Topics

In the Devices section I have already assigned a name to each of these IP addresses (graph below), they show OK (with the name) in the Top Devices section, but not in the Top Local Hosts section, why is this?

I have the Home License in trial mode, thank you

I am using Unbound DNS Blocklist, it is working fine, now I installed and activated Home subscription (trial) for Zenarmor, it also has adBlocking, do I need both? or I can disable Unbound DNS Blocklist? Thanks

Thinking to migrate to a CPU with 6 cores / 12 threads vs 4 cores / 4 threads I have today, will OPNsense take full advantage of it while using IDS/IPS/Zenarmor/Other Tool functionality? Thanks

I have browsed all over, was directed to the mimugmail repository, but htop is not there, tried to compile it from source didn't work, please any assistance or guidance will be appreciated.

As a side note, I don't understand why it is so complicated to install such a basic package.

Thank you

Thinking to migrate to a CPU with 6 cores / 12 threads vs 4 cores / 4 threads I have today, will OPNsense take full advantage of it while using IDS/IPS functionality? Thanks

I am virtualizing OPNsense in Proxmox, I need two network cards from the Host available in the OPNsense VM (WAN, LAN), might need more in the future for VLAN or other network segmentation.

I can enable them in bridge or passthrough mode, I have read that bridge will have a CPU cost and passthrough will have a RAM cost, because all guest memory needs to be allocated at boot.

Please could you help clarify if these statements are true or not, I am using a host device with 64GB RAM, Intel Core i7-10810U CPU, and 6 Intel I225-V Rev. B3 2.5G Ethernet cards.

From a throughput perspective, the ISP is 5G internet so around 300-400Mbps and I don't have a NAS in the LAN or anything else with high traffic.

Thank you

I will be adding doing some passthrough with PCI devices (Ethernet ports and Thermal agent from the Intel Core i7-10810U CPU)

- Should I pick i440fx or q35?
- Do I select QEMU agent?

Thanks

Proxmox was installed on a single SSD using the ext4 FS (default), what should be the most adequate FS for the OPNsense VM, UFS or XFS? Thank you

[hw.acpi.cpu.cx_lowest = C3dev.hwpstate_intel.0.epp = 100...dev.hwpstate_intel.11.epp = 100]

I am using an appliance with an Intel Core i7-10810U CPU (6 cores / 12 threads) , due to the device running 24x7, I am trying to reduce power consumption as much as possible, with the latest OPNsense with a fresh installation with mostly defaults, it consumes ~13 watts, if I apply the following Tunables:

hw.acpi.cpu.cx_lowest = C3
dev.hwpstate_intel.0.epp = 100
...
dev.hwpstate_intel.11.epp = 100

The power consumption gets reduced to ~11.5 watts (12% reduction).

In one of my testings, I installed Proxmox, who runs Linux kernel 6.8.5, and idle with two VMs (Debian and Fedora) running idle as well, uses ~8 watts (30% reduction), that means there are opportunities to tune the FreeBSD kernel and OPNsense even more.

Do you know other tweaks or places I can research to reduce OPNsense power consumption to levels similar to the Linux kernel? Thank you

NOTE: Don't tell me to run OPNsense as a VM within Proxmox, because I know I can do it, but my goal is to run OPNsense on bare metal, if possible.

Yesterday I was playing with the services and turned ON the IDS, then turned it OFF, now I have a Disabled entry in the Cron section in Settings:

Description: ids rule updates
Command: Update and reload intrusion detection rules

I have tried all the possible options to delete it and it is impossible, what should I do to remove it? Thank you

Is there a way to enable each time a Cron runs to show an entry in the Dashboard's Live Log?

I have a Cron setup to download the latest UnBound Blocklist (Update Unbound DNSBLs) and I would like to see in the dashboard when it runs, thanks

[Core i7-10810U]

According to this section of the FreeBSD handbook:

https://docs.freebsd.org/en/books/handbook/config/#hwpstate_intel

It has the following note regarding PowerD and EIST (Enhanced Intel SpeedStep Technology):

NOTE: Users accustomed to using powerd or sysutils/powerdxx will find these utilities have been superseded by the hwpstate_intel driver and no longer work as expected.

The two CPUs I am using: Core i7-10810U and Celeron J6412, are compatible with EIST according to this information from Intel:

https://www.intel.com/content/www/us/en/support/articles/000007073/processors.html

Therefore, can I turn off PowerD? And keep all the power efficiency already in place by just the use of:

- hw.acpi.cpu.cx_lowest = C3
- dev.hwpstate_intel.0.epp = 90

In Tunables? Thank you

I am using Unbound DNS Blocklist functionality, if I select one of the pre-defined blocklists (Type of DNSBL), like Steven Black, the cron I created for the automatic update (Update Unbound DNSBLs) will work fine, at the configured time and frequency, I can confirm this with Steven Black, it works as designed.

