Topics

First of all congratulations with the 26.1 release and more importantly THANKS!

For me everything works as expected and I had no issues upgrading.
And for what it is worth, the entire thing feels a tad snappier as well which is not something I expected.

And here is the small request that I sneakily and totally accidentally wanted to mention :)

I don't use everything in the menu, and I expect not everybody else does either. For example stuff like the firewall->legacy rules and the services->ISC DHCP are relevant to mention these days.
It would be great if it was possible to click a button to hide (or shade) the services/features that I don't (often) use from the menu. And of course a menu button to globally override all hidden items so that everything comes back if you need to enable it / look at something you don't often look at (kind of like a favorites menu or like how "full help" works today). I am getting old and more easily confused by clutter.

Hi,

Just a little bit of feedback

1. BUG: On the first load, many widgets display "failed to load widget". If I refresh the page it (often) works.

2. BUG: The services widget does not seem to remember when I resize it (to my knowledge, all other widgets does).

3. Feature request: Would it be possible to compact the text a bit on some of the widgets (services, interfaces etc)? Less padding around text would make for a more relaxing and tidy view, and more information on screen - especially on the services widget.

4. Feature request: Widgets that can be resized does not show any clue that it can be reiszed

5. Feature request: The firewall widget has two modes, text mode and graphical "cake" mode which is not apparent - how about splitting them into two separate widgets?

6. Comment: While the new changes are welcome, I miss the old system information widget that compressed a lot of info in one widget without the need to launch multiple widgets.

7. Feature request : The underline of the headers seems to take it's own text line and consumes a lot of horizontal space. How about changing this:

header
---------
info,info,info

to this

header
info,info,info

instead?

I ran the latest update as of writing this and my opnsense box is now simply not working anymore.
All services are apparently gone and the ui only shows partly things.

I can ssh to the opnsense box and dmesg shows a never ending stream of lines with  pid+Python 3.11 with signal.4
The pid shows various numbers.
If i start unbound from the shell I can get access to the outside world and run pkg for example.

I am of the penguin kind so freebsd is not my regular environment.

Is there some way of repairing my nonsense box via the tools or do I have to reinstall from scratch?
E.g. what can I do to get the system back up to a working state from the shell??

(Sorry for lack of detail but I am writing this from my phone due to lack of connectivity)

(Ps! The box is a intel core 2 machine just for the record)

I find that quite often (several times week/day) DNS have stopped working due to Unbound being stopped as well.

Under system->general->logfiles it seems like the reason is a segfault:
<6>pid 57337 (unbound), jid 0, uid 59: exited on signal 11

It has been like this since 23.7 and also now with 24.1. For my use on this box it is not critical , but rather an annoyance.
The only thing that differs from the default is that I have enabled nearly everything on the blocklist under the DNBL drop down menu.
In addition I have also added a URL to my own blocklist that resides on a remote server in the form of "http://example.com/blocklist.txt" - that connection has been difficult at times, but I imagine a non-existing file should NOT cause any issues with Unbound, but then again that is the only thing I can think of.

As a side note - it would be great if it was possible to configure what to do if a service crash. (restart n-times before giving up, send mail, run a script (write to rs232 for example))

Hi,

Unbound seems to crash/or exit for some reason according to the logfiles.
This happens now and then, but not often. Always when you don't need it of course.

Is this a known problem? If not , what can I do to help diagnose the issue?

Hi,

I run OPNsense on a rather old core2 duo machine. I sometimes see the CPU usage peak at about 70% so what does this tell me? ... well in reality not much, but I am tempted to think that perhaps one CPU core is saturated from time ot time. My load average numbers are <1.0 which is good , but it still does not account for brief 2-3 second peaks that saturate a single CPU core.

Would it be possible to change the CPU usage bar under the system information widget to show if any CPU is saturated for a significant amount of time. The easiest would perhaps be to provide a CPU bar pr. CPU , but another alternative could perhaps be to add something similar to a "clip" indicator just like most audio programs has.

That way it would be easier to know if my system is actually saturated at times. As it is now it is not that easy especially since htop is not available when running pkg search htop as root on my opnsense box.

Firewall->Settings->Normalization

Hovering over any item under general settings such as disable interface scrub, ip do not fragment or ip random id hides the text by giving it the same color as the background color.

I use the tukan theme , but I bet there is something inconsistent with the GUI itself.

I have to do system->firmware->status->check for updates or via the system info widget in the lobby click the check or updates link.

