Messages

https://forum.opnsense.org/index.php?topic=52191.msg269089;topicseen#msg269089
Double post or similar but separate problem?

Thank you for this @meyergru . I had to abandon my last attempt at this and I can see from this what changes I must adopt despite following the guide, for instance not manually crafting the certs but using an app. The price of the recommended one for the this purpose stings but the technical background is very valuable. Thank you. I might be able to re-visit the attempts.

My suggestion will be to test with a non-*bsd-based router. A Linux one instead.
user friendlies were dd-wrt and open-wrt. It's been a while since I looked, it might have changed.
The reason to suggest it is that you likely eliminate any possible tuning required under freeBSD for your connection. Linux tends to have more hardware support for NICs as well. Yes you are using well supported nics in freebsd but tunables could be a factor.
Additionally it might be possible to put some additional logging in place to support your case with the ISP.

I would start looking for clues in two places: message buffer and system log which is /var/log/system/latest.log
Perhaps a live tail (tail -f) whilst renewing the dhcp lease from the ISP.

Only thing I can think of is if the ACL for this network is being unhelpful. Anything looking odd in /var/unbound/unbound.conf ?

After the interface change the reporting database might have become corrupted. Just a guess.

He wrote :

I reinstalled Opnsense

So that can't be it ;)

I beg to differ. The config backup contains the RRD data unless it's actively unselected. Therefore if it was saved (as per default) then the import would have contained this data.

Does the configuration backup save everything, or do any manual adjustments need to be made after restoring the config?

What is set or changed using the UI gets committed to the config file that is then used for import. Anything else is not i.e. done in the filesystem directly.

After the interface change the reporting database might have become corrupted. Just a guess.
Perhaps resetting would help? Reporting > Settings > Reporting Database Options.
There are options to reset / repair but beware, I imagine there could be data loss. I am not certain if the actions taken are destructive.
In the past when I changed interface hardware I had to do this. It didn't matter to me if resetting would reset to zero data but it fixed my reporting problem similar to yours.

I was going to ask about Network Interfaces: All (recommended) but that is set correct.
At this point I wonder if you have one of those obscure cases of VLANs mixing traffic with tagged and untagged. Can you check for that? What we're looking for is the setup, where your trunk to OPN has ONLY tagged traffic.

If creating swap is at all possible, it is hardly a bad idea to provide it to a system. Even when there is what appears to be plenty of memory for it.
It's quite easy to see most unix-like/*bsd systems with suitable amount of memory, they swap from time to time, even if in small amounts. For the sake of a few gigabytes of storage, it's an easy and cheap help to give it.

Have set the range and lease time but its not picking the new leases its still using old configurations

You need to tell the local clients to renew their lease manually.

For Windows:
ipconfig /release
ipconfig /renew

But you need to do some research and use AI. Its great for these kinds of things.

My Current Range
192.168.2.101 -  192.168.2.200

what am getting
eferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.171(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.252.0
   Lease Obtained. . . . . . . . . . : 12 June 2026 11:48:37
   Lease Expires . . . . . . . . . . : 12 June 2026 13:48:36
   Default Gateway . . . . . . . . . : fe80::f690:eaff:fe01:fb24%17
                                       192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1

Is that a typo in the dhcp server address, which is different to the address assigned to the client?

Instead of making us guess, can you please tell the setup, what is the OPN version, which dhcp service are you using on it, what are the devices involved in the setup? Perhaps a router behind another router. Maybe more than one dhcp server running on the network.

Yes, let the defaults be. You don't need swap.

IMHO running any system without swap is not a very good idea. If the system needs it for any reason, it is best for it to have it than not.

Seems like a virtual machine but that's not in itself a problem. Many run it on VM without problem.
If external monitoring is not setup or available, you need to regularly check for running processes to see which ones are using up the memory.
Telling what the setup and running services and plugins would help too.

For me I find it still useful for exposed applications at L7. I have some public-consumed services behind haproxy on OPNSense. I see many hits there attempting to use exploits that crowdsec appears to identify and stop at the ssl handshake failed attempt level or some other probing scenarios.
I'm keeping it despite as you say the now fairly noisy upselling, and that they seem to not improve the functionality of the plugin for the user.

"Freezes" can be for various reasons, from configuration to hardware or a combination so each user experiencing a freeze will likely have a different problem and therefoer need a different path to diagnostic.
Piling each a request for an "update" or "progress" on "the issue" will not help anyone. It'll become just a "me too fest".
Open a new thread with your setup so you can be helped.