Topics

this is an issue, i identified for the 1st time a few months ago on 25.7.xx, but it did not solve with 26.1.

i use ISC DHCPv4 to provide IP addresses to devices in my local networks.
once a device has attached for the 1st time, it gets an IP from the pool. as pool IPs are configured in my setup for minimum rights, this is only temporary then.
as soon as i see the MAC of the new device in OPNsense, i configure it to a static IP, to add it to the appropriate group, to define its access rights to internet and other local networks, handled by OPNsense. this also allows me to access the device (expecially for IoT stuff) by IP.

all i need to do to get things working is disconnect/reconnect the device, so that it gets its configured IP address.
this has worked fine like this for years now.

for a few months now, i recognized that, when i detach/attach a device to get it working, it gets the new IP as expected, but it is shown as inactive in the leases.
and although the firewall is configured for this IP, i get no data through.
whatever i try, it still shows as inactive.

i'm not 100% sure, but it looks like for some reason, the device is not added to the arp list.

the only solution i found so far (after a few hours of analyzing the problem) is to reboot opnsense. after a reboot, it all works fine.

it looks to me like this issue has started with one of the updates for 25.7.


i actually use OPNsense 26.1.2-amd64 which still shows this issue.

any idea what's going wrong?

regards
bongo

i added some new devices (shelly) to my network. there are already quite a few of these devices running for a long time without issues.
so the new devices are connected exactly the same way as the old ones are and all configuration is the same.
the new devices connect to the network without issues and get the IP address as configured in opnsense under services DHCPv4, but when checking the leases, they all show as 'offline'.
as long as i am within the same LAN as the devices (LAN1), i can access them without any problems, but when i try to access them from my other LAN (LAN2) through opnsense, they are not accessible (this works fine for all other shelly devices in LAN1). i am quite sure that my configuration is correct, as i just added the IPs of the new devices to the existing group.
with packet capture on the interface, i can see that the packets to access the devices, sent from LAN2, pass the interface of LAN2 but never appear on LAN1.
the 2nd issue is, that the new devices try to access shelly cloud to do a firmware update, but they are not able to connect to the internet.
i 1st thought that i have some kind of routing issue on opnsense, but now i'm qite sure that the reason for the issues is, that opnsense thinks that the devices are offline (as shown in the leases list of DHCPv4).
so the question is: why does opnsense think that these devices, it gives an IP address to, are offline?
btw: it's not just 1 shelly device. i have this issue with several devices of different type, so i do not assume a defective shelly.
thank you for any advice on solving the issue!

my actual version is OPNsense 25.7.11_9-amd64.

i have a setup with multiple LANs.
now i have a device on LAN_A (subnet A) which needs to send a UDP packet to the broadcast address of LAN_B (subnet B) port 13111, so that multiple devices on LAN_B, listening on port 13111 get the packet.
i tried a lot, but so far, i could not get the packet to LAN_B broadcast address port 13111.
how exactly do i need to configure OPNsense for this?

i was able to send the packet to a specific address of LAN_B, but for broadcast, this did no work so far.

i installed WireGuard VPN on my phone and configured OPNsense accordingly. when monitoring port 51820 traffic on my OPNsense uplink, i can see incoming packets from my phone to the WireGuard server.
once my phone enters my local wifi network (which connects to the internet over OPNsense), i can see that port 51820 packets are sent from my uplink to IP 83.219.121.165, and then come back from IP 83.219.121.165 to my uplink to be forwarded to my WireGuard server in OPNsense.
looks quite strange to me. does this mean that all my VPN traffic is first sent to IP 83.219.121.165 (which seems to be somewhere in russia) and then comes back to me?
looks to me like a misconfiguration. right?
how should i change my configuration to avoid this?
thanx for advise!
regards
bongo

as i have persisting issues with OPNsense (https://forum.opnsense.org/index.php?topic=44197.0) i wonder if there is an easy way to revert to a former version of OPNsense without losing any configuration and with no unwanted side effects.

if yes, how exactly do i need to do this to be risk free?

thank you very much!

