Topics

ETA: It took a little time, but the device did show up in Interfaces -> Neighbors -> Automatic Discovery. Thanks to all for responses.


Original Post:

I set up a camera with a fixed IP address in its settings.

I specified the LAN IP (192.168.1.18), the subnet mask (255.255.255.0), the gateway (192.168.1.1 - OPNsense), and the DNS (192.168.1.1 also OPNsense with DNS servers in System->Settings).

I tested the camera on Ethernet and on Wifi and it's working either way. But I don't see it anywhere in OPNsense, not even in the live firewall logs.

Is there someplace I can see a device that is configured like this?

Thank you.

Home user here with a nearly default install of OPNsense.

Simple home network of one WAN, one LAN, one Wireless AP.

My ISP does not provide IPv6 and I don't have any IPv6 or DHCPv6 configuration anywhere that I am aware of.

Unbound is disabled.

Four DNS servers in System->Settings->General. NO boxes marked under Networking.

Dnsmasq has been working well for some time. I could stay with it, but I want delete lease support, so in another post it was suggested I consider using KEA as delete lease is/will be supported there.

The KEA DHCPv4 setup is simple: LAN, changed default lease to 3600 (for testing), one subnet 192.168.1.1/24 (OPNsense LAN is 192.168.1.1), one DHCP pool range (192.168.1.230-192.168.1.250), UNmark match client ID so I can use MAC address, and added all devices with reserved IPs. They're all lower than that pool range and the same as in Dnsmasq. I tried with and without marking the box for Auto Collect Option Data, no difference. It looks correct, populated to 192.168.1.1 for Routers (gateway), DNS, and NTP.

I disable Dnsmasq and enable KEA. All clients immediately cease to find any sites by DNS name. Internet access is still good. I can ping, tracert, etc. any site by IPv4 address, just not by DNS names.

I disable KEA and enable Dnsmasq and all sites are immediately found by DNS name again.

At first I thought perhaps DNS wasn't being served because KEA hadn't yet picked up any leases. So I released and renewed my windows laptop lease (which is reserved) and KEA showed the lease correctly to the same IP. But the laptop still couldn't reach any sites by DNS name. After enabling Dnsmasq again, the laptop could find all sites by DNS without me having to do anything further.

(I have tried different browsers on the laptop, and also different PCs, both wireless and wired. It is the same, DNS names working immediately with Dnsmasq, stop working immediately with KEA.)

Other than INFO messages, only these two WARNING messages in KEA logs are repeating every half hour:

   DHCP4_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
   DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.

Firewall live log looks the same whether Dnsmasq or KEA is enabled. It shows DNS queries to port 53 as pass on both LAN (Default allow LAN to any rule) and WAN (let out anything from firewall host itself (force gw)). For LAN the DNS server is 192.168.1.1 (OPNsense) and WAN is one of the four in my system settings list.

It almost seems like all is working except the DNS "answer" is somehow not getting back to the client when KEA is enabled?

I've been searching the 'net and the only issues I've been able to find with KEA and DNS have been solved and connected to AdGuardHome, Unbound, PiHole, IPv6... and I'm not using any of those.

Thank you for help.

*** SOLVED *** see post #8   https://forum.opnsense.org/index.php?msg=260595


Currently on 26.1.1 but this started on 25.7.

OPNsense ran without issue for nearly two years, then after the upgrade to 25.7 we started having connection dropouts.

During a period of connection instability, the below is repeated several times in the gateway monitoring logs:

Warning dpinger exiting on signal 15
Notice  dpinger MONITOR: WAN_GW (Addr: xxx.xxx.xxx.xxx Alarm: down -> none RTT: 20.0 ms RTTd: 1.2 ms Loss: 0.0 %)
Warning dpinger send_interval 1000ms loss_interval 4000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 0ms loss_alarm 0% alarm_hold 10000ms dest_addr xxx.xxx.xxx.xxx bind_addr xxx.xxx.xxx.xxx identifier "WAN_GW "

I have tried so many IPs, from geographically close server IPs to Cloudflare and Google DNS IPs. None have worked, though some have caused more dpinger exits than others.

