"Recent posts
#1
26.7 Series / Re: webgui stops respoding con...
Last post by franco - Today at 07:11:43 AMCheck the log?
# opnsense-log backend
It's rather rare configd will not start or fail to run.
Cheers,
Franco
# opnsense-log backend
It's rather rare configd will not start or fail to run.
Cheers,
Franco
#2
26.7 Series / Re: Confused by 26.7 upgrade
Last post by franco - Today at 07:09:26 AMSome people are not aware, but it bears repeating:
In the context of the BSD licenses, the "as is" provision means that the software is provided without warranties, and the authors generally disclaim liability for issues, failures, or damages resulting from its use, including operational errors.
We try our best to describe the changes. The code is open so it also documents the changes in a straightforward (but still very technical) way. If you want more you may want to consider participating in this process: the documentation is open and the changelogs are open too.
Cheers,
Franco
In the context of the BSD licenses, the "as is" provision means that the software is provided without warranties, and the authors generally disclaim liability for issues, failures, or damages resulting from its use, including operational errors.
We try our best to describe the changes. The code is open so it also documents the changes in a straightforward (but still very technical) way. If you want more you may want to consider participating in this process: the documentation is open and the changelogs are open too.
Cheers,
Franco
#3
26.7 Series / Re: Wireguard vs. DNS resoluti...
Last post by oc - Today at 02:36:55 AMMy understanding is that the "Renew DNS for Wireguard on stale connections" script helps when one of the S2S endpoints with a dynamic IP resolved by means of an alias is changing its IP *while the tunnel is up* (it has nothing to do with a reboot). On other devices wireguard is notorious to fail to re-establish a connection if the dynamic IP at the other end is changing while the tunnel is established (and manual intervention is required - disabling and re-enabling the tunnel brings it back right away). For instance, on Windows I've written a PowerShell script that I ran every 5 minutes via Scheduled Tasks - if the remote gateway was unavailable over ICMP it restarted the tunnel, which reliably re-established the connection. For instance, on GL.iNET devices the watchguard feature is well implemented, it never led to any issues.
But here we're not talking about that watchdog feature, but instead by the OPNsense wireguard server being unable to resolve its clients' DNS queries after rebooting the firewall, and until the service is restarted manually (I say again, S2S connections work well, it's only about clients which connect but cannot resolve). It has nothing to do with client-side dynamic IPs. According to what I found online, it's because the OPNsense wg 'server' service (instance) attempts to run before the DNS resolver is fully up - and the suggestion solution is scripting the wg server to start after a certain delay (they are proposing 30 seconds, which I can live). But the reason I've written here is because I'd like a Devs-endorsed workaround, rather than something I've found online - especially since it's likely that it would help many others as well.
But here we're not talking about that watchdog feature, but instead by the OPNsense wireguard server being unable to resolve its clients' DNS queries after rebooting the firewall, and until the service is restarted manually (I say again, S2S connections work well, it's only about clients which connect but cannot resolve). It has nothing to do with client-side dynamic IPs. According to what I found online, it's because the OPNsense wg 'server' service (instance) attempts to run before the DNS resolver is fully up - and the suggestion solution is scripting the wg server to start after a certain delay (they are proposing 30 seconds, which I can live). But the reason I've written here is because I'd like a Devs-endorsed workaround, rather than something I've found online - especially since it's likely that it would help many others as well.
#4
26.7 Series / Re: os-vnstat: Interface?
Last post by defaultuserfoo - Today at 02:22:05 AMWell, it says Identifier wan for the WAN interface, and Device is pppoe0. That's already three different designations. It's not any better at other places but even worse because I have an interface titled Interfaces: [FORPPPOE] which turns into forPPPoE when I copy and paste the title --- while the interface is actually named forPPPoE. But that interface has an identifier of opt5 (what is that for??), and at the same time, the device is bce0. Why the hell does that have to be made so confusing?
And I'm just noticing that that interface is not enabled, which is probably bad because IIUC, it means that the interface settings are not being applied. But I don't remember why I didn't enable it and what exactly it is for. There must have been some reason that I didn't enable the interface when I set things up.
So pppoe0 is bce0. Should that interface be enabled or not? How is it even possible to use an interface that is disabled?
And how do I tell if vnstat is configured right?
And I'm just noticing that that interface is not enabled, which is probably bad because IIUC, it means that the interface settings are not being applied. But I don't remember why I didn't enable it and what exactly it is for. There must have been some reason that I didn't enable the interface when I set things up.
So pppoe0 is bce0. Should that interface be enabled or not? How is it even possible to use an interface that is disabled?
And how do I tell if vnstat is configured right?
#5
Tutorials and FAQs / Re: How to get IPv6 with custo...
