Topics

Ich habe mit dem aktuellen updaten von Version 26.1.10 zu 26.1.11 das Problem base-26.1.11-amd64.txz zu installieren ich vermute das betrifft nicht nur mich sondern auch alle anderen.

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.1.10 (amd64) at Mon Jul  6 06:45:04 CEST 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (11 candidates): .......... done
Processing candidates (11 candidates): .......... done
The following 11 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
bind-tools: 9.20.23 -> 9.20.24 [OPNsense]
curl: 8.20.0 -> 8.21.0 [OPNsense]
expat: 2.8.1 -> 2.8.2 [OPNsense]
ldns: 1.9.0 -> 1.9.2 [OPNsense]
lighttpd: 1.4.82 -> 1.4.84 [OPNsense]
opnsense: 26.1.10 -> 26.1.11_6 [OPNsense]
opnsense-update: 26.1.10 -> 26.1.11 [OPNsense]
os-isc-dhcp: 1.0_5 -> 1.0_6 [OPNsense]
php83-phalcon: 5.14.2 -> 5.16.0 [OPNsense]
py313-duckdb: 1.5.3 -> 1.5.4 [OPNsense]
syslog-ng: 4.11.0_2 -> 4.12.0 [OPNsense]

Number of packages to be upgraded: 11

28 MiB to be downloaded.
[1/11] Fetching lighttpd-1.4.84.pkg: .......... done
[2/11] Fetching opnsense-update-26.1.11.pkg: .. done
[3/11] Fetching ldns-1.9.2.pkg: ......... done
[4/11] Fetching os-isc-dhcp-1.0_6.pkg: ... done
[5/11] Fetching bind-tools-9.20.24.pkg: .......... done
[6/11] Fetching syslog-ng-4.12.0.pkg: .......... done
[7/11] Fetching curl-8.21.0.pkg: .......... done
[8/11] Fetching php83-phalcon-5.16.0.pkg: .......... done
[9/11] Fetching opnsense-26.1.11_6.pkg: .......... done
[10/11] Fetching py313-duckdb-1.5.4.pkg: .......... done
[11/11] Fetching expat-2.8.2.pkg: ......... done
Checking integrity... done (0 conflicting)
[1/11] Upgrading bind-tools from 9.20.23 to 9.20.24...
[1/11] Extracting bind-tools-9.20.24: .......... done
[2/11] Upgrading curl from 8.20.0 to 8.21.0...
[2/11] Extracting curl-8.21.0: .......... done
[3/11] Upgrading expat from 2.8.1 to 2.8.2...
[3/11] Extracting expat-2.8.2: .......... done
[4/11] Upgrading ldns from 1.9.0 to 1.9.2...
[4/11] Extracting ldns-1.9.2: .......... done
[5/11] Upgrading lighttpd from 1.4.82 to 1.4.84...
===> Creating groups
Using existing group 'www'
===> Creating users
Using existing user 'www'
[5/11] Extracting lighttpd-1.4.84: .......... done
[6/11] Upgrading opnsense-update from 26.1.10 to 26.1.11...
[6/11] Extracting opnsense-update-26.1.11: .......... done
[7/11] Upgrading os-isc-dhcp from 1.0_5 to 1.0_6...
[7/11] Extracting os-isc-dhcp-1.0_6: .......... done
Stopping configd...done
Starting configd.
Reloading plugin configuration
Flushing all caches...done.
Configuring system logging...done.
Reloading template OPNsense/Syslog: OK
[8/11] Upgrading php83-phalcon from 5.14.2 to 5.16.0...
[8/11] Extracting php83-phalcon-5.16.0: ........ done
[9/11] Upgrading py313-duckdb from 1.5.3 to 1.5.4...
[9/11] Extracting py313-duckdb-1.5.4: .......... done
[10/11] Upgrading syslog-ng from 4.11.0_2 to 4.12.0...
[10/11] Extracting syslog-ng-4.12.0: .......... done
[11/11] Upgrading opnsense from 26.1.10 to 26.1.11_6...
[11/11] Extracting opnsense-26.1.11_6: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Migrated OPNsense\Firewall\Filter from 1.0.4 to 1.0.5
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
You may need to manually remove /usr/local/etc/syslog-ng.conf if it is no longer needed.
=====
Message from opnsense-26.1.11_6:

