Topics

[2026-04-10T07:35:41-04:00Errorwireguard/usr/local/opnsense/scripts/wireguard/wg-service-control.php: The command </usr/bin/wg syncconf 'wg1' '/usr/local/etc/wireguard/wg1.conf'> returned exit code 1 and the output was "Name does not resolve: `mydomain.com:1234' Configuration parsing error"]

I just upgraded to 26.1.6 which required a reboot. When my opnsense router came back online, my Wireguard tunnel was not working. Looking at the logs:

2026-04-10T07:35:41-04:00Errorwireguard/usr/local/opnsense/scripts/wireguard/wg-service-control.php: The command </usr/bin/wg syncconf 'wg1' '/usr/local/etc/wireguard/wg1.conf'> returned exit code 1 and the output was "Name does not resolve: `mydomain.com:1234' Configuration parsing error"

Restarting the Wireguard service fixed this. I'm using Kea DHCP and I'm using Unbound for DNS but it appears that Wireguard was perhaps started before DNS could start. "Renew DNS for WireGuard on stale Connections" Cron does not fix this because the service never successfully started.

I'm not sure whether this regression was introduced in 26.1.6 or one of the last few versions that didn't require an OS reboot. I've never had this issue before on this router for the last few years until this recent OS reboot

Just switched everything over from using ISC DHCP to KEA DHCP. I noticed one annoyance.

Assume IPv4 only and a 1 hour DHCP lease for both ISC and KEA:

In ISC DHCP, If I have a host that I only turn on every few days or so, it will always get the same address from the pool.

In KEA DHCP, If I have a host that I only turn on every few days or so, it will get a different address from the pool.

So for example, if the reservation range is from .100 to .120, one day I may get .101, and another day I might get .100 if I didn't give out any IPs since the last time the machine was on.

I don't want to increase the lease time because I want the client to request a new lease frequently in case something changes.

ISC DHCP was much better about giving previous addresses out. I never exhaust the pool range, so it was pretty much similar to having static entries without needing to make static entries.

With ISC DHCP, I can have the machine off for weeks and still get the same dynamic IP address it gave me  a while back.

Is there any way to make KEA remember IP addresses better and behave like ISC in that regard?

I'm using the latest opnsense (21.7) and I have a Deciso DEC850 and decided to try out specifying a custom MAC on the WAN port.

When I do this, the WAN port flaps. The interface goes up then down, then up, then down. It continues to do this until I remove the MAC spoof and then it starts working normally again.

Has anyone ever seen this issue before?

I installed the intel-em-kmod package / driver from FreeBSD but no luck, it still flaps.

I would be curious if someone who has a DEC800 series router could try to specify a custom MAC address on igb0 and let me know if it flaps.

I am running the latest Opnsense and decided to run zpool upgrade. Here was the result:

root@router:~ # zpool upgrade zroot
This system supports ZFS pool feature flags.

Enabled the following features on 'zroot':
  userobj_accounting
  encryption
  project_quota
  allocation_classes
  resilver_defer
  bookmark_v2
  redaction_bookmarks
  redacted_datasets
  bookmark_written
  log_spacemap
  livelist
  device_rebuild
  zstd_compress
  draid

Pool 'zroot' has the bootfs property set, you might need to update
the boot code. See gptzfsboot and loader.efi for details.

Is there anything I need to do, or can I reboot? I am worried that I'm going to brick my opnsense install by not updating "the boot code".

There were 23 CVEs that were published that are part of the InsydeH2O UEFI firmware:

https://www.bleepingcomputer.com/news/security/uefi-firmware-vulnerabilities-affect-at-least-25-computer-vendors/

I saw that the DEC appliances sold by Deciso use that firmware:

https://www.insyde.com/press_news/press-releases/insyde%C2%AE-software-powers-opnsense%C2%AE-network-appliance-leveraging-amd-epyc%E2%84%A2

Is there anywhere to download the security updates for these devices?

Are the following two equivalent if I am trying to max out performance:

1. PowerD disabled
and
2. PowerD enabled with setting Maximum

If they are equivalent, why is Maximum even a setting? Isn't the only use case of PowerD to save power?

I recently purchased a DEC850 from the Opnsense store. Everything has been going great except for one thing... The SFP+ ports don't seem to work (ax0 and ax1).

I am using a Ubiquiti UF-RJ45-10G (which is listed as supported on the DEC850 page). I tried it in a unifi switch and everything worked great. I put it into the SFP+ ports in the DEC850 and doing an ifconfig shows "status: no carrier".

I manually specified the link type with "ifconfig ax1 media 1000BASETX" but still no luck. Does anyone have any troubleshooting tips?

I'm using the same computer / NIC / cable that I used in the Unifi switch (which works) to eliminate any variables.