2 days ago, i updated to OPNsense 24.7.9_1-amd64.
since then, my internet connection stops working after about 12-24h of working fine.
i could not find out so far what's the reason. everything looks fine when i log in to OPNsense. but what i've seen is, that Interface/Diagnostics/DNSLookup does not work. it answers with a socket error then.
the restarting of unbound service did not solve the issue.
the only thing that seems to help is to reboot the firewall.
before i updated to the latest firmware, i never had such issues.
anyone else having this problem?

when trying to add a new device, i tried to do this according to the scheme i always did it so far.
unfortunately, this seems to be no longer accepted without obvious reason.

my scheme is:
<device type, 1 letter>_<device name>

as an example:
W_MyWifiDevice

this is not accepted and results in the message "The name must start with a letter or single underscore, be less than 32 characters and only consist of alphanumeric characters or underscores.". i think this is fulfilled.

but using
WW_MyWifiDevice
or
_W_MyWifiDevice

is accepted.

i'm running
   OPNsense 23.1.1_2-amd64

is this a bug and will this be fixed?

thanx!

whenever rebooting OPNsense (running on a pc x86 hardware), i get a few lines of
"sending datagram to 10.1.1.93:53 failed: Invalid argument".

since i updated to OPNsense 22.7.6-amd64, this message is now repeaded for a few pages instead of just a few lines.
where does this message come from? can this just be ignored?

10.1.1.x is one of my local networks behind OPNsense and 10.1.1.93 is within it's dynamic DHCP range, but there's no device with this IP address. so i really wonder what OPNsense tries to do...

i had to reinstall opnsense today because of a broken update. so now i'm on the latest version again.

as far as i remember, so far, when logging out from opnsense's web gui, the login screen has been shown.

but now, on logout, the browser shows:

Fatal error: Uncaught Error: Class "phpseclib3\Crypt\Common\AsymmetricKey" not found in /usr/local/share/phpseclib/Crypt/RSA.php:73 Stack trace: #0 /usr/local/etc/inc/certs.inc(34): require_once() #1 /usr/local/etc/inc/config.inc(41): require_once('/usr/local/etc/...') #2 /usr/local/www/guiconfig.inc(39): require_once('/usr/local/etc/...') #3 /usr/local/www/index.php(31): require_once('/usr/local/www/...') #4 {main} thrown in /usr/local/share/phpseclib/Crypt/RSA.php on line 73

this looks similar to the message i got in the console on boot, when booting has crashed after the broken update.

so i wonder why i get this message in the browser on logging off from opnsense.

- is this usual behavior with the latest opnsense version?
- is this a severe issue?
- will this be fixed with the next update?
- do i need to do anything else but waiting for the next update?


-

opnsense läuft bei mir auf einer pc hardware.
alle paar wochen mal führe ich das update aus, was bislang immer problemlos funktioniert hat.
heute hab ich wieder mal alle anstehenden updates installieren lassen, und nach dem automatischen reboot war opnsense nicht mehr verfügbar.
auf dem angeschlossenen bildschirm sieht's beim booten eigentlich ok aus (soweit ich das mitverfolgen kann). das erste was mir suspekt erscheint ist das "configd socket missing" gefolgt vom "error in early script 'templates'".
dann später noch das "CARP event system: Error (255)"
und zum schluss scheint's noch irgend ein key problem zu geben.
ich kann mit diesen meldungen nicht wirklich viel anfangen.
was hab ich da falsch gemacht und wie komm ich aus diesem schlamassel wieder raus?

i ran update today (did it last time  about 2 months ago) and after updating, opnsense boots with an error message i cannot interprete (see attachment).
how can i fix that?
i actually have no more internet accesss...but i need it for working...

some time ago i reported a "swap issue" shown on the screen of my OPNsense pc when it stopped working, a few days after updating to 22.1.

in the mean time, i tracked the memory usage of OPNsense.
after a reboot, memory usage is about 40% (of 8GB installed). with each day, memory usage rises by about 10%.
so after a week, it seems to reach 100%.
in this situation, i am no longer able to reach the internet from any machine in the lan. i'm also no longer able to reach the OPNsense machine.
on the screen attached to OPNsense, i couldn't find any useful info. so i tried to log in locally, but after typing username/password, the OPNsense machine played dead.
i was also not able to reboot in a controlled way. the only way out was a power cycle.