--
One step ahead, one step behind it, now you gotta run to get even
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/lighttpd-1.4.84~7501b26875.pkg
/var/cache/pkg/syslog-ng-4.12.0~7e3f25272b.pkg
/var/cache/pkg/expat-2.8.2.pkg
/var/cache/pkg/opnsense-26.1.11_6~d52b7b0fde.pkg
/var/cache/pkg/py313-duckdb-1.5.4.pkg
/var/cache/pkg/opnsense-26.1.11_6.pkg
/var/cache/pkg/php83-phalcon-5.16.0.pkg
/var/cache/pkg/opnsense-update-26.1.11~3ef18a4908.pkg
/var/cache/pkg/bind-tools-9.20.24~06a130e148.pkg
/var/cache/pkg/ldns-1.9.2.pkg
/var/cache/pkg/os-isc-dhcp-1.0_6~5b8d9139ed.pkg
/var/cache/pkg/curl-8.21.0.pkg
/var/cache/pkg/bind-tools-9.20.24.pkg
/var/cache/pkg/curl-8.21.0~0e3f9b6e02.pkg
/var/cache/pkg/ldns-1.9.2~cc8eba3ed0.pkg
/var/cache/pkg/py313-duckdb-1.5.4~8d0acd924a.pkg
/var/cache/pkg/syslog-ng-4.12.0.pkg
/var/cache/pkg/expat-2.8.2~52f92df3bb.pkg
/var/cache/pkg/lighttpd-1.4.84.pkg
/var/cache/pkg/php83-phalcon-5.16.0~32c71b5484.pkg
/var/cache/pkg/opnsense-update-26.1.11.pkg
/var/cache/pkg/os-isc-dhcp-1.0_6.pkg
The cleanup will free 28 MiB
Deleting files: .......... done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
Fetching base-26.1.11-amd64.txz: ........ done
Fetching kernel-26.1.11-amd64.txz: .... done
!!!!!!!!!!!! ATTENTION !!!!!!!!!!!!!!!
! A critical upgrade is in progress. !
! Please do not turn off the system. !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Installing kernel-26.1.11-amd64.txz... done
Installing base-26.1.11-amd64.txz..../usr/bin/ld.lld: Truncated tar archive detected while reading data: Unknown error: -1
tar: Error exit delayed from previous errors.
 failed, tar error 0
***DONE***
Weiter habe ich seitdem einige seltsame Fehler bei der Intigritätsprüfung (Health Check)

