Recent posts

#1

High availability / HA with prefix delegation: Wro...

Last post by ajr - Today at 02:55:18 PM

In this HA setup, there are some VLANS, which are associated to WLANS by
unifi accesspoints. Each of them has a different subnet (by prefix id).
Prefix delegation works correctly and assigns addresses from the right prefix
to the mobile clients (using Track interface).
The setup is the same as described here https://forum.opnsense.org/index.php?topic=50602.msg259211#msg259211
The IP6 gateway announced in the past was that from system->gateways
(WAN_DHCP6), which is the LLA of the DSL-Router (fe80::cece:1eff:feb3:757f) and worked perfectly on failover.
This changed recently to LLAs like fe80::20d:b9ff:fe48:5c1e, which are unusable.

How can I force radvd to announce WAN_DHCP6 ?

Version:  26.7.8_2

#2

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by tuto2 - Today at 02:36:32 PM

I don't have any further insight or experience to contribute at this stage, but what module coding and link partners have been tested? We don't have a non-production DEC appliance, but we do have DACs, AOCs, and SR/LR SFP28 modules on hand that we can recode at will, so if there's a specific combination that hasn't been tested (or needs validation) I might be able to provide another test case.

This seems to be the culprit: https://github.com/opnsense/src/commit/27ffeba0e6b5b8d8ebb8eec9d2566f56421ee946

There's a test kernel available if you want to give it a go:

# opnsense-update -zkr 26.7.8-next

Reboot afterwards, link should come up immediately on boot without the tunable.

#3

Portuguese - Português / Re: Crash - Atualizando do 26....

Last post by Micheale45 - Today at 02:30:20 PM

Pelos relatos, eu começaria por verificar o espelho de atualização antes de remover o AdGuard. O caso do servidor virtualizado indica que a troca do Cloudflare (São Paulo) pelo espelho oficial de Amesterdão resolveu um erro de validação SHA-256. Isso não prova que seja a mesma causa no teu caso, mas é um teste simples e bastante pertinente. Se voltar a falhar, seria útil partilhar o erro completo e os logs de atualização para perceber se é um problema de integridade do pacote, do repositório ou de algum plugin. E, antes de novas tentativas, convém guardar um backup da configuração.

#4

26.7, 26.10 Series / Re: Messages in firewall log w...

Last post by mooh - Today at 02:18:06 PM

I'm the maintainer of the ndp proxy btw, if you find something actionable I can help, but just a logging issue isn't actionable from my side right now.

I didn't mean to push you or anyone. I'm looking for pointers because I'm at a loss how to proceed investigating other than reading the code.

For example, there are a number of automatic rules that would fit the logged messages, but they are "ipv6-icmp from (self) to fe80::/10 icmp6-type neighbrsol", etc. Is there a chance that packets forwarded by the proxy match "(self)" even though the actual source address is not one of the firewall's?

#5

26.7, 26.10 Series / Re: [SOLVED] WAN PPPoE IPv6 de...

Last post by Taomyn - Today at 02:17:30 PM

Ok so far so good.  The -n option for dhcp6c is at "Interfaces: Settings: Prevent Release" which is an advanced setting. Try disabling this to see if it still works as expected.  It needs a reboot to take effect.


Cheers,
Franco

I disabled that as well now, rebooted and so far still working - no idea why that was enabled, maybe left over from the last time I tried to get IPv6 working a few years back.

#6

26.1, 26.4 Legacy Series / Re: os-kea-ubnd-ddns v0.98 — K...

Last post by peneal - Today at 02:06:16 PM

@tkreagan

Have you had the chance to have a look at what @kevindd992002 mentioned?

How is the acceptance into the official community plugins going so far?

#7

26.7, 26.10 Series / Re: No health graphs since 26....

Last post by szty0pa - Today at 01:39:16 PM

@cookiemonster No recent HW-changes, same (bare-metal) OPNsense version as you have. Strange, have to investigate it further then. My hunch is that the data collecting cronjob is not running for some reason.

@tuto2 No, i'm on community release. There is a line in the changelog which made me think that it has been changed: "In other news, ECMP route support has hit the development version along with cloneable widgets for the health graphs and a general improvement with the health graphs while at it." Data collection stopped right after the update on all my OPNsense routers.

#8

General Discussion / Re: Dnsmasq authoratative only...

Last post by nintendoeats - Today at 01:10:06 PM

What's bothering you exactly ?!

Yeah, tbh I'm using it because it's the DHCP/DNS system in OPNsense that I can get my head around. Assign name and IP to host via MAC, there is no step 2.

#9

German - Deutsch / Re: OPNsense VM klonen, irgend...

Last post by JeGr - Today at 01:04:53 PM

Danke @meyergru, dann bin ich beruhigt und schön, dass es so easy ist.

Je nach Hypervisor kümmert der sich normalerweise um Dinge wie "neue MAC für die geclonten NICs" - ein Blick reinwerfen ist aber nicht verkehrt. Ansonsten die IPs nicht vergessen ggf. zu ändern (sollten beide nebeneinander laufen), nicht dass du dich mit IP Konflikten rumschlagen musst :)

#10

German - Deutsch / Re: Performance verbessern

Last post by JeGr - Today at 01:03:18 PM

Vielleicht durch Tuneables. Oder unbound Einstellungen um DNS Auflösung zu beschleunigen.

Nichts davon würde sich auf einen iperf3 Test niederschlagen. Maximal noch tunables am Interface und die würden generell gelten und wären nicht zenarmor spezifisch (also Dinge, die sich explizit auf den NIC Typ o.ä. beziehen).

Da der Unterschied SO groß ist und single core noch ein Ding, würde ich stark auf CPU locked tippen, da gibts dann keine Schraube außer "mit Hardware auf das Problem feuern", was helfen würde.

Cheers