this problem started when upgrading to 22.1. i never had such issues before.

i'm running OPNsense on a pc hardware with 8GB memory and an SSD.

is there any known issue resulting in this memory leak?
how shall i proceed?
the only thing that works for me so far is to reboot every few days.

about 2 weeks ago, i updated from 21.7 to 22.1.
i actually run the latest version, i.e. all updates are installed.
so far, everything worked fine, but this morning, i was no longer able to reach the internet from the local lan.
i was also not able to login to the OPNsense, i.e. the ip address of the OPNsense router did not answer.

when looking at the screen attached to OPNsense (it's running on PC hardware), i've seen lots things that got killed because of a swap issue (i unfortunately did not take a picture).

i tried to do a controlled reboot, but was not able to shut down the machine. so all that helped was to press the reset button.

anyone else having such problems?
any idea how to avoid this?

thanx for your help!

i know, this has been discussed before, but i couldn't find the perfect answer.

i'm actually running 21.7 on a pc hardware, equipped with just an ssd where just OPNsense is installed and running, as well as a few network cards.
before updating to 22.1, i would like to create an image copy of the whole disk, which would allow me to get back to 21.7 asap if i recognize any issues with 22.1, as it is essential for me to have a working internet connection.

i think the best way to do so would be to either attach an usb stick or an usb disk drive which allows to boot from, and access the built-in OPNsense ssd to write an image copy to either an usb stick or a dvd.
if something fails, i could just again boot from this usb stick or cd and restore the generated copy back to the built-in ssd.

what's recommended to do so and is there a step-by-step instruction on how to do it?
or is there a better way to get a copy of the whole system?
or what's the best strategy to always have a fall-back solution at hand if something fails?

aktuell verwende ich OPNsense 21.7.7-amd64 und bislang lief das eingentlich recht stabil.
seit 2 tagen hab ich nun das problem dass ich von den angeschlossenen clients jeweils plötzlich keinen internetzugriff mehr hab.
die einzige möglichkeit das problem zu lösen ist dann jeweils ein reboot von OPNsense.

ich hab nun versucht die sache zu analysieren und hab wohl die ursache für den fehlenden internetzugriff gefunden, sowie eine möglichkeit das problem zu reproduzieren:

mit interface/diagnostics/dns lookup krige ich im normalfall die antwortzeiten des lokalen DNS servers, sowie der 3 eingetragenen externen DNS server.
sobald das problem jedoch auftritt gibt's keine antwort mehr von 127.0.0.1 (siehe bilder im anhang).
für mich sieht das danach aus als dass unbound DNS nicht mehr funktioniert.
in der folge hab ich versucht, unbound zu restarten oder zumindest mal zu stoppen. üblicherweise dauert sowas ja maximal ein paar sekunden. in diesem zustand dauert restart oder stop jedoch bis in alle ewigkeit...
auch darauf scheint also unbound nicht mehr zu reagieren.
die einzige möglichekit unbound wieder auf die beine zu kriegen ist ein reboot von OPNsense.

zwischenzeitlich hab ich nun auch den auslöser des problems gefunden. damit kann ich's problemlos reproduzieren.
ein zugriff vom angeschlossenen client aus auf die url

https://map.avnet.com/NzMwLU5TVC05ODgAAAGBFA1NilLbyUEK3gAZrRcq_H1vQSUw6YKLgiaWywfAnsO3q__MfAu5OYc9BbiQVI9hOk_Ve64=

reicht und unbound DNS stellt sich tot.
das komische ist bloss dass ich diese seite seit anfang dezember regelmässig besucht habe und nie ein problem auftrat. seit 2 tagen scheint dieser aufruf jedoch meinen DNS zu killen.

die kurzfristige lösung ist natürlich diese URL nicht mehr aufzurufen, aber ich befürchte dass dies nicht das letzte mal sein wird dass dieses problem aufgetreten ist. es werden wohl weitere problem-URLs folgen, mit denen ich's dann aber wohl nicht so leicht reproduzieren kann. aus diesem grund möchte ich das problem lieber gleich lösen.

