Messages

DNS is not being served when you disable Dnsmasq because there is no DNS built into Kea.

That's a deal breaker for me then, for unknown reason Unbound isn't stable in my config and that's why it's disabled. (Have whole thread here about it.) I'll stay with Dnsmasq. Thank you, had no idea.

Home user here with a nearly default install of OPNsense.

Simple home network of one WAN, one LAN, one Wireless AP.

My ISP does not provide IPv6 and I don't have any IPv6 or DHCPv6 configuration anywhere that I am aware of.

Unbound is disabled.

Four DNS servers in System->Settings->General. NO boxes marked under Networking.

Dnsmasq has been working well for some time. I could stay with it, but I want delete lease support, so in another post it was suggested I consider using KEA as delete lease is/will be supported there.

The KEA DHCPv4 setup is simple: LAN, changed default lease to 3600 (for testing), one subnet 192.168.1.1/24 (OPNsense LAN is 192.168.1.1), one DHCP pool range (192.168.1.230-192.168.1.250), UNmark match client ID so I can use MAC address, and added all devices with reserved IPs. They're all lower than that pool range and the same as in Dnsmasq. I tried with and without marking the box for Auto Collect Option Data, no difference. It looks correct, populated to 192.168.1.1 for Routers (gateway), DNS, and NTP.

I disable Dnsmasq and enable KEA. All clients immediately cease to find any sites by DNS name. Internet access is still good. I can ping, tracert, etc. any site by IPv4 address, just not by DNS names.

I disable KEA and enable Dnsmasq and all sites are immediately found by DNS name again.

At first I thought perhaps DNS wasn't being served because KEA hadn't yet picked up any leases. So I released and renewed my windows laptop lease (which is reserved) and KEA showed the lease correctly to the same IP. But the laptop still couldn't reach any sites by DNS name. After enabling Dnsmasq again, the laptop could find all sites by DNS without me having to do anything further.

(I have tried different browsers on the laptop, and also different PCs, both wireless and wired. It is the same, DNS names working immediately with Dnsmasq, stop working immediately with KEA.)

Other than INFO messages, only these two WARNING messages in KEA logs are repeating every half hour:

   DHCP4_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
   DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.

Firewall live log looks the same whether Dnsmasq or KEA is enabled. It shows DNS queries to port 53 as pass on both LAN (Default allow LAN to any rule) and WAN (let out anything from firewall host itself (force gw)). For LAN the DNS server is 192.168.1.1 (OPNsense) and WAN is one of the four in my system settings list.

It almost seems like all is working except the DNS "answer" is somehow not getting back to the client when KEA is enabled?

I've been searching the 'net and the only issues I've been able to find with KEA and DNS have been solved and connected to AdGuardHome, Unbound, PiHole, IPv6... and I'm not using any of those.

Thank you for help.

I agree, that's why I thought it was really weird when I read that. I wish I could remember where. If I run across it again I'll post it.

ETA: I did some quick searches, and while I didn't find the reference I'm looking for, there are quite a few posts out there of others who thought the same thing. Wondering if something was worded in such a way to suggest it and has since been revised.

(...) it should be native. As long as it isn't I will not work on workarounds to that core issue. I hope thats understandable.

I used the provided 'delete button' with past Dnsmasq routers I had, it worked well, but that was quite some time ago. Yes I can understand how that might not be compatible with OPNsense now. Thank you for trying to get it working.

I only mentioned my script in case anyone else wants to explore something like that for themselves. I'm not sharing the script itself since I have no way of knowing what harm it could cause.

Thank you for clarifying on KEA. I wish I knew where I read that KEA was deprecated, as I got the impression it was the whole module, not just an API. Good to know it is actively maintained.

I saw that note on Github, that this wasn't going to be pursued.

I've been using a script to stop DMSmasq, edit files to remove the stuck lease, then restart DNSmasq. I haven't noticed any side effects, error log entries, etc. to indicate any problems, but I don't know how to actually confirm there isn't any problem caused by that. But I'm just a home user with a simple network, if I ever do cause myself some problem I can live with having to recover from it.

I thought I read somewhere that KEA was being deprecated?

This might not be your problem, but I've found that some providers, particularly wireless providers, sometimes drop the abnormally small ping packets sent by dpinger. For all of my gateways I set "Data Length" to 56 (you'll need to switch on "Advanced Mode" to see this option).

Just came in here again to say changing the data length to 56 has solved the issue for me (as far as dpinger giving false positives). I have been externally monitoring my own IP as well as the IP I am using for the monitor. The few failures I get now are due to monitor IP unreachable but my own connection was working.

