"Recent posts
#1
26.7 Series / Re: Interfaces: Virtual IPs: S...
Last post by MK4L - Today at 06:39:41 PMQuote from: RES217AIII on Today at 05:26:01 PMIf I understand correctly, you want to use OPNsense purely as a Layer 2 bridge and disable all services.
You want to avoid unpacking or readdressing IP packets (no NAT) and consulting routing tables in order to minimize latency.
That's a valid idea!
Thank you for understanding. It is is also why I see gold in this setup that would otherwise require much more complex alternatives.
I just wish the team had seen it as well.
I kid you not that it occurred to me more than once to ask them to keep it for a fee!
Where would you find a FREE Traffic Shaper that would not mess up your routes?
The response was like: Get lost. Sad.
Quote from: RES217AIII on Today at 05:26:01 PMHowever, doing so means you aren't utilizing 90% of OPNsense's capabilities.
OPNsense is a stateful L3/L4 router with firewalling features.
Those I implement standalone. I manage heavy traffic over a total of ~ 300 Mbps over multiple links. Shaping is something I cannot function without!
The only time I wanted to test IDS on the same box, I lost both under load :D
Quote from: RES217AIII on Today at 05:26:01 PMI get the feeling that specialized solutions would be far better and offer higher performance for your use case than trying to force OPNsense to do something it wasn't designed for.
Hardware solutions that promise shaping end up *queuing* and not *piping*.
I tried queuing in hardware and software and it never delivers.
On a final note: This forum thread managed to actually poison DeepSeek :D Like it is the main source on the subject.
#2
Hardware and Performance / Re: Warning about RealTek adap...
Last post by Bob.Dig - Today at 06:26:16 PMRTL8126 is very solid to me in Windows. There is some CPU utilization but that could be come in part from SMB too. And I paid 30 bugs for two cards. Feels like a no-brainer.
#3
26.7 Series / Re: Error message with schedul...
Last post by Mming - Today at 06:02:53 PMI totally missed that one, for some reason I assumed a field for comments. Once that was cleared out if works as it should.
/Mm
/Mm
#4
26.7 Series / Re: Interfaces: Virtual IPs: S...
Last post by RES217AIII - Today at 05:26:01 PMIf I understand correctly, you want to use OPNsense purely as a Layer 2 bridge and disable all services.
You want to avoid unpacking or readdressing IP packets (no NAT) and consulting routing tables in order to minimize latency.
That's a valid idea!
However, doing so means you aren't utilizing 90% of OPNsense's capabilities.
OPNsense is a stateful L3/L4 router with firewalling features.
I get the feeling that specialized solutions would be far better and offer higher performance for your use case than trying to force OPNsense to do something it wasn't designed for.
"mode=other" was a hack in the source code. The OPNsense team removed the mode because it was architecturally unsound and caused confusion in standard setups—even though it had worked for 10 years.
I hope you find the best solution for your needs, but it is possible that OPNsense—in its current and future versions—is no longer the right fit.
You want to avoid unpacking or readdressing IP packets (no NAT) and consulting routing tables in order to minimize latency.
That's a valid idea!
However, doing so means you aren't utilizing 90% of OPNsense's capabilities.
OPNsense is a stateful L3/L4 router with firewalling features.
I get the feeling that specialized solutions would be far better and offer higher performance for your use case than trying to force OPNsense to do something it wasn't designed for.
Quote from: franco on August 17, 2026, 08:05:44 AM> community/25.1/25.1.3:o interfaces: remove defunct "other" VIP type
To our knowledge it wasn't even creating a VIP, just being selectable in some legacy pages as a single pseudo-alias and we simply did not want to bring this cruft into MVC to ease future maintenance burden.
Cheers,
Franco
"mode=other" was a hack in the source code. The OPNsense team removed the mode because it was architecturally unsound and caused confusion in standard setups—even though it had worked for 10 years.
I hope you find the best solution for your needs, but it is possible that OPNsense—in its current and future versions—is no longer the right fit.