Now, if I decide to use a Custom blocklist (URLs of Blocklists) within Advanced mode, like the HaGeZi Pro+ blocklist, the cron will run but NOT update the blocklist, even when I have confirmed at their GitHub site that a new version of the blocklist has been released.

Ad blocking with both blocklists types, predefined and custom, works fine, it is the updating process that it is not working.

Am I doing something wrong? Thank you

I have two Protectli devices VP2420 and VP4670, initially I was using both of them with the AMI BIOS (standard), and the default power management was not very good, even with PowerD enabled, more details on these discussions, links below:

https://forum.opnsense.org/index.php?topic=28031.0

https://www.reddit.com/r/opnsense/comments/1fdzknu/how_to_enable_low_power_c_states_with_intel_core/

Bottom line, with the AMI BIOS I had to set the C3 state in Tunables with hw.acpi.cpu.cx_lowest or dev.cpu.0.cx_lowest. Before applying those settings the 2420 and 4670 consumed ~12 and ~14 watts respectively. After the C3 tweaks in Tunables, their power consumption got reduced to ~8.7 and ~10.7 watts respectively. Huge improvements with the tweaks.

The other day, I decided to test the Coreboot BIOS on both devices with fresh OPNsense installs, I noticed from the beginning the devices were running cooler, I have NOT configured C3 in Tunables (fresh install), meaning the CPU is always running on the C1 state, the 2420 and 4670 were consuming ~9.3 and 10.7 watts respectively, very close to the measurements with C3 enabled with the AMI BIOS.

If I enable C3 state with the Coreboot BIOS, their will be a small gain with the 2420 of about 0.6 watts and the 4670 will have not change, both use a different CPU:

2420: Intel Celeron J6412
4670: Intel Core i7-10810U

It seems with the openBSD kernel defaults, and the Coreboot BIOS power management is already optimized, vs using the default AMI BIOS on the Protectli devices, any previous experience, thoughts? Thanks for the feedback

[Press any key to start the configuration importer]

I have been installing and testing OPNsense across two devices multiple times, I am using Protectli VP2420 and VP4670, I will connect the USB-C drive with the installation image, power on and OPNsense will boot into the installation mode, first asking for:

Press any key to start the configuration importer

Then asking for:

Press any key to start the manual interface assignment

But now, suddenly, it doesn't ask any of those two questions, and go straight to the login, auto-assigning the interfaces I would assume, then I login into installer mode and go through the regular installation process, after it completes the installation, I boot the device, I login as root and reassign the interfaces, option1 from the menu. Out of 5 different fresh installations this is the first time this happening.

The only change I have made to the Protectli devices is that now they have coreboot as BIOS, before it was AMI BIOS, with AMI always the OPNsense installer asked the questions about configuration importer and interface assignment, any idea why this might be happening?

To summarize:

1.- When I install OPNsense from a USB-C drive using the AMI BIOS, the installer will ask me for the configuration importer and to assign interfaces, as expected, all good.

2.- When I install OPNsense from a USB-C drive using the Coreboot BIOS, the installer will NOT ask for the configuration importer and to assign interfaces, NOT, as expected.

I did the above installations on both, the VP24240 and the VP4670, something happens with the OPNsense installer when using Coreboot BIOS.

Thank you

[sysctl dev.cpu | grep cx]

I am trying to optimize the power consumption of the Protectli VP4670 using the Intel Core i7-10810U CPU, but after running the command sysctl dev.cpu | grep cx, the output (below for 1 of the 12 cores/threads) only shows the C1 state, no C2 or C3, is there a way to optimize the power management of the i7 CPU to minimize power consumption? Thank you

dev.cpu.0.cx_method: C1/hlt
dev.cpu.0.cx_usage_counters: 11192
dev.cpu.0.cx_usage: 100.00% last 642us
dev.cpu.0.cx_lowest: C1
dev.cpu.0.cx_supported: C1/1/0

I have seen some online articles (link below) where they will define a Port Forward Firewall rule to ensure everything related to Port 53 goes through OPNsense/UnBound DNS, is it really necessary? Is that something being managed by Unbound DNS? Thanks

https://forum.opnsense.org/index.php?topic=9245.0

If I perform a DNS lookup and as a result the server is 127.0.0.1, that means Unbound DNS is resolving the DNS request? Thank you and sorry if this is a basic question, new to OPNsense

If I use a custom link for the blocklist (URLs of Blacklists) instead of the predefined Type of DNSBL, will the cron I had created for the automatic daily download will also pull the updates from  URLs of Blocklists link? Thanks

My ISP (T-Mobile Home Internet) only provides /64, therefore no PD (prefix delegation), I can't use IPv6 with OPNsense, even though the OPNsense appliance will get an IPv6 address, nothing can be passed to the LAN clients unless I can enable NDP Proxy/Relay mode, in OPNsense, and so far, I can't. Does it make sense to fully disable IPv6 in OPNsense vs leave it half-active with no use?