Topics

Hi, since the Update, my Setup is not working anymnore.

I have:

BlockyDNS -> Port 53 --> forwarding internal domains to DNSMASQ on Port 65352 --> forwarding domains, if not resolvable, to unbound port 65353.

Problem: when i ask dnsmasq, its NOT forwading my domain to unbound anymore. this was working before the last update  :(

I cant add any new certificate NOR recerify them. Iam using ionos and i see no issues regarding DNS record adding... But i see errors like:

Code Select Expand

[Thu Mar 27 19:15:51 CET 2025] Not valid yet, let's wait for 10 seconds then check the next one.
2025-03-27 19:15:51.000 OPNsense.quolke.net
[Thu Mar 27 19:15:51 CET 2025] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 6
2025-03-27 19:15:51.000 OPNsense.quolke.net
[Thu Mar 27 19:15:51 CET 2025] No DOH
2025-03-27 19:15:51.000 OPNsense.quolke.net
And its repeating for all my certis. There where working before and as mentioned, i can see the DNS records without any issue (and usually, in the past, in 10-30 secods as ionos is fast AF  .. :D)

Iam really trying to improve my shaper knowlege.. But iam hitting a limit ehre and there.

Long story short:

I have a normalization rule, adding CS3 to all packages coming/going to a specific device and a rule, looking for traffic containing CS3 traffic. But for some reason, the rule is matching ALL traffic from all VLANs  :|

First: Thank you ! Finally this helps a LOT :)

But i have a question: Is there a (official) way to tackle Bufferbloat AND using Shaping together? I would like to Prio my IPTV but without loosing the pimped bufferbloat  :|

See title. It is fixable by restarting dhcpdv6. Internet access is back immediately after restarting the the ISC DHCP v6. This issue is new with the current release.

For now iam using from to restart the dhcp every hour ... :/

[native]

Hi,

i have a (at least for me) strange issue:

I have a Setup with 2 Physical Interfaces and multiple VLANs.

The issue i have:
One host in the untagged (native) network is trying to reach the IPv6 fd11:192:168:10::10 (SERVERS VLAN) and gets no response, UNTIL i add a firewall rule INSIDE the SERVERS VLAN to allow traffic TO the native network. Even more strange: this only counts for IPv6. IPv4 does not have that kind of issues here (picmp, etc are fine). Any idea why only IPV6 is affected? All the rules i have are IPv4 AND ipv6 (triple checked) and adding the rule to the TARGET network does not seems to make any sense.


To rebuild this:

Have one Physical Interface with Multiple VLANs

Have a Host in the untagged network
Have a Host in the VLAN 10

Have a rule in untagged VLAN allow ALL traffic IP4/6 to VLAN10
IPv4 Ping works fine
IPv6 Ping not

The same works from another VLAN to the VLAN10 but not von UNTAGGED network to VLAn and ONLY for IPv6

Hi, iam playing around with the traffic shaper and normalization but i dont get the stuff to work right.

What do i want?

- Tag ALL HTTPS Traffic to CS1
- Put CS1 Tagged traffic into the CS1 Queue.

What did i have done?

- Created a normalization rule to add CS1 to all packages on my interfaces (WAN/LAN) matching TCP/UDP 443
- Created a shaper rule matching all outgoing (and ingoin, two separated rules) and put them to the correct queue


Problem: My CS1 queue is still empty i dont get why

Hi,

ich habe mir eine Gruppe gebaut für meine beiden Wireguard Verbindungen (https://forum.opnsense.org/index.php?topic=27449.0). Was mich jetzt nervt: Ich habe nun eine nutzlose Wireguard (Group) Gruppe unter den Rules sowie zwei weitere Pro Interface. Ich würde diegerne irgendwie verstecken, da meine selbst erstellte Gruppe eigentlich ausreicht und es zur übersicht beiträgt. Kann opnsense das ?


Zur besseren Verständlichkeit will ich die hier schwarz übermalten einfach verstecken

[Pipes:]

Hi,

I have created the following:

Pipes:
Download / 95Mbit / fq_codel / ecn
Upload / 35 Mbit / fq_codel / ecn

Queues:
Download:
High Prio / Download-Pipe / Weight 100 / ecn
Medium Prio / Download-Pipe / Weight 25 / ecn
Low Prio / Download-Pipe / Weight 1 / ecn

Upload:
High Prio / Upload-Pipe / Weight 100 / ecn
Medium Prio / Upload-Pipe / Weight 25 / ecn
Low Prio / Upload-Pipe / Weight 1 / ecn

Flows
IN-Traffic from WAN to IPTV / Medium-Download-Prio
IN-Traffic from WAN to LAN / Low-Download-Prio


I can see in the status page, that all packages matching the correct flow etc. So this part is working.

Now my Problem:
When iam starting to Download something, the IP-TV starts to stutter a lot.

When i create ANOTHER Pipe (! not qeueue) with 25 Mbit and assign the flow to that pipe, the problem is solved.

Shouldnt the weight solve my issue? Why IPTV stutters even when the weight is way higher then the BULK traffic. ? And why another PIPE is solving the issue ?

PS: I have a 100/40MBit VDSL Line


Second Question:
With normalization, i can add DSCP Tags to packages. Does the shaper comes AFTER that so i can create DSCP based flows? this would be kind of diffserv behavior... But of cause, for that the upper question and problem needs to be solved first.

When iam clicking on DHCPv6 Leases i got this error: And its showing me static leases only, even if there are some known dynamic leases left.

2023-09-27T22:31:05+02:00 the.fqnn.of.my.fw configd.py[244]: [a46c67fd-99b8-416e-b93d-578f3cd22110] Script action failed with Command '/usr/local/opnsense/scripts/dhcp/get_leases6.py --inactive ''' returned non-zero exit status 1. at Traceback (most recent call last):   File "/usr/local/opnsense/service/modules/actions/script_output.py", line 44, in execute     subprocess.check_call(script_command, env=self.config_environment, shell=True,   File "/usr/local/lib/python3.9/subprocess.py", line 373, in check_call     raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/dhcp/get_leases6.py --inactive ''' returned non-zero exit status 1.

Hi, iam struggeling since two days now with the following issue:

I have Two RAs in one of my networks (and only there as far as i can see).

First:
RA is assigning the Gateway (fe80::fc7c:e7ff:fee0:d96c, the gateway for my WIREDCLIENTS Interface) and everything works fine. I can reach internal and external IPv6 adresses

After some time:
fe80::505c:56ff:feb0:824 is reaching the Client, which is the gateway addr from my LAN Interface. From that point on, i can only reach external IPv6 adresses.

I have absolute NO idea, why this is happening. In the other networks, i cant observe the issue. On my SERVERS network, i only see the one route. On my WPA3 network, i only see the WPA3 Gateway.

It looks like some bug, because the firewall rules are floatet (and therefore the same) + the whitelisting the other networks, which are even the same except that the WPA3 is whitelisting WIRED and vice versa


Looks like a bug.

BTW: Can i assign a CUSTOM IPv6 Gateway over RA/DHCPv6?