"Recent posts
#1
26.7 Series / Re: Another 26.7 "Upgrade Fail...
Last post by bamf - August 18, 2026, 11:58:38 PMQuote from: cookiemonster on August 18, 2026, 11:17:57 PMHe mentioned a secondary drive so I assumed a mirror.
Just because it's a ZFS mirror doesn't mean both drives are bootable. The installer leaves the EFI partition on the second drive unformatted, so if you don't create the filesystem and copy the bootloader over manually, it won't boot when the primary drive fails. Learned that here.
#2
26.7 Series / Re: Another 26.7 "Upgrade Fail...
Last post by Patrick M. Hausen - August 18, 2026, 11:54:39 PMYes, of course. And with a mirror you need a boot loader on both drives. Which the FreeBSD installer up to a couple of days ago installed on the first drive only. So you need to install it on the second one afterwards, manually.
Also in case of a boot loader update you need to do that on both drives.
The boot loader partitions are not mirrored!
Also in case of a boot loader update you need to do that on both drives.
The boot loader partitions are not mirrored!
#3
26.7 Series / Re: Another 26.7 "Upgrade Fail...
Last post by cookiemonster - August 18, 2026, 11:17:57 PMQuote from: Patrick M. Hausen on August 17, 2026, 12:41:46 AMHe mentioned a secondary drive so I assumed a mirror.Quote from: cookiemonster on August 16, 2026, 10:42:25 PMWhat makes you think that you need to install the bootloader to the secondary drive?
How are you going to boot from the secondary drive when the primary one fails?
#4
26.7 Series / Re: Interfaces: Virtual IPs: S...
Last post by mimugmail - August 18, 2026, 10:22:07 PMSorry to be offtopic, but what happens in the OS when you add a Virtual IP with type other?? I never had a demand to even think about its reason.
#5
Intrusion Detection and Prevention / Suricata 8.0.6 — eve.json neve...
Last post by Abdikarim001 - August 18, 2026, 10:15:50 PMOPNsense (recent version), Suricata 8.0.6
Hardware: N100 mini PC, 4x Intel igc NICs
WAN: PPPoE (pppoe0 over igc1)
Suricata configured for WAN-only monitoring, ~20 rulesets enabled (abuse.ch feeds + ET Open categories, ~150k+ signatures total)
Zenarmor (Sensei) also installed, using netmap on a separate interface
Issue 1: eve.json never populated
Suricata starts cleanly (confirmed via configctl ids status and pgrep). stats.log updates normally, showing active flow processing (non-zero packets, flows checked, zero drops). eve-log is enabled in the generated suricata.yaml with a standard config (filetype: regular, filename: eve.json, types: alert/anomaly/drop/ssh).
The file stays at 0 bytes indefinitely, even after 60+ seconds of real traffic and repeated requests to testmynids.org (designed to trigger GPL SID 2100498). No "rules loaded" or signature count message appears anywhere in suricata_YYYYMMDD.log.
Things tried, none of which changed the outcome:
Switching interface binding from raw physical igc1 to the logical pppoe0
Removing a duplicate syslog eve-log output block, leaving only the file-based one
Deleting and recreating the pidfile and eve.json to rule out stale locks
Full system reboot
Full package reinstall via pkg install -f, including wiping /usr/local/etc/suricata and /var/log/suricata entirely before reinstalling
Issue 2: Netmap/inline capture mode breaks WAN entirely
Switching Capture mode to "Netmap (inline/IPS)" causes complete loss of internet connectivity (100% packet loss pinging 1.1.1.1/8.8.8.8) within seconds of starting. Suspect a conflict with Zenarmor/Sensei's own netmap usage on a different interface of the same box, though unconfirmed. Reverting to "PCAP live mode (IDS)" immediately restores connectivity.
Question: Has anyone seen eve.json fail to populate under 8.0.6 specifically, despite clear evidence the engine is processing traffic? And is netmap mode known to conflict with other netmap consumers (e.g., Zenarmor/Sensei) on a different interface of the same box?
Hardware: N100 mini PC, 4x Intel igc NICs
WAN: PPPoE (pppoe0 over igc1)
Suricata configured for WAN-only monitoring, ~20 rulesets enabled (abuse.ch feeds + ET Open categories, ~150k+ signatures total)
Zenarmor (Sensei) also installed, using netmap on a separate interface
Issue 1: eve.json never populated
Suricata starts cleanly (confirmed via configctl ids status and pgrep). stats.log updates normally, showing active flow processing (non-zero packets, flows checked, zero drops). eve-log is enabled in the generated suricata.yaml with a standard config (filetype: regular, filename: eve.json, types: alert/anomaly/drop/ssh).