leider habe ich keine ahnung wie ich nun weitermachen soll...
muss ich in der OPNsense config irgendwas ändern oder handelt es sich allenfalls um einen bug in unbound?

schon mal vielen dank für euer kompetente hilfe!

i am actually running OPNsense 21.7.7-amd64 which was running quite fine so far.
for 2 days now, i notice the problem that suddenly, there is no more internet access.
the only way to recover is to reboot OPNsense.

i have analyzed the issue and i think i found the reason for the dead internet access as well as a way to reproduce it:

when doing interface/diagnostics/dns lookup, i can see that while this looks fine before the issue. but after accessing this URL, there is no more DNS response from 127.0.0.1 (see attachments).
this looks to me like unbound DNS has stopped working.
so i tried to restart or stop/start unbound DNS, but at this time, this does not work anymore.
while restarting unbound under normal conditions may take a few seconds, restarting or stopping does not seem to be possible anymore after the issue. this operation seems to take forever. so the only option to get out of the desaster is to reboot OPNsense.

and then i found a way to reproduce it. accessing the url

https://map.avnet.com/NzMwLU5TVC05ODgAAAGBFA1NilLbyUEK3gAZrRcq_H1vQSUw6YKLgiaWywfAnsO3q__MfAu5OYc9BbiQVI9hOk_Ve64=

seems to be the source of all evil. while this was no problem so far, for 2 days now, this seems to kill unbound, as soon as i access this url.

the short solution for sure is to no longer access this url, but i'm quite sure that there will be more url's like this killing my DNS server, but then i probably won't be able to reproduce. that's why i would like to solve this issue as soon as possible.

unfortunately, i have no idea on how to go on now...
do i need to reconfigure something or is there a bug in unbound resulting in this issue?

thanx for your help!

when trying to access another computer in the same subnet by it's name (from within windows explorer), this is very unreliable:
- sometimes it works fine
- sometimes i need several retries
- sometimes i need to wait for several minute retrying again and again
- sometimes, it does not work at all
accessing the computer by it's IP address instead seems to works fine.

so this looks like for some reason, local machine names are not translated to IP addresses reliable. i have this issue since i use opnsense.
probably, i forgot to set a tick somewhere to let unbound dns translate host names in the local network.
unfortunately, i cannot find where to enable it.

today, i updated from 20.7.8 to 21.7.5.
all updates of the production release are installed now.
unfortunately, when looking at the dashboard, openssh keeps red and cannot be started.
i don't know if this will be a problem for me as i do not really know what for openssh is used in opnsense. i tried to start it, but when doing so, nothing happens and openssh keeps red.

do i need to care about this and if yes, what shall i do?

thanx for any help!

my OPNsense was working without any issues for month...until a few days ago.
when recognizing that i have no more internet access, i restarted OPNsense.
since then, Unbound DNS stops working regularly (turns red on the dashboard) and i need to manually restart it. this happens several times a day. never had this issue before.
what might go wrong?
my actual version is:
OPNsense 20.7.7_1-amd64
FreeBSD 12.1-RELEASE-p11-HBSD
OpenSSL 1.1.1i 8 Dec 2020

ich bin im moment am debuggen eines NTP clients, welcher die zeit vom OPNSense NTP server bezieht, und bisweilen nicht synchronisiert.
nun habe ich festgestellt das der NTP server auf OPNSense bisweilen nicht antwortet.

wenn ich im sekundentakt (ich weiss, das macht nicht wirklich sinn, aber ist nun aktuell der testcase) auf port 123 von OPNSense zugreife kriege ich ca. 12x die aktuelle zeit, danach bloss noch "morgens um halb acht am 7.2.2036".
packet capturing hat gezeigt dass ich bei den ersten 12 zugriffen eine antwort von OPNSense krieg, danach jedoch nicht mehr.

hat da OPNSense ein problem oder muss ich irgendwas konfigurieren damit OPNSense meine zugriffe nicht blockt?