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.1.11_6 (amd64) at Mon Jul  6 11:44:16 CEST 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.1.11 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.1.10 is incorrect, expected: 26.1.11
>>> Check for missing or altered base files
Error 2 occurred.
usr/bin/lldb:
sha256digest (0x9afbd73a548f72d1271c9c3625905d2843009fd594127adb5bbadf8bbecc6f4b, 0xec7d750bc27bbc44d7c670e6e085a4ae9dd593b1d71fe10c80e411ab635a305e)
usr/lib/libkvm.a:
sha256digest (0xd92e445f6712763c8c09a7a92e12f4033826d8f4d4b3de58c516bcacd5abbbc4, 0x7e2c4733982a857f007c1fc6e6edcda2196f2d493a6c4191f676d55743e6dd2a)
usr/lib/i18n/libHZ.so.5:
sha256digest (0x5438ec95a816ace6968d179e89280448489ed64de79978cf8153e525799230df, 0x80dcf8a50ce8e9f2a06af39d4dbcc8889c7bf6d1e234321cba97ac60679a75a9)
usr/lib/i18n/libUTF7.so.5:
size (9120, 9200)
sha256digest (0x2fff784e753c3b35984124294956d77a61b0a60c7343773e8a82401398ed68dc, 0x40a307fc50cbdf5bc8aa9aaa903c068874dce71ca8141efd0dbee6df12fce7e2)
usr/lib/i18n/libVIQR.so.5:
size (14440, 14088)
sha256digest (0x71b02f481bcac9221a1082e562957ca34dcbf75eacc853d2a2601d3e856f831a, 0xc3dd2674be339843356409a30866e2243e62dcb57dc154f98474c79491d97603)
usr/lib/i18n/libZW.so.5:
size (8256, 8272)
sha256digest (0x2a3590049f76309f0d06ea6b65423bb312283f27c54ecf04771132ff0e5cbe36, 0x76a25a305fb5c629c8832668c3a51b68bd80b1397bb46672030e588d914ceaca)
usr/lib/i18n/libISO2022.so.5:
sha256digest (0xca46587941ce8e9916118caaaade3acab93ca2d7b7a0d3d2b9ca0090d38e48d9, 0x79a325b016e42bc6f675a114ca89f8413fedd039a5c587e986256883b74e7629)
usr/lib/libalias_smedia.a:
size (7216, 7240)
sha256digest (0xbc79e04cd58a0f7d03455d7e2040a45da9ff95ffd6309fc68cf851e285cc00d2, 0x3494fc89280aff4d33c400ae712c34796e191214394d1d6dab58463d9a92b9d5)
usr/lib/libprocstat.a:
sha256digest (0x8677af05554104767cae4d5a0c1a770228892dcb5540ec98164f09f1ff27e621, 0x01c87ecf49b2dedf26279d5300c188d768de03bbbd360794ff613df32ac81b36)
usr/lib/libzpool.a:
size (27097712, 27098832)
sha256digest (0x3e6b58d15035dfdf27eeeef563c02fb435676f9badf23438cfe7738213380b1f, 0xe1e734b3f81ee0bf075aec05e427cad6955e3568b2e456ad1855c5141d90d499)
usr/lib/libnvpair.a:
size (149740, 149812)
sha256digest (0xbac00f093f2c5f00ecd2b7bed760e8c09bd8189979916ab626eb7004c18eea03, 0x6eb660ad78c2abf838f624b44499f5f7603e2fc5163119bf96b6b1d9bec1c0dc)
usr/lib/libprocstat.so.1:
sha256digest (0x8fa046a88d736af9f455b618df9174be289fb83396fc3f6988894a34d414dac9, 0x75e21d106b4c3ffaecd0d79b5689cd5bc0f20731af67a1756c265d6fc3091b61)
usr/include/vm/vm_object.h:
size (14025, 14006)
sha256digest (0xa5403bcab1c3eac25f2e607904533c02c74df685d84abae5f062bf23ace59819, 0x25e8407175213e3d52332c68f81c8b56758bd3dd9e5c7df2c8d69b49cb3d3053)
usr/include/sys/proc.h:
size (55340, 55496)
sha256digest (0xd537232d194203dc1b21b1ba5f2f57f1b64b0aa4bd40c823ff7e4f52d75e0b16, 0xd734301495ef1056fd891c74d97d2de98471e4ba8c8b564c98ff73ba40fc5d83)
usr/include/sys/imgact.h:
size (5280, 5492)
sha256digest (0x1f74b7709f06052648b3d5780a1061f14c28b0385e19d262531b3d35dec674af, 0xe0ea64c2e02726d475752ddf70b421d2815d7395673637d2ccfe69cdc9bb4638)
usr/include/sys/ptrace.h:
size (9934, 10418)
sha256digest (0xa71fd4ca527a14ff66ef6b5464cb422b14e44d15ac5347226c2d82da9ca87820, 0xd9c29dd066bd0f52f6b3f086197b02c042cd5e03b64d4983c54a91c8a0785693)
bin/freebsd-version:
sha256digest (0x5663276f4b94371fba908eb4148bd6469d9f18b3c5916f749a0629e79823bac4, 0x3cedb1e37b0fdec57135aa0fbccdd967db67d087425426d010e5df0ab989edf1)
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-acme-client 4.16_1
os-isc-dhcp 1.0_6
os-theme-rebellion 1.9.4
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .........
python313-3.13.14: checksum mismatch for /usr/local/lib/python3.13/__pycache__/typing.cpython-313.pyc
Checking all packages.... done
>>> Check for core packages consistency
Core package "opnsense" at 26.1.11_6 has 68 dependencies to check.
Checking packages: ..................................................................... done
***DONE***

Vielleicht werde ich jetzt zu paranoid aber in Zeiten der AI supply chain attacks und massenhaften Funde von vulnerabilities für FreeBSD kann an vielleicht nicht vorsichtig genug sein.

