Recent posts

#1

26.7 Series / Re: Bug?: Rules [Legacy] appea...

Last post by franco - Today at 11:53:09 AM

Thanks, how about this?

# opnsense-patch https://github.com/opnsense/core/commit/b077133613


Cheers,
Franco

#2

German - Deutsch / Re: Lokale Ressourcen nicht er...

Last post by Bob.Dig - Today at 11:34:11 AM

ich versuche grad mit einer VirtualBox eine opnsens laufen zulassen,

Warum?

so das diese einen wireguard Tunnel erstellt

Warum?

um auf lokale Ressourcen zuzugreifen.

Warum?

Man kann sich seine Hobbies selbst aussuchen...

#3

General Discussion / Re: VLAN support on bridges fr...

Last post by Monviech (Cedrik) - Today at 11:23:51 AM

https://github.com/opnsense/core/issues/10576

https://github.com/opnsense/core/pull/10584

#4

26.7 Series / Re: 26.7 continually reboots

Last post by abulafia - Today at 11:08:13 AM

Just for reference (in case someone else stumbles over this thread):

I had boot loops on update to 26.7 too, but for a different reason: I was still using an ooold EFI boot loader (from 2022?).

Updating the boot loader per FreeBSD 15.1 instructions helped in my case. See https://forum.opnsense.org/index.php?topic=52508.0.

#5

26.7 Series / Re: Error on upgrading - pkg-s...

Last post by firefart - Today at 11:05:38 AM

The other weird part is the apparent lack of dns resolution/internet connectivity and the fact it is repeatable.

Just curious, where can you spot dns resolution and internet connectivity errors in the logs above?

#6

26.7 Series / 26.7 upgrade failed with boot ...

Last post by abulafia - Today at 11:05:08 AM

My initial attempt to upgrade from 26.1.11_10 to 26.7 failed with a boot loop: the update process could not go through as it requires several automatic reboots.

1. Removing the Intel microcode plugin as well as AdGuardHome and the community repo did not fix the boot loop.
2. Updating the EFI boot loader as per https://www.freebsd.org/releases/15.1R/upgrading/#upgrade-loader-uefi helped.
3. Now the update went through. Re-installed community repo and AdGuardHome.
4. Yay!

#7

German - Deutsch / Re: Lokale Ressourcen nicht er...

Last post by meyergru - Today at 10:54:57 AM

Das schrieb viragomann doch... es geht darum, den Rückweg, der sonst über das Default-Gateway liefe (Dein Router), zu ermöglichen, indem vorgegaukelt wird, alle Pakete von 192.168.99.0/24 kämen von 10.170.60.254, damit sie lokal beantwortet werden können und nicht über den Router laufen.

S-NAT:

Interface: LAN
TCP/IP Version: IPv4
Protocol: any
Source: WireGuard net (oder besser das spezifische WireGuard-Subnetz, z. B. 10.170.61.0/24)
Destination: LAN net (oder any)
Translation / Target: Interface address


Bei der Source kommt es darauf an, mit welcher IP die Clients oder der Host ankommen: Wenn der Host selbst ein Wireguard-Client ist, nutzt er die Tunneladresse 10.170.61.1. Geht er über ein anderes WG-Gateway, nimmt er eher 192.168.99.39/24 - die Source muss das so reflektieren.

Ich gehe oben davon aus, dass der Quell-Host ein WG-Client ist, der die Route zu 10.170.60.254 aufgrund der "AllowedIPs" kennt und dort mit der 10.170.61.1 aufschlägt. In der OpnSense würde die S-NAT-Regel dann diese Pakete aufgrund der Source auf die LAN-Interface-Adresse (10.170.60.254) umschreiben. Der Ziel-Host sieht dann diese Adresse und redet direkt im LAN damit.

#8

26.7 Series / Re: Call for testers - new CPU...

Last post by OPNenthu - Today at 10:52:15 AM

@Patrick, I got this command from ChatGPT.  It looks like the loaded ucode is 0x26, which is the updated version.  So the late loading is working even though it doesn't print anything was applied in dmesg.

Maybe it's simply a logging bug then and not a functional one.

Code Select Expand

root@firewall:~ # cpucontrol -m 0x8b /dev/cpuctl0
MSR 0x8b: 0x00000026 0x00000000

JFYI

#9

General Discussion / Re: Migrating OpenBSD pf to Op...

Last post by newsense - Today at 10:49:29 AM

I'll take a guess here that one is your default LAN and the other just another network on another port.

While the default lan allows you to go anywhere the additional ones will need specific firewall rules

#10

26.7 Series / Re: Call for testers - new CPU...

Last post by Patrick M. Hausen - Today at 10:41:00 AM

Thank you Patrick,

Re your second option, if the three files

Code Select Expand

/boot/loader.efi /boot/efi/efi/boot/bootx64.efi /boot/efi/efi/freebsd/loader.efi are identical in size, can I assume there's no need to update the boot loader?

Are they AFTER you upgraded to 26.7? I doubt that. You need to update the boot loader with the version that comes with FreeBSD 15.1 which is only present as /boot/loader.efi after the upgrade.

Second size doesn't say anything about the content. Try "cmp" to check if the files are identical. Or simply copy /boot/loader.efi over the two other ones - won't hurt.