I still need to think on monitoring as a whole in my situation. It is useful to me to know when my connection was disrupted, but only if actually true. If dpinger could check several IPs in series, and only if all fail assume the gateway unusable, it would mitigate the false positives from a single monitor IP being unreachable.

Does anyone know if there is a way to do multiple ping target IPs for the gateway monitor? Total of two or even three? If the first ping is unsuccessful, move to the second, if that's unsuccessful then try the third, and only assume the gateway is unavailable if all targets cannot be reached?

i found that using dns ip was a bad idea.

Same here, DNS IPs were fine for some testing but long term were not reliable.

For all of my gateways I set "Data Length" to 56

I believe this helped. I ran with this for the past two days. I still have a handful of dpinger entries like the ones I posted above, a significant reduction from before. I don't know for sure but the handful might be actual failures to contact my monitor IP. I still believe my own connection has been up. So now I question if using a monitor IP (in my particular situation) may give me too many false positives. I really just want to know if my own connection has been disrupted.

I have cable (Spectrum), nonetheless it's worth a try. Thank you! 😊

*** SOLVED *** see post #8   https://forum.opnsense.org/index.php?msg=260595


Currently on 26.1.1 but this started on 25.7.

OPNsense ran without issue for nearly two years, then after the upgrade to 25.7 we started having connection dropouts.

During a period of connection instability, the below is repeated several times in the gateway monitoring logs:

Warning dpinger exiting on signal 15
Notice  dpinger MONITOR: WAN_GW (Addr: xxx.xxx.xxx.xxx Alarm: down -> none RTT: 20.0 ms RTTd: 1.2 ms Loss: 0.0 %)
Warning dpinger send_interval 1000ms loss_interval 4000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 0ms loss_alarm 0% alarm_hold 10000ms dest_addr xxx.xxx.xxx.xxx bind_addr xxx.xxx.xxx.xxx identifier "WAN_GW "

I have tried so many IPs, from geographically close server IPs to Cloudflare and Google DNS IPs. None have worked, though some have caused more dpinger exits than others.

Several days ago I ran these tests:

1. Configured a nearby IP known to have near 100% uptime and fast response, in gateway monitoring. With my phone on cellular only (disabled wifi radio, disabled bluetooth), I ran continuous pings on that server for several hours.

2. Changed my phone to ping my own public IP for several hours.


No pings failed, but our internet connection still dropped periodically, and the dpinger entries were in the logs.


I disabled gateway monitoring after the above tests and we haven't had any more connection drops AFAIK.

I am just a home user and my OPNsense has very few minor tweaks over the default install. And while I don't strictly need dpinger - I have no backup connection - I like having a record of internet disruption especially when I've been away.

Is there anything else I can do/look at, to troubleshoot and (hopefully) get dpinger working well again?

Thank you for any help and info.

Kind regards.

I'm up on 26.1.1 now and my internet still goes through periods of instability. It still appears to be dpinger. As best I can tell, dpinger still isn't working right.

For a test, I used my cell phone solely on cellular service (wifi radio turned off) to run ping tests across two days. One day I ran all day against the new IP I selected from my tracert (the one mentioned above, that appeared to be solid and I have dpinger monitoring), and the next day I ran ping test against my own public IP.

My cell phone never failed a ping test to either IP. But dpinger continued to fail the monitoring IP and restarted (?) my gateway assignment.

I don't have any fallback internet method, so if my internet goes down there's nothing I can do about it. It would be nice to monitor and have a notification, but it's not necessary.

I disabled gateway monitoring a few days ago and so far my internet has been up and stable...

No worries! Thank you for confirming the behavior. I'll go see about that bug report, thanks!

I've used multiple machines and multiple browsers. Auto refresh is on.

Firewall just updated to 26.1.1 and I still have the same problem.

Did you try the specific example I gave? It looks like that might be the only one that doesn't work. I tried a query src_port contains and that one worked.

I tried the above specific criteria (address, is, <value>) with multiple LAN and public IPs and none of them worked for me.

Minor bug?

Firewall -> Logs - > Live View -> Templates. I have a few templates saved from prior versions (25.7 and prior) and these work fine.

After upgrading to 26.1, I entered criteria for a template and got my expected result list. I saved it as a new template.

The saved template does not bring up any result. If I reenter criteria and apply it to the log, I get a result.

Sample criteria:

Change "action" in dropdown to "address"
Change "contains" in dropdown to "is"
Enter some address in search box that has log entries - I entered 192.168.1.9

Applying the above criteria brings up several records. I save it as a template, leave the firewall log and display some other page like the Dashboard. Then I come back to the firewall log and choose the new template. Nothing is displayed.