The file stays at 0 bytes indefinitely, even after 60+ seconds of real traffic and repeated requests to testmynids.org (designed to trigger GPL SID 2100498). No "rules loaded" or signature count message appears anywhere in suricata_YYYYMMDD.log.
Things tried, none of which changed the outcome:
Switching interface binding from raw physical igc1 to the logical pppoe0
Removing a duplicate syslog eve-log output block, leaving only the file-based one
Deleting and recreating the pidfile and eve.json to rule out stale locks
Full system reboot
Full package reinstall via pkg install -f, including wiping /usr/local/etc/suricata and /var/log/suricata entirely before reinstalling
Issue 2: Netmap/inline capture mode breaks WAN entirely
Switching Capture mode to "Netmap (inline/IPS)" causes complete loss of internet connectivity (100% packet loss pinging 1.1.1.1/8.8.8.8) within seconds of starting. Suspect a conflict with Zenarmor/Sensei's own netmap usage on a different interface of the same box, though unconfirmed. Reverting to "PCAP live mode (IDS)" immediately restores connectivity.
Question: Has anyone seen eve.json fail to populate under 8.0.6 specifically, despite clear evidence the engine is processing traffic? And is netmap mode known to conflict with other netmap consumers (e.g., Zenarmor/Sensei) on a different interface of the same box?
#6
Intrusion Detection and Prevention / Re: Policy Editor?
Last post by spetrillo - August 18, 2026, 10:12:03 PMComing back to this. Does anyone know how to do policies?
#7
Tutorials and FAQs / new to OpenSense and like to i...
Last post by comet424 - August 18, 2026, 10:01:22 PMi tried googling to learn how hard it is most posts are old..
i curious i new to open sense and currently running in a VM. on unraid
but in 2026 is there an importer to import convert pfsense to opensense? and is there a way to import my OpenVPN certificates users CA also so i dont have to re generated peoples user accounts and there OpenVPN Clients..
as i dont have a simple setup.. i got multiple OpenVPN Server,Clients,, Multiple USers, Multiple Vlans etc.. how hard is it to transistion?
i curious i new to open sense and currently running in a VM. on unraid
but in 2026 is there an importer to import convert pfsense to opensense? and is there a way to import my OpenVPN certificates users CA also so i dont have to re generated peoples user accounts and there OpenVPN Clients..
as i dont have a simple setup.. i got multiple OpenVPN Server,Clients,, Multiple USers, Multiple Vlans etc.. how hard is it to transistion?
#8
Virtual private networks / IPSec with Let's Encrypt YR - ...
Last post by viragomann - August 18, 2026, 08:12:55 PMI'm running an IPSec server for road warriors. It uses public key authentication with a Let's Encrypt certificate.
Client authentication goes via EAP-RADIUS. The local FreeRADIUS uses certificate from a private CA.
Most clients here are Windows 11 built-in vpn clients.
This worked flawlessly with the LE R13 certificate. But since this was replaced by the ACME client with an YR cert, Windows fails to connect.
The reason seems to be an additional layer in the cert chain, which Windows doesn't trust:
my-cert ← R13 ← ISRG Root X1
my-cert ← YR2 ← Root YR ← ISRG Root X1
So the YR has an additional intermediate certificate: "Root YR". OPNsense shows only YR2 up in the GUI though, but if I download it, I can see both intermediate certs are stored into a single file.
So I suspect, that the vpn server only sends the first one to the client. Or Windows accepts only the first one.
The IPSec log shows
However, Windows fails to connect. It just stops the communication and the connection times out on the server.
Is anyone else using an LE YR or YE certificate with IPSec on OPNsense and got this working?
I assume, a workaround could be to split the intermediate cert file so that I get a unique for both and assigning them the vpn server. So that both are delivered to the client. But the intermediate cert has a limited validity. So this might be only a temporary solution.
Client authentication goes via EAP-RADIUS. The local FreeRADIUS uses certificate from a private CA.
Most clients here are Windows 11 built-in vpn clients.
This worked flawlessly with the LE R13 certificate. But since this was replaced by the ACME client with an YR cert, Windows fails to connect.
