"Recent posts
#1
Zenarmor (Sensei) / Re: Certain Youtube videos kee...
Last post by sy - Today at 03:00:22 PMHi,
This could be a netmap-related issue. Have you tried running Zenarmor in bypass mode to see if the problem persists? Additionally, what is the current throughput?
This could be a netmap-related issue. Have you tried running Zenarmor in bypass mode to see if the problem persists? Additionally, what is the current throughput?
#2
26.7 Series / Re: [26.7.4_1]Intermittent con...
Last post by meyergru - Today at 02:30:17 PMAny specific reason not to leave handling of the physical NIC to PVE via virtio, as described here?
That would also take the igc/iflib driver path inside OPNsense out of the equation.
That would also take the igc/iflib driver path inside OPNsense out of the equation.
#3
26.7 Series / [26.7.4_1]Intermittent connect...
Last post by dragao-azul - Today at 02:10:04 PMHi,
Long time lurker (thanks everyone, very useful posts), first time poster.
I'm having an issue since the 15th/16th of September that results in momentary connection drops.
Context:
I use opnsense as a firewall in my homelab, I was away for some time and on my return I immediately started experiencing occasional internet drops for 8-10sec.
OPNsense is virtualised in proxmox with the NICs (I226-V) passthroughed directly to the VM. CPU is in host mode (4 vCPUs, physical CPU is an N150).
On debug, I saw proxmox CPU usage history with higher spikes since the aforementioned dates - so I suspect that's when it started.
Current observations:
If I monitor the ping to 8.8.8.8 or 9.9.9.9 (in fact I used both simultaneously) - I sometimes get spikes of 5-10sec. During this time, I simultaneously looked at CPU usage and the system usage spikes. ChatGPT got involved from here to help debug and may be taking me in wrong directions - it did help spot that clock{clock (0)} consumes 100% of 1 CPU over this time, but I'm not sure if this by itself is very valuable.
I'm trying to progress from here but I feel like I'm getting into the weeds of the kernel's working. Is there a recommended debug strategy for this? Since the dates coincide with the latest updates was any known change introduced? The only thing that stood out (disclaimer disclaimer: helped by ChatGPT to spot it) was "o src: iflib: assorted upstream patches from stable/15" but since it was working before it would imply a regression.
In the meanwhile I'll keep trying to break down this clock thread that spikes.
Many thanks!
Long time lurker (thanks everyone, very useful posts), first time poster.
I'm having an issue since the 15th/16th of September that results in momentary connection drops.
Context:
I use opnsense as a firewall in my homelab, I was away for some time and on my return I immediately started experiencing occasional internet drops for 8-10sec.
OPNsense is virtualised in proxmox with the NICs (I226-V) passthroughed directly to the VM. CPU is in host mode (4 vCPUs, physical CPU is an N150).
On debug, I saw proxmox CPU usage history with higher spikes since the aforementioned dates - so I suspect that's when it started.
Current observations:
If I monitor the ping to 8.8.8.8 or 9.9.9.9 (in fact I used both simultaneously) - I sometimes get spikes of 5-10sec. During this time, I simultaneously looked at CPU usage and the system usage spikes. ChatGPT got involved from here to help debug and may be taking me in wrong directions - it did help spot that clock{clock (0)} consumes 100% of 1 CPU over this time, but I'm not sure if this by itself is very valuable.
I'm trying to progress from here but I feel like I'm getting into the weeds of the kernel's working. Is there a recommended debug strategy for this? Since the dates coincide with the latest updates was any known change introduced? The only thing that stood out (disclaimer disclaimer: helped by ChatGPT to spot it) was "o src: iflib: assorted upstream patches from stable/15" but since it was working before it would imply a regression.
In the meanwhile I'll keep trying to break down this clock thread that spikes.
Many thanks!
#4
General Discussion / Re: Unable to upgrade v25.7.11...
Last post by chrisb - Today at 01:54:38 PMThank you for all the information, we will explore.
#5
General Discussion / Re: Unbound DNS hard restarts ...
Last post by franco - Today at 01:36:19 PMYes, Unbound restarts and this zeros the (runtime) statistics. Unbound DNS reporting may be something more persistent you want to consider.
Cheers,
Franco
Cheers,
Franco
#6
General Discussion / Re: Unable to upgrade v25.7.11...