Several days ago I ran these tests:

1. Configured a nearby IP known to have near 100% uptime and fast response, in gateway monitoring. With my phone on cellular only (disabled wifi radio, disabled bluetooth), I ran continuous pings on that server for several hours.

2. Changed my phone to ping my own public IP for several hours.


No pings failed, but our internet connection still dropped periodically, and the dpinger entries were in the logs.


I disabled gateway monitoring after the above tests and we haven't had any more connection drops AFAIK.

I am just a home user and my OPNsense has very few minor tweaks over the default install. And while I don't strictly need dpinger - I have no backup connection - I like having a record of internet disruption especially when I've been away.

Is there anything else I can do/look at, to troubleshoot and (hopefully) get dpinger working well again?

Thank you for any help and info.

Kind regards.

Minor bug?

Firewall -> Logs - > Live View -> Templates. I have a few templates saved from prior versions (25.7 and prior) and these work fine.

After upgrading to 26.1, I entered criteria for a template and got my expected result list. I saved it as a new template.

The saved template does not bring up any result. If I reenter criteria and apply it to the log, I get a result.

Sample criteria:

Change "action" in dropdown to "address"
Change "contains" in dropdown to "is"
Enter some address in search box that has log entries - I entered 192.168.1.9

Applying the above criteria brings up several records. I save it as a template, leave the firewall log and display some other page like the Dashboard. Then I come back to the firewall log and choose the new template. Nothing is displayed.

My Ooma Telo VOIP device (I'm a home user, this is residential service for my home phone) stopped connecting out to Ooma's servers on or about January 16th (about 2 1/2 weeks ago). It has been working for the past couple of years on the same hardware and OPNsense.

I was on 25.7 with all updates at the time it stopped working. But I just upgraded to 26.1 and it's still happening, so looking for help on this version.

A few things happened on or about the 16th:

1. ISP upgraded service in my area around that time
2. OPNsense had updates around that time
3. I migrated from ISC to DNSMasq around that time

I don't get calls every day and can't normally see the Telo device, it was another week when I realized I'd had no calls and saw the Telo was offline. Everything else had been working fine and stil is. On both 25.7 then and 26.1 now. AFAIK the Telo is the only issue.


Here's what I've done:

1. After checking basic things like swapping cables, power supply, DHCP lease gets assigned, troubleshooting using Telo's own config webpage, I called Ooma support and after several days of struggle with their various troubleshooting reports, Ooma says everything is good so if it isn't connecting the Telo is probably dead. They could not see it try to connect to their servers at all.

2. I bought a new Telo, called Ooma to activate it, we set it up, and it doesn't connect either.

3. I got referred to the next level Ooma support, they had me cable the new Telo inbetween the ISP's modem and OPNsense (it's on a protectli box), and it connected. It passes through all non Ooma traffic through. All was working again, albeit slowly, and my Ooma service was working.


I put the Telo back as a client on the LAN as it has been for years, and it doesn't connect. So I must've done something wrong on OPNsense I'm assuming, but I've no idea what since everything else works great.

I did want to try going back to ISC as a test, but on 26.1 I can't figure out how to add new devices? I don't have any plus signs anywhere to setup something new, at least not that I can see?

I do not use Unbound. DNSMasq uses the DNS servers I have under System area. I can see in the firewall logs everything is going to ones I specified and not my ISP's so I think that is working correctly. It is configured for all clients to forward all DNS queries to OPNsense (192.168.1.1) and let OPNsense handle the DNS, this way there is no client that can go around the DNS I've coded. (I think that's how it works.)

The Telo does make some DNS queries periodically, I can see that in the Firewall logs, they are going to OPNsense 192.168.1.1 just like all the other clients on my home network.

I did check that SIP ALG is still disabled and it is.