Last post by IsaacFL - Today at 02:15:40 AMI am not sure what you mean by using Custom DNS, but wouldn't that be better done via unbound?
I also use Spectrum and never had any problems using any upstream DNS I wanted, by using Unbound.
WAN interface:
IPv6 Configuration Type: DHCPv6
Prefix delegation size: 56
Request prefix only: can be checked or not. it provides a unique ipv6 to the WAN interface
Request DNS configuration: I do not check this.
Send prefix hint: checked
LAN interface
Use Identity Association (Track interface is obsolete)
Parent interface: WAN int name
Assign Prefix ID: using VLAN ID in hex
Reserved prefix range: 1
Allow manual adjustment of DHCPv6 and Router Advertisements is no longer there for Identity Association
Services: Router Advertisements
Added an entry for LAN interface
Mode: Unmanaged should be used for Spectrum, otherwise you will have to setup dhcpv6 which isn't recommended for dynamic assigned prefixes
Recursive DNS Servers: Leave blank so it will get from Router
on unbound, under DNS forwarding, set to your 3rd party dns servers, you can use DNS over TLS instead if your 3rd party dns supports it and most do.
With this setup, the network devices will be assigned the router as the local DNS, and your router will then forward to the 3rd party DNS
I also use Spectrum and never had any problems using any upstream DNS I wanted, by using Unbound.
WAN interface:
IPv6 Configuration Type: DHCPv6
Prefix delegation size: 56
Request prefix only: can be checked or not. it provides a unique ipv6 to the WAN interface
Request DNS configuration: I do not check this.
Send prefix hint: checked
LAN interface
Use Identity Association (Track interface is obsolete)
Parent interface: WAN int name
Assign Prefix ID: using VLAN ID in hex
Reserved prefix range: 1
Allow manual adjustment of DHCPv6 and Router Advertisements is no longer there for Identity Association
Services: Router Advertisements
Added an entry for LAN interface
Mode: Unmanaged should be used for Spectrum, otherwise you will have to setup dhcpv6 which isn't recommended for dynamic assigned prefixes
Recursive DNS Servers: Leave blank so it will get from Router
on unbound, under DNS forwarding, set to your 3rd party dns servers, you can use DNS over TLS instead if your 3rd party dns supports it and most do.
With this setup, the network devices will be assigned the router as the local DNS, and your router will then forward to the 3rd party DNS
#6
General Discussion / Re: WAN out connection Issues
Last post by Tetra - Today at 01:28:21 AMFollow-up: For testing purposes I did some allow any firewall changes and I believe the firewall was blocking the pings from the other devices connected to my ISP router. The OPNsense WAN interface can now ping the ISP Router private not public, while other devices connected to the ISP can ping the public IP. Other devices can also ping the OPNsense WAN interface but the issue still persists where the endpoint can't ping the ISP Router(public or private).
#7
26.7 Series / webgui stops respoding config ...
Last post by clash - Today at 01:02:57 AMHi,
After upgrading to OPNsense 26.7.3_11-amd64 Iam expiriencing very slow and then unresponsiv webgui.
Then I tried
configctl webgui restart
but it tells me:
--
unable to connect to configd socket (@/var/run/configd.socket)
--
After restarting config, the Webgui work well again.
Is this a known issue? Can I increase configd logging?
After upgrading to OPNsense 26.7.3_11-amd64 Iam expiriencing very slow and then unresponsiv webgui.
Then I tried
configctl webgui restart
but it tells me:
--
unable to connect to configd socket (@/var/run/configd.socket)
--
After restarting config, the Webgui work well again.
Is this a known issue? Can I increase configd logging?
#8
26.7 Series / Re: OpenVPN CLient Export fail...
Last post by rubydragon - Today at 12:28:27 AMI had the same issue as stated and even ended up recreating everything from scratch with the same result. Starting from 26.7, the "server" only certificate is apparently not working anymore. You have to pick "combined client/server". If that can help anyone else...
#9
General Discussion / Re: WAN out connection Issues
Last post by Tetra - September 03, 2026, 11:42:21 PMSo on the ISP I still have some of my other personal devices connected and they can ping each other and the ISP Router, but can't ping still the OPNsense WAN interface. I've confirmed that its properly pulling a IP from the router by restarting the interface. All my other devices work just fine connected the ISP router but this OPNsense WAN interface.
#10
26.7 Series / Re: Wireguard vs. DNS resoluti...
Last post by meyergru - September 03, 2026, 10:35:41 PMFor S2S connections, the cron job helps. For C2S, there should be nothing keeping your Wireguard server from starting, because the peer does not have to have an endpoint, so there is no DNS to be resolved that could keep the instance from coming up?
