All appears to be working, so low priority issue but... on boot it seems to spend an extended amount of time on "Generating /etc/resolv.conf" maybe 1-2minutes, WAN is down during this time.
I don't see any errors, once it gets passed that the wan comes up, but boot sits on "Reconfiguring IPv4 on em0" and again on Reconfiguring IPv6 on em0 for a similar amount of time/delay.
I'm not well versed in the shell but if there's a log file or something that can help with debugging I'll give it a go.
As of 02/19/2020 have upgraded to 20.1 and have had same issue with long delays during boot still with these items. Works fine after boot though.
Running 18.1.12 on generic hardware, recently (sat 7/21) updated from 18.1.9 that was running fine for a month or so. Well, Just a few mins ago users (ie, my family, this is a home / small business deployment) noticed that websites were not responding, quick diagnostic showed I wasn't getting DNS resolution. I logged into the web interface and went to Services \ Unbound DNS \ General and the service start button on the top was Red. I clicked the "play" button and it started and DNS was working fine. I haven't logged into the router and am the only one with access so it wasn't stopped manually.
I then went into the system \ log files \ general and didn't see any error messages but the last one pertaining to DNS was Jul 26 17:29:21 opnsense: /usr/local/etc/rc.dyndns: Dynamic DNS: (Success) IP Address Updated Successfully! which would be a different service so I believe it would be unrelated.
Is there any other log files, perhaps from the shell in var \ log that I can review that might show why the DNS service stopped functioning? I'm not super versed in Unix so might be a simple thing I'm missing.
Sorry to bump an old thread, I'm on 18.1.9 and followed the mobile https://wiki.opnsense.org/manual/how-tos/ipsec-road.html guide and finally got to where I can connect to my LAN and access local IP's but I can't access any external sites from the mobile device. Been messing with firewall rules and the log isn't showing any deny activity... are there any known issues the documentation doesn't cover to assist?
I've got alerts setup so that I get notified when a wan interface has high latency or goes down. I was curious if there's a way to get the IP Address of the WAN included when it comes back up? 99% of the time it's the same IP but it'd be nice to know if the ISP changes it.
I know I can use Dynamic DNS, I'm not sure I want to expose that I have services running on my network by using that option.
Not a big deal, but I figured someone may know more about scripting than I do that could point me in the right direction if it's even possible.
Thanks, I was unable to get an ipsec vpn working with an IOS device using the documentation / guide and this was the only obvious setting that was different. There were a few others that I noted (such as the need for setting a user permission that changed in 18.x) but I searched and found and tried alternatives for all else so far.
Do you think that needing to be "off" is an issue or, if not, I can do some more digging. I may also try the other "OpenVPN" guide but was preferring to use a VPN that is native to the iOS mobile platform rather than needing to install a 3rd party app on all the devices.
Finally getting around to trying out a VPN setup, and for my needs IPSEC is what I wanted to use. Following the guide https://wiki.opnsense.org/manual/how-tos/ipsec-road.html when I get to the Phase-2 section it suggests setting the PFS Key Group to "Off" however, there is no "off" option available in my screen. (Under VPN \ IPSEC \ Tunnel Settings \ Phase 2).
I triple checked the other settings were all matching and I'm not sure if that value is going to affect the final results yet, but figured if I'm not doing something wrong I'd post here for documentation update awareness?
I just updated from 17.x to 18.1.2 today and all seems well. Props to all those who worked on this project!
2 Questions:
1) Is there any way to adjust the VGA console resolution? I have tried vidcontrol -i MODE to list alternative modes and none appear in the results (I just the column headers for the modes and nothing else). I have an intel celeron J1800 based device with VGA output. My LCD monitor is aliasing the text pretty badly so it's difficult to read when I do need to use it, regardless of whether or not I use EFI Console or VGA Console in the System: Settings: Administration for primary console and Use the virtual terminal driver (vt) is enabled. I don't want to break future upgrade path by messing with the kernel / boot configurations, but perhaps there is something I missed that may be worth looking into. I'm willing to experiment a bit if it's not too crazy.