Ich poste auch mal im Englischen Forum.

Best regards,
Hover

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 22.7.7_1 (amd64/LibreSSL) at Thu Nov 10 18:48:17 CET 2022
>>> Check installed kernel version
Version 22.7.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 22.7.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense
>>> Check installed plugins
os-acme-client 3.14
os-dyndns 1.27_3
os-theme-rebellion 1.8.8
os-wireguard-devel 1.13
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: ........
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/io.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/os.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/posixpath.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/re.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/site.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/stat.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/threading.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/token.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/tokenize.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/traceback.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/types.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/typing.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/uu.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/warnings.cpython-39.pyc
python39-3.9.15: checksum mismatch for /usr/local/lib/python3.9/__pycache__/weakref.cpython-39.pyc
Checking all packages..... done
>>> Check for core packages consistency
Core package "opnsense" has 63 dependencies to check.
Checking packages: ................................................................. done
***DONE***

Hello Folks,

just had a look on the SSH service default configuration and was wondering why it supports so may outdated key, kex and mac algorithms.

Why not hardening it?

Code Select Expand


$ ssh-audit opnsense
[...]
# algorithm recommendations (for OpenSSH 8.0)
(rec) -diffie-hellman-group14-sha1          -- kex algorithm to remove
(rec) -diffie-hellman-group-exchange-sha256 -- kex algorithm to remove
(rec) -ecdh-sha2-nistp256                   -- kex algorithm to remove
(rec) -ecdh-sha2-nistp384                   -- kex algorithm to remove
(rec) -ecdh-sha2-nistp521                   -- kex algorithm to remove
(rec) -ecdsa-sha2-nistp256                  -- key algorithm to remove
(rec) -hmac-sha1                            -- mac algorithm to remove
(rec) -hmac-sha2-256                        -- mac algorithm to remove
(rec) -hmac-sha2-512                        -- mac algorithm to remove
(rec) -umac-64@openssh.com                  -- mac algorithm to remove
(rec) -umac-128@openssh.com                 -- mac algorithm to remove
(rec) -hmac-sha1-etm@openssh.com            -- mac algorithm to remove
(rec) -umac-64-etm@openssh.com              -- mac algorithm to remove


The argument is probably backwards compatibility, but I thought OPNsens is the firewall for the paranoid ones ;)

Maybe not like here, but in general

Best Regards,
Hover

Hey OPNsense forum,

Im pretty new her and new to OPNsense and pf as packet filter. I running a PC-Engines APU2 board for my OPNsense setup.
It divides my home office LAN from my private LAN like this:

https://pastebin.com/RYJbjsP0

       
I configured the OPNsense box to do NAT for my private and for Office LAN. I also installed WireGuard on OPNsense so the box can act as an VPN Endpoint.

What I want to do is to setup a second gateway on the OPNsense (10.0.2.254) on the LAN interface and an gateway (10.0.0.254) on the OpenWRT box so the clients can decide if they want to tunnel all their traffic via WireGurad by using the 0.254 gateway or direct internet connection on the 0.1 gateway.

Under Linux this is easy; add an eth0:x device give it a different IP address. The rest can be handled using ip / iprout2 to manage that the the second gateway uses 10.0.2.254 as gateway and this gateway should tunnel everything through 10.0.1.1 to the internet.

I tried to set up things but ended up in somehow breaking (web interface wasn't starting anymore, could not ping 10.0.2.1 anymore)  the configuration of the LAN interface on the OPNsense box, by adding a VLAN to the igb0 interface and giving that VLAN interface a different mac address.

I'm not sure how to achieve what I want on the OPNsense (Hardnend BSD) using the web interface or if there is a problem with my NIC drivers (Intel i210AT)  I have to admit.

I'm running the 19.7 version of OPNsense, because I want to run a WireGuard instance

Can some here help me on fixing my problem.

Best regards,
Hover