#5
26.7 Series / Re: APC UPS deamon plugin stop...
Last post by beneix - Today at 05:01:03 PMI do not have NUT installed. I found these entries in the backend log, but they aren't too helpful as there is no clue to why apcaccess returns exit status 1:
2026-08-18T16:56:49
Error
configd.py
[ba0645b2-b032-4318-b12a-b5c037461565] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:39
Error
configd.py
[4740dfe5-0cc3-4a44-8aec-902f153d0d7f] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:29
Error
configd.py
[f34fb567-56f2-4914-b3dd-083688ded618] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:19
Error
configd.py
[edd0785d-d8de-4189-888c-146b543a9198] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:09
Error
configd.py
[1282142a-6513-4ea2-896c-b806c61638fe] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:49
Error
configd.py
[ba0645b2-b032-4318-b12a-b5c037461565] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:39
Error
configd.py
[4740dfe5-0cc3-4a44-8aec-902f153d0d7f] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:29
Error
configd.py
[f34fb567-56f2-4914-b3dd-083688ded618] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:19
Error
configd.py
[edd0785d-d8de-4189-888c-146b543a9198] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
2026-08-18T16:56:09
Error
configd.py
[1282142a-6513-4ea2-896c-b806c61638fe] Script action failed with Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/sbin/apcaccess ' returned non-zero exit status 1.
#6
26.7 Series / PF states created with route-t...
Last post by geri441 - Today at 04:59:30 PMHi,
I am seeing what looks like a PF/gateway initialization issue after boot on OPNsense 26.7.2_2.
Environment
OPNsense 26.7.2_2
FreeBSD 15.1-RELEASE-p2
amd64
WAN uses an Intel ix interface with a static IPv4 gateway.
The firewall also has several internal interfaces/VLANs with rules that explicitly use the WAN gateway for Internet traffic.
Problem
Shortly after boot, the kernel repeatedly logs:
arpresolve: can't allocate llinfo for 0.0.0.0 on ix0
While this is happening, the routing table itself is correct.
For example:
default <WAN_GATEWAY> UGS ix0
and:
route -n get 0.0.0.0
route to: 0.0.0.0
destination: 0.0.0.0
mask: 0.0.0.0
gateway: <WAN_GATEWAY>
interface: ix0
flags: <UP,GATEWAY,DONE,STATIC>
The currently loaded PF rules are also correct and contain:
route-to (ix0 <WAN_GATEWAY>)
There are no active rules containing:
route-to (ix0 0.0.0.0)
However, some PF states created shortly after boot contain:
route-to: 0.0.0.0@ix0
For example:
all udp <INTERNAL_HOST_A>:514 <- <INTERNAL_HOST_B>:514
route-to: 0.0.0.0@ix0
I also found affected states for normal Internet traffic, so this is not limited to one internal destination.
Examples included HTTPS traffic to public IP addresses such as:
1.1.1.1:443
8.8.8.8:443
In the diagnostic capture there were several dozen states containing:
route-to: 0.0.0.0@ix0
Timing
The bad states appear very early after boot.
In one capture, system uptime was only a few minutes and the affected PF states were almost the same age, indicating they had been created roughly during the first minute after startup.
The arpresolve errors started afterward and continued while those states existed.
Test performed
Once the firewall was fully booted, I flushed the state table:
pfctl -F states
No firewall rules, aliases, gateways, NAT configuration, or interfaces were changed.
Immediately afterward:
pfctl -ss -vv | grep 'route-to: 0\.0\.0\.0@ix0'
returned no results.
New states were then recreated automatically by normal traffic and all of them used the correct gateway:
route-to: <WAN_GATEWAY>@ix0
For example:
route-to: <WAN_GATEWAY>@ix0
route-to: <WAN_GATEWAY>@ix0
route-to: <WAN_GATEWAY>@ix0
The kernel arpresolve messages also stopped. The last recorded message remained at the same kernel uptime timestamp even several minutes after the state flush.
I suspect there may be a boot-time ordering/race condition where some policy-routed states are created before the WAN gateway information is fully available to PF.
Has anyone else seen PF states being created with route-to: 0.0.0.0 during early boot on 26.7.x?
I am seeing what looks like a PF/gateway initialization issue after boot on OPNsense 26.7.2_2.
Environment
OPNsense 26.7.2_2
FreeBSD 15.1-RELEASE-p2
amd64
WAN uses an Intel ix interface with a static IPv4 gateway.