Is there really anything that problematic with having OPNsense by itself, (perhaps once a day) check an URL to see if it's firmware version match or if there is a update available? I would much rather prefer to see in the system widget when an update is available instead of mindlessly having to click and hope there is something exciting waiting for me.

Would this be possible to add in a future update/release?

Reporting->Traffic->Graph works fine, but...
Lobby->Dashboard->Traffic widget does not display graphs on SeaMonkey 2.53.6

This
... was working in 21.1.1
... was broken in 21.1.2 , but I did not report it - hoping for it to be fixed in 21.1.3.

It all works on Chrome 88.0.4324.182 (Debian), but please test your updates for stable versions on older browsers as well. Not everyone needs or wants to run on the latest fancy stuff, and it is not fun when thins break. This is a minor problem of course, but things such as buttons not working (which was fixed with a workaround in 21.1.2) is not always fun.
Don't get me wrong - you guys are doing a great job so keep up the good work!

I upgraded by opnsense box with SSD's and decided to put /var in RAM.
If I enable all the periodic backups (rrd,dhcp leases,netfow and captive portal) at 1 hour interval it is not clear to me if this would be the same as having /var periodically saved to disk causing a unclean reboot / shutdown to result in max 1 hour of lost logs.

Apparently I am not able to edit aliases by clicking the pen like button (Firewall->Aliases->existing alias->pen icon)

I tried in two different browsers , SeaMonkey 2.54 (daily driver) and Chromium v83 with the same result. Also ran System->Firmware->Updates->Audit->Health which I assume checks that all files are ok and don't have checksum errors...
I tested this with both the tukan theme (which I use by default) and the OPNsensedefault theme.

Is it just me or do others have this problem as well?

Hi,

I just wanted to warn that upgrading to 21.1 on my old box (core 2 duo era) took a very long time (over 1 hour) after all packages was downloaded. If this is indeed expected it might be a good idea to add a warning somewhere so that people don't assume that their box is hanging.

Except from that - everything seems to be running perfectly, so congratulations to the OPNsense team with yet another great release as usual! Thanks a bunch! :)

The traffic graph widget on the dashboard does not remember history. E.g. just showing what happens from you load the dashboard and for as long as it is up. Now that chart.js is being used - will it show history in 21.1 or is this planned for future releases?

Hi,

Last time I posted something that I was displeased with the othersense fanatic picked it up and made a mess out of it so I am going to try to thread very carefully here....

From what I can remember many of the recent releases have been done just a couple of days before the end of the month. Assuming that 21.1 will be released by the end of this month , would it not make more sense to call it 21.2 to better reflect when it was released? I feel this would be more consistent with both the releases and peoples expectations.

Yes, I appreciate that opnsense is free, and this is a minor issue so I almost don't feel right complaining about this at at all , but on the other hand I have chosen to donate (and I encourage others to as well) so perhaps I have bought myself the "right" to be a tad unpleasant.

PS! Keep up the good work , opnsense is really a pleasure to use and it is getting better and better for every release it seems ;)

Howdy.

I just donated a few bucks to OPNsense so therefore I feel less guilty about posting a couple of feature requests so before I snap out of thinking that I am great - Here goes.

1. Traffic graph (dashboard):
Do not reset state if you switch to another view. How about using the [insight->totals->Last 2 hours, 30 second average] graph instead.

2. Make it possible to hide certain menu elements for less clutter.
For example GUI elements such as [Services->OpenDNS] , or [Services->DHCPv6] could be moved to a "disabled" section on the leftmost menu

3. Optionally turn off GUI animations.
It slows down a lot - especially on my browser (SeaMonkey)

4. Continous realtime interface monitoring. Split the GUI screen - showing real-time traffic on all interfaces on the lowest 20% of the screen (or somewhere else) as an example. Potentially using the same graph as my feature suggestion#1

That's it :)

I think it would be nice (and useful) if OPNssense had a topology view somewhere.
For example you could use a description linked to the MAC address / DHCP lease and build a table that describes the topology and what is connected to what.

Would this be interesting? I think it can be very useful for both small and larger networks, it could also be expandable with links to firewall rules, traffic stats, etc....

