"Recent posts
#1
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - October 25, 2026, 10:55:08 PMHi babagoo,
Good news first: your health audit shows that the kernel and the base system are fine, with no missing or altered files. The version mismatch lines only appear because the update stopped halfway. Nothing seems broken.
The real problem is that the download stops. The first packages arrive, then one fails, and the security audit also cannot fetch its file. The small catalogue check works, so the connection exists but larger transfers break. Since it is the same on both firewalls and with different mirrors, I would look at the network of your virtual machines first.
Some things to try, one at a time:
1. Under System, Settings, General, tick the option to prefer IPv4 over IPv6, save, and try the update again.
2. Check that DNS answers quickly from the firewall, using Interfaces, Diagnostics, DNS Lookup.
3. Try the update again later, in case the mirror had a short problem.
4. Check that the virtual machine has enough free disk space.
5. As a test, try a smaller or different network adapter type for the NAT interface in VMware.
If the update stops again at the same package, please tell us which one. That helps to see if it is always the same file.
Sergio
Good news first: your health audit shows that the kernel and the base system are fine, with no missing or altered files. The version mismatch lines only appear because the update stopped halfway. Nothing seems broken.
The real problem is that the download stops. The first packages arrive, then one fails, and the security audit also cannot fetch its file. The small catalogue check works, so the connection exists but larger transfers break. Since it is the same on both firewalls and with different mirrors, I would look at the network of your virtual machines first.
Some things to try, one at a time:
1. Under System, Settings, General, tick the option to prefer IPv4 over IPv6, save, and try the update again.
2. Check that DNS answers quickly from the firewall, using Interfaces, Diagnostics, DNS Lookup.
3. Try the update again later, in case the mirror had a short problem.
4. Check that the virtual machine has enough free disk space.
5. As a test, try a smaller or different network adapter type for the NAT interface in VMware.
If the update stops again at the same package, please tell us which one. That helps to see if it is always the same file.
Sergio
#2
High availability / Re: HA: Enter CARP Maintenance...
Last post by patient0 - October 25, 2026, 10:31:00 PMQuote from: mossi2000 on October 25, 2026, 09:53:41 PMwould have sworn that it I had seen under HAIt's always been under 'Virtual IPs' and the naming was never logical to me. But it is how it is and keeps your brain active :)
#3
High availability / Re: HA: Enter CARP Maintenance...
Last post by mossi2000 - October 25, 2026, 09:53:41 PMHi BonetTech,
this was it. See screenshot. Thanks.
Then I can continue to test if everything works.
I would have sworn that it I had seen under HA....where it definitely would make sense...
this was it. See screenshot. Thanks.
Then I can continue to test if everything works.
I would have sworn that it I had seen under HA....where it definitely would make sense...
#4
High availability / CARP update of backup firewall...
Last post by babagoo - October 25, 2026, 09:48:46 PMI have a CARP setup in VMware workstation (NAT and Host-only networks) with both firewalls on opnsense version 26.7.6. I am trying to update to version 26.7.7. I get this error when I try to update the backup firewall:
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:37:48 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: ...
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
Health audit output:
***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:40:49 GMT 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.7.6 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.7.6 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-vmware 1.5_1
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.7.6 has 69 dependencies to check.
Checking packages: .........................
opnsense-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
opnsense-update-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
php85-ctype-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-curl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-dom-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-filter-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-gettext-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-ldap-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pcntl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pdo-8.5.11 version mismatch, expected 8.5.12
Checking packages: .....
php85-session-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-simplexml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sockets-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sqlite3-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-xml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-zlib-8.5.11 version mismatch, expected 8.5.12
Checking packages: ...................... done
***DONE***
Security audit output:
***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:39:14 GMT 2026
Fetching vuln.xml.xz: ..
pkg: An error occurred while fetching package
pkg: cannot fetch vulnxml file
***DONE***
I have tried different mirrors (same on both firewalls first) for updates with the same error. I only started using opnsense 4 months ago and I am getting more familiar with the product. Can anyone help please?
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:37:48 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: ...
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
Health audit output:
***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:40:49 GMT 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.7.6 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.7.6 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-vmware 1.5_1
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.7.6 has 69 dependencies to check.
Checking packages: .........................
opnsense-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
opnsense-update-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
php85-ctype-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-curl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-dom-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-filter-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-gettext-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-ldap-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pcntl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pdo-8.5.11 version mismatch, expected 8.5.12
Checking packages: .....
php85-session-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-simplexml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sockets-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sqlite3-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-xml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-zlib-8.5.11 version mismatch, expected 8.5.12
Checking packages: ...................... done
***DONE***
Security audit output:
***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:39:14 GMT 2026
Fetching vuln.xml.xz: ..
pkg: An error occurred while fetching package
pkg: cannot fetch vulnxml file
***DONE***
I have tried different mirrors (same on both firewalls first) for updates with the same error. I only started using opnsense 4 months ago and I am getting more familiar with the product. Can anyone help please?
#5
26.7 Series / Re: Crowdsec not starting (fou...
Last post by tangofan - October 25, 2026, 09:18:17 PMAccording to the docs at https://docs.opnsense.org/manual/aliases.html you can indeed use fully-qualified domain names in aliases, though I haven't tried that myself.
I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.
Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at irewall: Diagnostics: States on the action tab. For good measure I usually click both button there.
Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.
I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.
Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at irewall: Diagnostics: States on the action tab. For good measure I usually click both button there.
Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.
#6
26.7 Series / Crowdsec not starting (found s...
Last post by Amodin - October 25, 2026, 07:42:39 PMReferencing this post: https://forum.opnsense.org/index.php?topic=47580.0
I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services. When I did that, Crowdsec refused to start, even after rebooting the OPN machine.
Following that post, I found it odd that I had to disable the ruleset to get it started.
1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names? I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group. It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming. It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.
I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services. When I did that, Crowdsec refused to start, even after rebooting the OPN machine.
Following that post, I found it odd that I had to disable the ruleset to get it started.
1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names? I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group. It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming. It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.
#7
26.7 Series / Re: PPPoE over an unassigned V...
Last post by fanski - October 25, 2026, 07:39:22 PMQuoteIt looks like something is broken in LCP/PAP (ppp[72477]: [wan_link0] LCP: auth: peer wants PAP, I want nothing).
Hi GOJ,
not sure if this is really a problem of OPNSense.
I have the same with my 26.7.1 where the connection is working.
The problem is more the "ppp[72477]: [wan_link0] MESG: Access Denied" message I guess where your provider denies your access for whatever reason.
Also it isn't the same issue I have as my PPPoE doesn't even start, yours is working. At least you are connecting to your provider while mine just times out.
Not sure but maybe there is something wrong with the access to your provider?
Regards,
Fanski
#8
High availability / Re: HA: Enter CARP Maintenance...
Last post by BoNetTech - October 25, 2026, 07:36:51 PMHi mossi2000,
Thank you for the screenshot. That page, System, High Availability, Status, shows the firmware versions of the backup unit and the services that can be restarted, and as far as I remember it never had the buttons for CARP. The firmware versions on both units are the same, which is good.
The buttons for disabling CARP and for persistent maintenance mode used to be on a different page: Interfaces, Virtual IPs, Status. Could you open that page on the master and tell us what you see there? Are the buttons missing there too?
If they are missing there, please do a full reload without cache or try a private browser window, and also check the privileges of the user you log in with, if it is not root.
It would also help to know whether the virtual addresses show as master on the first unit and backup on the second, and whether persistent maintenance mode is already active, because then the button text changes.
Sergio
Thank you for the screenshot. That page, System, High Availability, Status, shows the firmware versions of the backup unit and the services that can be restarted, and as far as I remember it never had the buttons for CARP. The firmware versions on both units are the same, which is good.
The buttons for disabling CARP and for persistent maintenance mode used to be on a different page: Interfaces, Virtual IPs, Status. Could you open that page on the master and tell us what you see there? Are the buttons missing there too?
If they are missing there, please do a full reload without cache or try a private browser window, and also check the privileges of the user you log in with, if it is not root.
It would also help to know whether the virtual addresses show as master on the first unit and backup on the second, and whether persistent maintenance mode is already active, because then the button text changes.
Sergio
#9
26.1, 26,4 Series / Re: PHP2Shell security fix for...
Last post by weilander - October 25, 2026, 06:55:04 PMHi Franco,
I understand your point, and I don't disagree with the technical advice. In fact, newsense's recommendation made me reconsider my approach, and as you can see, I ultimately followed it. I also appreciate the work you put into providing the PHP security update for 26.1.
But I do think there's a difference between giving the right advice and the way that advice is delivered.
I came here with a genuine question, asked politely, and explained why I was hesitant to rush a major upgrade on a production firewall. I wasn't questioning the importance of security updates or expecting unsupported versions to be maintained indefinitely.
Being told that I had "far bigger issues than a couple php vulnerabilities" and that there was "no reason to wait for miracles" felt unnecessarily dismissive. The same technical advice could have been given clearly and firmly without those remarks.
I wouldn't have chosen tracker's rather harsh wording either. But I do think he has a point about how people communicate with each other in technical forums.
Being technically right and treating someone respectfully are not mutually exclusive. Especially when someone comes here looking for help.
I'm grateful for the advice and support I received, and the successful upgrade speaks for itself. I just think the tone matters, too.
Cheers,
Michael
I understand your point, and I don't disagree with the technical advice. In fact, newsense's recommendation made me reconsider my approach, and as you can see, I ultimately followed it. I also appreciate the work you put into providing the PHP security update for 26.1.
But I do think there's a difference between giving the right advice and the way that advice is delivered.
I came here with a genuine question, asked politely, and explained why I was hesitant to rush a major upgrade on a production firewall. I wasn't questioning the importance of security updates or expecting unsupported versions to be maintained indefinitely.
Being told that I had "far bigger issues than a couple php vulnerabilities" and that there was "no reason to wait for miracles" felt unnecessarily dismissive. The same technical advice could have been given clearly and firmly without those remarks.
I wouldn't have chosen tracker's rather harsh wording either. But I do think he has a point about how people communicate with each other in technical forums.
Being technically right and treating someone respectfully are not mutually exclusive. Especially when someone comes here looking for help.
I'm grateful for the advice and support I received, and the successful upgrade speaks for itself. I just think the tone matters, too.
Cheers,
Michael
#10
Development and Code Review / Re: Freeradius VLAN fallback c...
Last post by franco - October 25, 2026, 06:11:43 PMHi Claudio,
I asked Michael for comment.
Thanks,
Franco
I asked Michael for comment.
Thanks,
Franco