The firewall also has several internal interfaces/VLANs with rules that explicitly use the WAN gateway for Internet traffic.
Problem
Shortly after boot, the kernel repeatedly logs:
arpresolve: can't allocate llinfo for 0.0.0.0 on ix0
While this is happening, the routing table itself is correct.
For example:
default <WAN_GATEWAY> UGS ix0
and:
route -n get 0.0.0.0
route to: 0.0.0.0
destination: 0.0.0.0
mask: 0.0.0.0
gateway: <WAN_GATEWAY>
interface: ix0
flags: <UP,GATEWAY,DONE,STATIC>
The currently loaded PF rules are also correct and contain:
route-to (ix0 <WAN_GATEWAY>)
There are no active rules containing:
route-to (ix0 0.0.0.0)
However, some PF states created shortly after boot contain:
route-to: 0.0.0.0@ix0
For example:
all udp <INTERNAL_HOST_A>:514 <- <INTERNAL_HOST_B>:514
route-to: 0.0.0.0@ix0
I also found affected states for normal Internet traffic, so this is not limited to one internal destination.
Examples included HTTPS traffic to public IP addresses such as:
1.1.1.1:443
8.8.8.8:443
In the diagnostic capture there were several dozen states containing:
route-to: 0.0.0.0@ix0
Timing
The bad states appear very early after boot.
In one capture, system uptime was only a few minutes and the affected PF states were almost the same age, indicating they had been created roughly during the first minute after startup.
The arpresolve errors started afterward and continued while those states existed.
Test performed
Once the firewall was fully booted, I flushed the state table:
pfctl -F states
No firewall rules, aliases, gateways, NAT configuration, or interfaces were changed.
Immediately afterward:
pfctl -ss -vv | grep 'route-to: 0\.0\.0\.0@ix0'
returned no results.
New states were then recreated automatically by normal traffic and all of them used the correct gateway:
route-to: <WAN_GATEWAY>@ix0
For example:
route-to: <WAN_GATEWAY>@ix0
route-to: <WAN_GATEWAY>@ix0
route-to: <WAN_GATEWAY>@ix0
The kernel arpresolve messages also stopped. The last recorded message remained at the same kernel uptime timestamp even several minutes after the state flush.
I suspect there may be a boot-time ordering/race condition where some policy-routed states are created before the WAN gateway information is fully available to PF.
Has anyone else seen PF states being created with route-to: 0.0.0.0 during early boot on 26.7.x?
#7
26.7 Series / Re: Interfaces: Virtual IPs: S...
Last post by MK4L - Today at 04:44:29 PMQuote from: Monviech (Cedrik) on Today at 01:32:14 PMIf it cannot be explained properly and everybody is confused occam's razor makes it look like this:
https://xkcd.com/1172/
Believe me I tried, but your heating children are standing in my way :D :D
#8
26.7 Series / Re: Interfaces: Virtual IPs: S...
Last post by MK4L - Today at 04:43:03 PMQuote from: lmoore on Today at 02:09:20 PMThis suggests you are experiencing ARP issues over the bridge where the router on the other side of the bridge does not receive the ARP request and/or vice-versa.
A transparent bridge operates by forwarding Ethernet frames based on MAC addresses. It doesn't look at IP addresses or make routing decisions.
Since I'm not interested in messing up the routing AS IT IS in my setup, I will never set a default route to the WAN.
I have multiple destination networks on both sides, and I'm not giving that up. Ever.
#9
26.7 Series / Re: Error message with schedul...
Last post by meyergru - Today at 02:44:12 PMDid you put the actual string "Hourly config backup to Git/Forgejo" into the cron job parameter for "remote backup" instead of a random delay?
#10
General Discussion / Re: os-ddclient plugin doesn't...
Last post by drosophila - Today at 02:38:03 PMThe ddclient updater programs are a little simple-minded. They assume they run on the same server that hosts the service, not on a router that may handle more than one server on more than one WAN / LAN link. If it were IPv6 then you might get away with using "dynamic IPv6 host" from the advanced configuration, but there doesn't seem to be an equivalent to that for IPv4.