Last post by franco - Today at 01:34:33 PM> No route to host
There will be no new insights from audits. Fix routing first. If your clients have Internet it could still be misconfigured on the firewall for local connections.
Cheers,
Franco
There will be no new insights from audits. Fix routing first. If your clients have Internet it could still be misconfigured on the firewall for local connections.
Cheers,
Franco
#7
26.7 Series / Re: Intel E810 fails to link o...
Last post by MajorP93 - Today at 01:08:26 PMQuote from: tuto2 on September 16, 2026, 11:55:07 AMI tested this on all the Deciso appliance variants running the E810 with 10G-SR and 25G-SR fiber optics. All link and communicate just fine with the DDP package loaded. The link may take a few cycles to come up, but this shouldn't be a problem.
Reading all of the reports in here, as well as https://forum.opnsense.org/index.php?topic=52405 I'm seeing quite some variablity in reported firmware version and indeed https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296989 also reports versions >= 4.60. The only report in the forum post concerning a DEC4280 was on a non-standard firmware version (DEC devices run NVM 4.30), which is not something that's supported.
Maybe this is something worth mentioning in documentation (E810 NVM firmware versions that are officially supported / verified).
#8
26.7 Series / Re: How to reorganize the chan...
Last post by franco - Today at 12:49:48 PMQuote from: BigFreddy on September 19, 2026, 08:31:02 AMWhat I had in mind when I was making this post was that it would be a good idea to divide the changelog into more readable sections, in my mind, these three would make more sense: Security, Breaking Changes, Developer Notes then under them, list the changelogs that apply per each section.
I can see the value, but, traditionally, journalism was a way for digested information to be readily available in the past. There's not a lot of tech journalism still around and interested in networking projects. And we don't want to spend too much time doing blog-post analysis of things that are going on which few people will read no matter how good it is written.
We also can't stop publishing the release notes in the format we have because the development digest has the biggest value for looking for regressions. Breaking changes are only really intended for major upgrades and are listed as "migration notes". Security issues vary wildly in scope. You'll have links to most security issues. Things may change on the front, but there are no concrete plans yet.
Cheers,
Franco
#9
General Discussion / Re: What are firewall rules as...
Last post by OzziGoblin - Today at 12:47:36 PMWow, that's fantastic, thanks Patrick
#10
German - Deutsch / Re: 'Migration Assistant ' der...
Last post by OPNjk - Today at 12:47:31 PMIch hänge mich hier mal an den Thread an:
Ich habe die Firewall-Rules auf einem meiner Cluster schon sehr lange per Migration-Assistant migriert und heute auch die Outbound-NAT-Rules durch Source-NAT-Rules ersetzt (26.7.4_1). Auf der aktiven Firewall ist der "Migration-Assistant" Menu-Punkt seither auch verschwunden (ebenso der Outbound-NAT Menupunkt). Auf der Standby-Firewall gibt es aber beide Untermenus noch. Der Migration-Assistant dort würde auch gerne die "Current Rules" für Firewall und Outbound NAT exportieren wollen.
Müsste man die Legacy Firewall Rules und die Outbound NAT Rules auf der Standby-Firewall auch im Assistant noch manuell löschen? Wird das ggf. nicht synchronisiert?
Vielen Dank!
EDIT: https://github.com/opnsense/core/issues/10289 scheint das Problem zu beschreiben. Hat aber niemand kommentiert.
Ich habe die Firewall-Rules auf einem meiner Cluster schon sehr lange per Migration-Assistant migriert und heute auch die Outbound-NAT-Rules durch Source-NAT-Rules ersetzt (26.7.4_1). Auf der aktiven Firewall ist der "Migration-Assistant" Menu-Punkt seither auch verschwunden (ebenso der Outbound-NAT Menupunkt). Auf der Standby-Firewall gibt es aber beide Untermenus noch. Der Migration-Assistant dort würde auch gerne die "Current Rules" für Firewall und Outbound NAT exportieren wollen.
Müsste man die Legacy Firewall Rules und die Outbound NAT Rules auf der Standby-Firewall auch im Assistant noch manuell löschen? Wird das ggf. nicht synchronisiert?
Vielen Dank!
EDIT: https://github.com/opnsense/core/issues/10289 scheint das Problem zu beschreiben. Hat aber niemand kommentiert.