2) On a similar path, is there any way to leverage my local VGA console to show log messages or system health / statistics without logging into the console as root and running something like systat -ifstat? I looked into creating a new user account but it seems like I'd need to assign admin level accounts to login to the local console (This is a controlled / personal install and I'm not all that worried about physical security, but I am aware of the risks). Maybe there's another way I'm not familiar. Perhaps best to just leave it alone? Just had to ask as I'm curious.
Overall I'm happy with this purchase and would recommend the system to others for small business/home-office use. I have it running as a multi-wan failover only scenario.
Prior to this build I was running my dual-wan setup on an ASUS RT-68u with Merlin firmware and was having a lot of issues with failover and DHCP from the cable-ISP modem. Prior to that I was running on an ALIX 2d3 for quite a few years and "the other"-Sense which actually worked wonderfully until my ISP speeds were upgraded-increased beyond what the aging hardware could handle. Once I was above 75Mbps the Alix platform would stall during heavy downloads... causing my to upgrade to the ASUS router as a stop-gap until I could afford to build something more current.
More Details:
I am not affiliated with the manuf nor do I sell these devices. This was my first purchase from ALIExpress so I was a bit hesitant to try it out but I was getting tired of the issues with RT-68U and really liked the features and price point. The product arrived very quickly to the US East Coast, about 7 days after I ordered. I configured it with 4GB RAM and 32GB SSD so about $14x.00 USD total. The device came preinstalled with W7 on it, which I tested out just to see how it ran and was fine before I wiped it clean. I then installed OPNSENSE 17.7.5 VGA version from USB. It took a bit of reading to find the right way to build the USB installer image, dd didn't work but Etcher did. Also, I had to plug the USB directly into one of the two available USB ports for it to recognize as a bootable device in the UEFI (vs plugging it into a USB hub). Why did I use a hub? I thought I might need a mouse so I needed USB KB, USB Mouse, and USB Flash drive but it turns out the Mouse didn't work with the installer anyway so I just needed one port for KB and the other for the flash installer.
After getting OPNSENSE installed it recognized the 4x Intel GIGABIT ports and the rest of the configuration went smoothly. I updated it to 17.5.7 and ran it at that version, best uptime was about 24days before I ran into some issues I posted about in another thread, but I've since sorted out and am on 17.7.11 with 3.5 days uptime now.
Versions OPNsense 17.7.11-amd64 FreeBSD 11.0-RELEASE-p17 OpenSSL 1.0.2n 7 Dec 2017 Updates Click to check for updates. CPU Type Intel(R) Celeron(R) CPU J1800 @ 2.41GHz (2 cores) Load average 0.43, 0.35, 0.29 Uptime 3 days 17:19:16
Some things I would note: 1) I haven't been able to get the serial com1 port to work yet, not sure if it's a hardware issue, cable issue (RJ45-DB9), or OPNSENSE is just not outputting secondary console to com1. I don't need it enough to troubleshoot it yet... but I've got it on my to-do's to sort out. 2) This CPU does not have AES-NI instructions so it may not work with future FreeBSD based router software updates. One of the reasons I've gone with OPNSENSE is the hope that they will continue to not require advanced HW on hobbiest/prosumer installs. 3) The system runs a bit "warm" I would say. CPU Temps are reported at 67-71deg C in my AC office. That appears to be within spec for this platform. There isn't any MB headers for a CPU fan nor is there a lot of clearance between the heatsink and the top of the case to add one... just fyi in case that is a concern for anyone. 4) Power usage is low, performance meets my requirements, have a high-tech family with lots of devices streaming media and gaming and have not had any issues yet. CPU and Memory utilization have not been a concern but I haven't done any advanced functions yet with proxy, malware filtering, etc though. 5) The Power connector and VGA header is on one side of the box and the ethernet ports are on the opposite side making cable routing a bit of a hassle.
Anyway, that's about all I can think of for now, I'm still fairly new to OPNSense community and I'm not sure I can offer any guidance to others but I'm happy to try.
Well, I was having a problem with my VOIP so I initiated a reboot and the system was stuck but eventually restarted... upon which time the VGA console seemed to get stuck in a loop of TAR messages, corrupt file, etc. So I ended up reinstalling from 10.7.5 scratch, restoring my backup configuration, and tweaking the settings to get it back to where it was since the last backup. I am now back on 10.7.11 and we'll see if problems reoccur.
