Topics

During the upgrade there was a crash of some kind. The device restarted and reverted to 25.7. Now, when trying to upgrade again I get the following:

Code Select Expand

***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 25.7 (amd64) at Mon Aug  4 15:13:10 UTC 2025
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
Waiting for another process to update repository OPNsense
All repositories are up to date.
Checking integrity... done (0 conflicting)
Your packages are up to date.
Checking for upgrades (13 candidates): .......... done
Processing candidates (13 candidates): .......... done
Checking integrity...Assertion failed: (strcmp(uid, p->uid) != 0), function pkg_conflicts_check_local_path, file pkg_jobs_conflicts.c, line 315.
Child process pid=66704 terminated abnormally: Abort trap
***DONE***
I read other threads requesting a health audit. I tried that and there is a crash during the audit. Here is what was on the screen when the crash occurred:

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 25.7 (amd64) at Mon Aug  4 15:19:00 UTC 2025
>>> Root file system: /dev/gpt/rootfs
>>> Check installed kernel version
Version 25.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 25.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-ddclient 1.27_3
os-wol 2.5_1
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: ....

I can see from the source code that CVE-2023-42325 can't affect OPNsense because that code doesn't exist in OPNsense. However, CVE-2023-42327 and CVE-2023-42326 are a bit less clear looking at the source code.

Is OPNsense affected by CVE-2023-42327 or CVE-2023-42326?

On the most recent update an error "Unbound Migration failed" was in the update logs. This may have started with an earlier upgrade, but I am just noticing the error because it stands out. The error message says to check log for details. Here is what is shown in the log.

Code Select Expand

[ERROR] Model OPNsense\Unbound\Unbound can't be saved, skip ( OPNsense\Phalcon\Filter\Validation\Exception: [OPNsense\Unbound\Unbound:advanced.dnssecstripped] value should be a boolean (0,1){on}
[ERROR] [OPNsense\Unbound\Unbound:advanced.dnssecstripped] value should be a boolean (0,1){on}

Here is the exact text of the error in the update log:

Code Select Expand

>>> Invoking update script 'refresh'
*** OPNsense\Unbound\Unbound Migration failed, check log for details

I can see exactly what to fix: change the entry in the config XML from "on" to "1" and then the scripts should work. However, I hesitate to fix this manually when there are probably many others with the same problem.

Is this a bug in the migration process?

If an update requires a restart, is there a way to schedule the process to occur at a particular time in the future? And another situation: even without an involved update, is there a way to schedule a restart?

I have searched the documentation and the forums here and didn't see anything that stood out that would answer this question.

Is it possible to make DHCP changes over the API? I have looked the API documentation up and down and I don't see any endpoints that pretain to the DHCPv4 service. My goal is to check existing leases and then convert one of them to static.

What API endpoint is used to configure DHCPv4 service?

I am trying to create firewall rules via API. I am able to create rules using CIDR, but the system aliases like "OPT1 net" or "WireGuard (Group)" or "WireGuard (Group) net" in the source_net or destination_net fields in the POST'ed JSON. Also, I'm unable to refer to the interface "WireGuard (Group)" in the interface field.

Are these strings usable in the API at all?

On a side note, when the rule is created (using CIDR and interface ID), and you look in the web console listing of "Automatically generated rules", the created rule appears to be wide open with "*" in every column on that view. However, when editing that same rule as listed under "Automation -> Filter", everything looks correct.

Is the web UI not able to display the details of the rule correctly? Or is showing all "*" in each column by design and the expected way for the rule to be displayed?

When using the OPNsense importer, if the imported configuration includes a WireGuard VPN, the WireGuard (Group) interface is subsequently removed during the install process that follows the importer. I have tried and failed to discover a method for getting it back.



The step where it is removed is "(root): Created web GUI TLS certificate".



I have tried to trigger the creation of the interface by doing the following, but none worked.

1. Uninstalling and reinstalling the plugin.
2. Disabling and enabling the local server configuration.
3. Disabling and enabling WireGuard.
4. Creating a new local server configuration.
5. Creating a new local server configuration with all others disabled and WireGuard disabled.

Anyone have a suggestion for a workaround for getting the interface added back? Also, if there are any pointers as to where this happens in the source code, I could take a stab at fixing it and making a PR.

I've been digging into the WireGuard configuration for a project I'm working on and noticed that each time the public and private keys are generated, there are extra newlines and whitespace added to the configuration XML. This whitespace is then removed whenever the WireGuard config is modified for any reason going forward. I've tracked down the source: "tee" is used to write the keys to a file and print them to stdout simultanously, the output to stdout being captured in the config.xml file. This command line adds newlines which cannot be silenced (I checked the tee man page).

This is where tee is used:

https://github.com/opnsense/plugins/blob/3bcfab38f6ea265bf23b5b01eccc4e82f75fbb4e/net/wireguard/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh#L37-L45

Here is where that shell script is called in PHP:

https://github.com/opnsense/plugins/blob/3bcfab38f6ea265bf23b5b01eccc4e82f75fbb4e/net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php#L48-L93

There are three potential fixes along with "just ignore it / who cares".

1. In genkey.sh, the output from tee can be piped to tr: "tee ${TMPDIR}/wireguard.priv | tr -d '\n'" as one example of two.
2. In ServerController.php, each of the four locations where the strings are stored in the config get wrapped in rtrim(): "$node->privkey = rtrim($keyspriv);" as one example of four.
3. Whatever function pretty prints the config XML before writing to file should be called after these modifications are done. I have not found this pretty print function or step, so I don't know what to do for it, but there is clearly a pretty print function being called after subsequent modifications to the config because this whitespace is removed any other time the config is modified.

I can make a PR, but I didn't want to until I check here in case the OPNsense maintainers decide that "just ignore it / who cares" is what they wish.



And, yes, I know that is a private key in the image. It was generated for this screenshot and is not used anywhere.

I've written a kludgy Jupyter notebook that takes a template config.xml and performs a set of replacements and additions based on the contents of an INI file. I'm using it for deployment of a project, but I figured that I would share it here if anyone needs something like this, at least it may be a place to start. There are a number of optimizations that are just for my project, so you may need to bend it to your will to make it useful.

https://gist.github.com/utkonos/57c79f1a0b68dd6a79cbf2de68db995a

I have been digging into the config.xml and during this, I noticed that the /conf/config.xml file has world readable permissions. I also noticed that the incremental backups of the config file located in /conf/backup have inconsistent permissions. Some are 640 and some are 644.

Are these permissions correct?

Greetings,

I am attempting to load a configuration file from a mounted ISO rather than a USB. The use case is for deployment on a VM inside of Proxmox, a virtualization environment. Generating an ISO and then uploading it to Proxmox's ISO storage is straightforward as is adding a second cd drive to the VM with that ISO attached. The result is cd0 with the OPNsense ISO attached and conf.iso attached to cd1. The layout of the conf.iso is /conf/config.xml as outlined in this previous thread:

https://forum.opnsense.org/index.php?topic=22307.0

Both devices are recognized correctly during first boot. When I press any key to start the configuration importer, both are listed:

<QEMU QEMU DVD-ROM 2.5+> at scbus1 target 0 lun 0 (cd0,pass0)
<QEMU QEMU DVD-ROM 2.5+> at scbus1 target 1 lun 0 (cd1,pass1)

When I select "cd1" at the prompt as the device to import from, it doesn't find the configuration and the following is printed to console:

No known partition layout was found for 'cd1'.

Is there a change that I can make to the ISO image that will allow this to work?