I have never done anything to use the Telo, just gave it a reserved IP address (to make it easier for me to find its setup page) and it has just worked all this time until now.

Oh, and my OPNsense configuration is very little more than the defaults, and nothing has been changed in a few years except for moving to DNSMasq. I've used a simple DNSMasq config with other routers in the past with no issue, I don't expect that's the problem now but I don't know for sure. I basically only use it to assign reserved leases and of course handle DHCP and DNS.


I am happy to try moving back to ISC for a test to narrow it down, but I need help figuring out how to add new devices. If there's anything else I can look at or try please let me know?

I don't know much about OPNsense, I'm just a home user who put it up pretty much by default a few years ago and tweaked a little over time, so please have some patience with my lack of know-how.

Thank you for any help and info on figuring this one out.

Kind regards.

OPNsense has been working fine since the upgrade to 25.7 (after I disabled Unbound, have other post on that).

Have applied a few updates since the upgrade and no issues with that process either. Today I click on "view pending updates" and update text scrolls by, followed by an error popup: The release type "opnsense" is not available on this repository


I searched and found this recent post: https://forum.opnsense.org/index.php?topic=49338 - the OP's situation is different from mine, but OP also received this popup. In that post, OP was advised to run a health audit.

I found mine here: System->Firmware->Status->Run an Audit (button at bottom)->Health (dropdown) This is the result:

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 25.7.4 (amd64) at Wed Oct 22 08:16:24 PDT 2025
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 25.7.3 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 25.7.3 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-gdrive-backup 1.0
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 25.7.4 has 67 dependencies to check.
Checking packages: ..
ca_root_nss-3.115_2 version mismatch, expected 3.115_3
Checking packages: ...................
openssh-portable-10.0.p1_2,1 version mismatch, expected 10.2.p1,1
Checking packages: ..
opnsense-25.7.4 version mismatch, expected 25.7.6
Checking packages: ...
opnsense-update-25.7.3 version mismatch, expected 25.7.5_1
Checking packages: ..............
php83-phpseclib-3.0.46 version mismatch, expected 3.0.47
Checking packages: ................
py311-sqlite3-3.11.13_11 version mismatch, expected 3.11.14_11
Checking packages: ........
suricata-7.0.12 version mismatch, expected 8.0.1
Checking packages: .
syslog-ng-4.8.2_4 version mismatch, expected 4.10.2
Checking packages: ..
wpa_supplicant-2.11_5 version mismatch, expected 2.11_7
Checking packages: . done
***DONE***

I don't know why there are mismatches? I've not done anything in the past except apply whatever updates are waiting, as soon as I see them - every couple of weeks.

I haven't applied this update yet. I'm afraid to go ahead with it given I've never had an error message before.

Is there something else I should do or look at?

Thank you for any help. Kind regards.

In looking at blocked entry in firewall live log, the detail popup has this information in it:

...
reason: match
rid: <magnifying glass> <hex string> (clickable)
...

Firefox browser: Click "rid" launches a new tab that immediately closes. Right-click and use 'open in new window' does same - launches and immediately closes.
Edge browser: Click "Rid" remains in same tab, but tab page is blank.

I was getting a lot of "server not found" browser messages after the upgrade to 25.7. All would seem OK for a while, then there'd be a period of failures. (Multiple devices, wired and wireless, and multiple browsers on those devices). Also, most devices were laggy at intervals, without any error messages. It would just take a long time before any result would appear (in the case of browsing).

I previously had Unbound enabled (it came that way by default). I did nothing further with it other than specify three DNS server IPs in Unbound. Nothing more for DNS. It's been this way for a couple of years, and no trouble here that I'm aware of.

After upgrade to 25.7, the problems came.

In searching the 'net for help, I stumbled on a setup post for Unbound that had me mark Enable DNSSEC Support, Register ISC DHCP4 Leases, and optionally Flush DNS Cache during reload, which I also marked. After applying the changes I rebooted.

It has now been several hours and I have not seen any DNS failures or experienced any lags. Performance is quite snappy again.

