like this: 1st Hop Router (with NAT) -> OPNSense as transparent bridge + proxies connected to some Web Apps -> 2nd Hop Router (with NAT) -> application servers etc...

It seems that OPNSense is interfering with something in the communication between the routers. I've suspected something with ARP, but the last test with some static ARP entries (neighbors) has failed. Before the OPNSense we had a Sophos XG (in bridge mode too) and it has worked flawlessly. But with the EOL it was the time to change.

The only solution for me was to save the bridge and the IPS/IDS configuration again(interface bridge+lan).

Could you please help me?
I'll go into detail, when some information is needed. But it could be a really long topic, so I made this summary.

All the best

Regards

Joel T.

The recurring need to save the bridge configuration after a reboot makes me suspect an interface initialization or configuration-application issue rather than ARP alone. I'd start by checking whether the bridge members are consistently attached to the bridge after boot and whether the assigned interface configuration is being applied in the expected order. Also check the system logs around the time connectivity disappears, particularly interface link state changes and driver or netmap errors.

The Suricata message is worth investigating separately. No buffer space available can indicate netmap buffer exhaustion or a problem with how the network interfaces are being handled under load. Since saving the IDS configuration temporarily clears it, I'd look at the Suricata/netmap initialization and interface assignments rather than assuming it's simply a firewall rule issue.

A few things I'd want to know:

Which OPNsense version and kernel are running on the DEC3842?

Are both physical bridge interfaces using the same driver?

Is Suricata configured to use the bridge interface directly or its individual physical members?

Does connectivity return immediately after saving the bridge, without restarting any services?

I'd also consider testing with Suricata temporarily disabled to see whether the bridge still loses connectivity after a reboot. That would help establish whether these two symptoms share the same underlying cause. Given that the Sophos worked in the same topology, I'd pay particular attention to differences in bridge implementation and NIC/netmap handling.