Thanks, unfortunately while trying to get NAT port forwarding working I created, modified, and deleted variations of one rule multiple times (while trying to sort out an issue with connecting inbound) which means I don't have a backup from before the 17.7.11 update was completed to restore to. [Basically I was trying to port forward 25565 (minecraft server for my son and a friend to use) from outside to a host inside the network but wasn't able to get it to work on a single inbound port, the client seems to randomize the requesting port # so the only way I could get the rule to work was to accept any inbound port to the Server IP and direct it to the internal host on 25565. But that's another issue not worried about right now. (FWIW I only have 3 rules in NAT right now, one for the default anti-lockout, one for a VOIP, and the disabled Minecraft rule.) ]
If I still have issues my ultimate plan will be to fresh install using the older code, I was just hoping to get some more clues as to the state before the crash but wasn't sure which logs to look at and if the circular logs are written to disk regularly by default or if I have to specify that somewhere?
As I noted the system was rock solid for weeks before the update so I'm pretty confident the hadware is good and it's likely software related. If I have issues after reverting to an older version I'll give memtest and other HWDiags a shot.
Today while monitoring the VGA console I saw errors, " swap_pager_getswapspace(2): failed" but swap space (<25% used) and memory usage (<15%) are very minimal and disk space is plentiful. I ran TOP and sorted by Size and didn't see anything strange but there could be something there: PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 64518 root 1 20 0 1093M 7912K select 1 0:01 0.02% sshd 53790 root 1 20 0 1067M 2572K select 1 0:00 0.00% sshd 3308 root 1 20 0 1060M 2240K select 1 0:02 0.00% miniupnpd 10051 dhcpd 1 20 0 1057M 1660K select 1 0:12 0.02% dhcpd 60776 root 1 20 0 1054M 3752K pause 0 0:00 0.00% csh 65272 root 1 20 0 1054M 2804K wait 1 0:00 0.00% sh 7922 root 1 52 0 1054M 764K wait 0 0:12 0.00% sh 46530 root 1 20 0 1053M 1364K bpf 1 2:07 0.11% filterlog 29043 _dhcp 1 20 0 1051M 1280K select 1 0:00 0.00% dhclient 24559 root 1 52 0 1051M 1116K select 1 0:00 0.00% dhclient 20379 root 1 20 0 1051M 1348K select 0 0:41 0.04% syslogd 62521 root 2 20 0 1051M 1252K piperd 0 0:00 0.00% sshlockou 79599 root 1 20 0 1051M 2304K select 1 0:05 0.01% ntpd 53240 root 1 20 0 1049M 1336K select 0 0:19 0.02% apinger
So far it hasn't locked up yet today but it hasn't quite been 24hrs since the last time, about 3hrs to go. I also disabled the NAT rule I created and set NAT outbound back to Automatic from Hybrid. That is pretty much the same config I had before the update to 17.7.11 short of "deleting" the rule, rather than disabling it. I'll report back either way and advise.
I'm trying to figure out what's causing a strange crash behavior since I upgraded firmware and packages/etc a couple days ago. I also was setting some NAT Port Forwards around the same time so it could be that, disabling those for now... but the symptom is that I lose access to the GUI, SSH, and local console are all frozen. Some internet services will keep running, for example I could still connect to one PC via team viewer and it could still get on the internet but other devices were offline.
Both crashes happened around 11:30 EST based on a gap in services in the System Health screen.
I had 23days of straight uptime prior to the upgrade 2 days ago and all I adjusted were firewall rules in NAT to enable port forwarding.
Anyway, I don't think anyone will be able to offer any advice on what to do to fix the problem, but what I was looking for was advice on what log files I can review that will go back far enough that I can see what happened prior to the crash OR if there's something I can enable in settings such that it'll archive log files periodically so I don't lose them on a reboot?
Thanks in advance.
[Resolved] System crashed during a reboot, reinstalled software from scratch and seems to be working fine. Not sure if upgrade from web interface may have caused an issue or if internal SSD had errors but there was data corruption issues after reported. I have had close to 4 days uptime since the last reboot after the reinstall. After I did the base install I did all the updates from the shell/ssh login and everything is on the same version as it was when I encountered the issue above. [/End Update]