I assume what I had was a poorly configured DNS situation that was better tolerated before 25.7.

Most people here are far beyond me in config and expertise, I'm just posting in case it helps someone.

(Cable modem -> Protectli Vault with OPNsense -> Cisco switch -> wired clients and one wireless AP for the rest. Basic install setup plus some reserved DHCP LAN IPs.)


***ETA***: All had been working fine for more than 24 hours, when suddenly again nothing is getting DNS resolved. Unbound DNS reporting showed a sharp drop and 0% of queries resolving.

I tried restarting Unbound service, tried stopping/pause/starting, tried flushing the Unbound cache. Resorted to reboot OPNsense via WebUI menu and all is working again.

If anyone has any ideas on what else I can look at or do, I would really appreciate the help.


***ETA2***: Eight hours ago, I cleared Unbound's cache, disabled Unbound, rebooted, so OPNsense would use the DNS servers in System -> Settings -> General directly. All seems to be working fine so far, will continue to monitor. Did go more than 24 hours with the last change, though, so will check back in tomorrow. Meanwhile please let me know any ideas. Thank you.


***ETA3***: Fixed incorrect info.

Just a simple home user here. Protectli VP4630 (32G memory and 1T SSD) and OPNsense, upgraded to 24.1.5_3-amd64 yesterday 4/7.

TLDR; I have no clue if the odd "lockup" issue I experienced rests with OPNsense or Protectli vault. If OPNsense I don't even know if it was this latest update or that's just a coincidence. I know too little to troubleshoot very well and I've already recovered from it and all is good again. So I don't need any help - just want to put this out in case it resonates with anyone.

Simple network: 1 WAN, 1 LAN. Spectrum provided Cisco modem into WAN. Unmanaged switch in LAN port. Wired devices and a wireless AP plugged into switch (One Eero 6+ in bridge mode as the AP). No issues for 5 months.

As mentioned, ran manual update yesterday to OPNsense and everything went fine. About five hours later, wifi disappeared. Checked the Eero - "red light" - disconnected. Eero has been a POS for me so I assumed it was Eero and started researching how to fix. Everything pointed to internet down but modem idiot lights looked good and Spectrum app reported it was up, and anyway I should still have a network just no internet if that was the actual issue. Too much time wasted there but I learned some things.

Finally dawned on me to check a wired desktop (plugged into switch and bypasses Eero) and it had no internet. So not the Eero. Apparently no local network either as it couldn't reach any other wired computer nor bring up the OPNsense webpage.

Tried power cycling modem, protectli, wired computer - no change. Put protectli on a monitor, keyboard, mouse. Got the OPNsense console upon power on, and OPNsense found my IPV4 address from my modem (my ISP has never served an IPV6). Nothing configured on LAN port.

Tried factory reset from console. Assigned WAN, LAN ports and now LAN port had IP range, nothing found for WAN IP. (made sure ports were correct to cables as I've seen the factory reset puts LAN on first port then WAN by default, I assign WAN on first then LAN)  I don't know how many times I tried to get this part working... and failed miserably.

Tried restoring from backup to no avail as well. No joy.

Now I wondered if my modem was broken? Back to Spectrum app, still says modem is working well. Restarted modem from the app which also does a reset (I could have used the reset hole on the modem but it is fidgety). Power cycled protectli while waiting for modem to come up, then another factory reset.

This time it all worked. And the kicker - the modem was now serving an IPV6 address. I have had IPV6 disabled on all prior routers (right or wrong, not here to debate that) and so I had disabled all IPV6 services in OPNsense when I first set it up, since I've never had an IPV6 address from Spectrum ever before.

I have no way to know anything for sure, but I am thinking that by disabling IPV6 in OPNsense, OPNsense got lost somehow when the Spectrum modem began (unsuccessfully until reset/restart?) to serve an IPV6 address. I confirmed with Spectrum that change was made yesterday.

It is certainly an edge case if that's what happened, just want to mention anyway.