+------------+------+----------+---------------------------------+
| The ether  | WAN  | OPNsense | Switch48p_VLAN1                 |
|            |      |          +--+------------------------------+
|            |      |          |  | LAN                          |
|            |      |          |  +--+---------------+-----------+
|            |      |          |  |  | server01_file |           |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | server02_www  |           |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | workstation01 |           |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | workstation02 |           |
|            |      |          +--+--+---------------+-----------+
|            |      |          | Switch48p_VLAN2                 |
|            |      |          +--+------------------------------+
|            |      |          |  | OPT1_PUB                     |
|            |      |          |  +--+---------------+-----------+
|            |      |          |  |  | server03_file |           |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | server04_www  |           |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | server05_ftp  |           |
|            |      |          +--+--+---------------+-----------+
|            |      |          | Switch48p_VLAN3                 |
|            |      |          +--+------------------------------+
|            |      |          |  | OPT2_WIFI                    |
|            |      |          |  +--+---------------------------+
|            |      |          |  |  | rpi_ap1                   |
+------------+------+          |  |  +---------------+-----------+
| Cosmos     | WAN2 |          |  |  |               | Cellphone |
+------------+------+          |  |  |               +-----------+
| Multiverse | WAN3 |          |  |  |               | Laptop    |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  | rpi_ap2                   |
|            |      |          |  |  +---------------+-----------+
|            |      |          |  |  |               | Guest01   |
+------------+------+----------+--+--+---------------+-----------+

Hi,

Currently I have OPNsense set up with 4x deticated links for the following:

• 1x WAN for Internet access
• 1x LAN for private stuff
• 1x OPT1 for public stuff (webservers, etc...)
• 1x OPT2 for WIFI access , private/guest

LAN + OPT1 and OPT2 go to their own cheap 5 port switches which keeps the networks isolated quite well.

I recently got a bricked Netgear GS724Tv3 switch from the garbage at work and with some help from our nasty uncle Google I was able to de-brick it. This switchs has 24 ports and therefore have more than the 3 (switches) x 5 (ports) = 15 I have today - this should allow for plenty of spare ports for future setup/experiments.

I was hoping that I can replace my 3x switches with this 24 port switch since it fits cleaner in my rack and only require one power plug as well instead of the current mess with 3x power adapters and extra cabling.

I was hoping that I can somehow "partition" the switch to keep certain ports isolated from each other. From what I have learned recently VLANS is apparently the way to go, but there is a clear warning in opnsense that "Not all drivers/NICs support 802.1Q VLAN tagging properly. On cards that do not explicitly support it, VLAN tagging will still work, but the reduced MTU may cause problems. "

What sort of problems are we talking about here? corruption? complete failure? discarded packages?! How do I know if VLAN is supported or now - can I test it without creating a setup?! Do it need to be supported on everything or just one component of the networks such as OPNsense?!

I also discovered that my switch allow me to set up something called PVID which seems to be a "internal VLAN id" for the networks on the switch, but I don't understand if I need support for this on the other end somehow.

VLAN / PVID marked ports also have what I learned is called TAGGED, UNTAGGED and EXCLUDED. As I understand this the tagging/untagging bit only adds or removes a VLAN ID on the incomming/outgoing package.

As you probably have understood by now I am a complete imbecile when it comes to VLAN's and that sort of thing. I have heard about it , but I know nothing about it except from a few articles found around internet which is not very useful.

What I am trying to achieve is to simply have 3x isolated switches in one switch. E.g. set port 1-5 to network A, port 6-10 to network B, 11-15 to network C without possibility of interaction between those A,B,C's on the switch.

I would appreciate if someone can help point me in the right direction for what to read / what do do.

Howdy,

On the forums there is a rather huge search button that you have to click to open a searchbox. WHY???! There is more than enough room even on my 4:3 display to keep the search box open all the time.  It would be great if this could be open like a normal sensible searchbox and it would be good it if could use a normal font as well instead of the huge font currently used.

1st of all - thanks for OPNsense - by far better and makes more sense than a certain other sense which does not make sense anymore... anyway ...

In lobby->dashboard the system information widget shows CPU usage. In a dual CPU system it appears to show  the combined CPU usage e.g. if one CPU is at 100% and the other at 0% the widget shows 50%. That's ok , but I wish the CPU widget either showed pr. CPU or at least changed the color of the graph to RED if *ONE* CPU is at 100%.
The reason for this should be obvious - some task that can't be parallelized will hog the CPU and the widget is giving the impression that the firewall is running just fine.

The CPU graph (just like the traffic graphs) are NOT persistent and does not show any history unless you keep the lobby->dasboard up for a while - in my opinion the graphs would have been better if they showed some history.

Please consider changing this for an update / for the 19.7 series

The traffic graph in the lobby:dashboard is not persistent. If I change to another view and get back the graphs start from scratch. Please consider adding a history for the last n hours