Topics

Good Morning,

On a OPNsense lab instance, I'm on latest DEV 26.1.a_621-amd64 and created a rule on WAN for ping. Afterwards I deleted that rule and boom, all firewall rules were gone, on all interfaces. That was ... surprising :). The firewall rules were created in the standard 'Rules', not 'Rules [new]'

That instance runs on Proxmox (which runs on a Hetzner root server) and has three virtual interfaces and Tayga: WAN (vtnet0), LAN (vtnet1), TEST (vtnet2) & Tayga.

If I delete one/any rule on WAN, LAN or TEST, all firewall rules on all four interfaces disappear in the GUI (also on Tayga). On interface Tayga deleting a rule does work normally.

In the config file the rules are present and do work, would indicate a GUI issue.

Is that something anyone else encountered? I can share the working and non-working config.

Adding, modifing, enabling/disabling rules does also work correctly.

While checking CARP settings in responds to a CARP thread here I realized that the field 'advskew' is missing (with 'advanced mode' enabled).

To verify I setup a pristine 25.1 with the ISO image 'OPNsense-25.1-dvd-amd64.iso', the setting is visible. Update to latest 25.1.3 and it's gone.

Can anyone verify that, or is it only me?

Hi,

To start: I don't want to offend anyone or belittle the effort put into the new dashboard.

I'm still not "feeling" the new dashboard, especially I don't get the widgets aligned up well and changing the size doesn't result in what I'd like to see (and the left menu is always visible unless I make the browser windows smaller - I thought it was possible to hide in earlier versions but maybe I'm wrong).

I'm aware that's probably only me and my own OCD or whatever triggering but I can't resist the questions:

• Is it feasible to create an old-style dashboard based on the new MVC/API technology?
• Could it be done in a way that would be very low maintenance?
  Like a different output mode for a widget, e.g graphic (standard new dashboard style) and old-style (or go crazy and create an ACSII output for your favorite widget)?
  That way the firewall/service data and getting the data would still be the same.
  If it could be done incrementally: if a widget got more than one output modes, the user could selected the one she/he likes
• Since I can't do it: Is anyone able to estimate the effort and cost (Euro 10k, 100K | 6 months or 1 year of work)?

I'm failing in installing FreeBSD 14.1 on my DEC740. After the boot menu of the installer it stops. I tried verbose mode and safe mode but without success.

Has anyone tried installing pure FreeBSD 14.1 and succeeded?

I run a OPNsense HA cluster on Proxmox in a Lab.

The master node still runs 24.1.2_1 and now I tried upgrading the backup node to 24.1.3. The upgrade itself runs fine, no errors and Unbound still runs. But if I restart the service it fails:

Code Select Expand

Notice unbound [84291:0] notice: init module 0: python
Error unbound [84291:0] error: pythonmod: can't parse Python script dnsbl_module.py
Error unbound [84291:0] error: pythonmod: python error: NoneType: None
Error unbound [84291:0] error: module init for module python failed

It's a standard HA setup, no blocklists or anything.

I rolled back again to 23.7.12_5, upgraded to 24.1 (it upgrades to 24.1.2_1) => OK; upgrade to 24.1.3 => NOK

Hi,

I setup an OPNsense 24.1 HA cluster on GNS3 to play with, well it started as an 23.7 cluster last week and then 24.1 happend :).

router1 LAN IP = 192.168.1.2/24
router2 LAN IP = 192.168.1.3/24
Floating LAN IP= 192.168.1.1/24

I came across an issues in KEA:

The Control Agent 'Bind address' is synced from the primary to the secondary.

Means after HA sync both 'Bind address' are set to the primary, in my case 192.1.2. But IMHO it should be either left alone or magically set to the IP of the secondary IP.
I did read up on it and in the 'Configuration Template' section of KEA they seem to agree with me on that.

Thanks for a great product!

Edit: I originally thought I had an HA issue too but turned out that the HA peers URL can't be HTTPS, switching to HTTP solved that.

/Thomas

Hi,

It's a bit embarrassing but I seem not to be able to figure out what the 'U' is meant to be for the 'Processor' graph unter "Health".

I did assume that it is load average but for that the numbers are way off for me.

I switched to OPNsense a week ago (running latest 22.7.4) and it runs on SOPHOS SG105r3 hardware. It got an Intel E3930 cpu with 2 cores (and 2GB RAM). The Health graph - with interrupt and processes disabled - is attached.

The load average on the dashboard is reporting "0.32, 0.41, 0.38" right now. Looking at the Health graph the average seems to be much higher and it regularly goes beyond 15.

The documentation did not clear it up for me. Maybe a patient soul could shed some light on that?

Thanks
Thomas

Hi,

Please move this post if not the right place or remove if necessary ... I'm aware it's probably offtopic since not really OPNsense related, but at least OPNsense hardware related  :)

Last week I got the DEC740 I ordered and I'm playing around with it, especially with the 10GbE interfaces.

Since OPNsense got newer drivers for the 10GbE than FreeBSD 13 do you have any idea when they get included in FreeBSD? I couldn't find anything related to this driver. But then I may just looked at the wrong place.

I did compile a custom FreeBSD stable/13 kernel with the code diff for the axgbe from OPNsense and it works well. Having it upstream would of course be even easier.

What I did see though is a difference of cpu load when receiving packages. The cpu load while receiving (iperf3 -R) is about 2 to 3 times higher than sending on a fresh installation of FreeBSD 13. Using iperf3 with one client (-P1) and on the other end is an Intel X520 I can max out the 10GbE easily.
Playing around with net.isr.dispatch, net.isr.maxthreads and net.isr.bindthreads didn't change much.

• Does anyone have a DEC740/750 box and did some benchmarking with FreeBSD or on OPNsense with the firewall disabled?
• Are there any recommendations for the AMD 10GbE drivers settings?
  

And now to the completely off-topic: The Linux shipped kernel 5.13 and also the lastest 5.17-rc2 do not recognise the AMD 10GbE interfaces. Are you in contact with the developer(s) from AMD and have any idea what the plans are in regard to the Linux kernel and the amd-xgbe driver? From the OPNsense axgbe code diff is seems like it would not be too much work for the developers to have it working on Linux.

/Thomas