The reason seems to be an additional layer in the cert chain, which Windows doesn't trust:
my-cert ← R13 ← ISRG Root X1
my-cert ← YR2 ← Root YR ← ISRG Root X1
So the YR has an additional intermediate certificate: "Root YR". OPNsense shows only YR2 up in the GUI though, but if I download it, I can see both intermediate certs are stored into a single file.
So I suspect, that the vpn server only sends the first one to the client. Or Windows accepts only the first one.
The IPSec log shows
Code Select
sending cert request for "C=US, O=Let's Encrypt, CN=YR2"However, Windows fails to connect. It just stops the communication and the connection times out on the server.
Is anyone else using an LE YR or YE certificate with IPSec on OPNsense and got this working?
I assume, a workaround could be to split the intermediate cert file so that I get a unique for both and assigning them the vpn server. So that both are delivered to the client. But the intermediate cert has a limited validity. So this might be only a temporary solution.
#9
26.7 Series / Re: APC UPS deamon plugin stop...
Last post by lmoore - August 18, 2026, 08:12:28 PMOne cause can be a corrupt configuration file. Go to Services -> Apcupsd -> Settings and apply the settings.
HTH.
HTH.
#10
26.7 Series / Possible boot-time race involv...
Last post by dinguz - August 18, 2026, 07:31:11 PMRecently, I have encountered an issue where OPNsense more often than not stops progressing during boot. In most cases, it stalls at the "Setting up gateway monitoring" step. My WAN uses PPPoE over VLAN, with DHCPv6 prefix delegation enabled. It remains stuck indefinitely until I manually trigger a network-related action in the GUI, after which startup continues normally.
As a precaution, I reset the gateway monitoring part of the configuration files to defaults, but this didn't make any difference.
Disabling the DHCPv6 rapid commit option appears to make the issue occur less frequently. However, it is unclear whether rapid commit is the underlying cause or whether disabling it merely masks the problem by changing the timing of the boot and interface configuration sequence.
If I disable IPV6 completely in the WAN interface, the system always boots normally.
The logs suggest that dhcp6c, PPPoE link events, and rc.newwanipv6 may be running concurrently. I see repeated interface reconfiguration and Can't assign requested address errors, which makes me wonder whether this could be a timing or ordering issue during boot.
I am running OPNsense 26.7.2_2 (amd64). Is there any way I can assist in solving this by providing logs or try out things?
As a precaution, I reset the gateway monitoring part of the configuration files to defaults, but this didn't make any difference.
Disabling the DHCPv6 rapid commit option appears to make the issue occur less frequently. However, it is unclear whether rapid commit is the underlying cause or whether disabling it merely masks the problem by changing the timing of the boot and interface configuration sequence.
If I disable IPV6 completely in the WAN interface, the system always boots normally.
The logs suggest that dhcp6c, PPPoE link events, and rc.newwanipv6 may be running concurrently. I see repeated interface reconfiguration and Can't assign requested address errors, which makes me wonder whether this could be a timing or ordering issue during boot.
I am running OPNsense 26.7.2_2 (amd64). Is there any way I can assist in solving this by providing logs or try out things?
Code Select
18:49:46 rc.bootup: plugins_configure bootup (execute task : unbound_configure_do(1))
18:49:51 dhcp6c: rtsold_script: starting dhcp6c
18:49:51 dhcp6c: Sending Solicit on pppoe1
18:49:52 dhcp6c: Received REPLY for REQUEST
18:49:52 dhcp6c: create a prefix .../48
18:49:53 rc.newwanipv6: IP renewal deferred during boot on 'pppoe1'
18:50:54 /interfaces.php: plugins_configure dhcp (,inet6,[lan])
18:50:54 dhcp6c: restarting
18:50:54 dhcp6c: Start address release
18:50:54 dhcp6c: Sending Release on pppoe1
18:50:54 dhcp6c: remove a site prefix .../48
18:50:54 ppp: caught fatal signal TERM
18:50:54 ppp: [opt1] IFACE: Close event
18:50:54 ppp: [opt1_link0] PPPoE: connection closed
18:50:54 rc.newwanip: IP renewal deferred during boot on 'pppoe1'
18:50:55 dhcp6c: Sending Solicit on pppoe1
18:50:55 dhcp6c: transmit failed: Can't assign requested address
rc.newwanipv6: IP renewal starting (reason: request, ... device: pppoe1)
rc.newwanipv6: plugins_configure dhcp (,inet6)
rc.newwanipv6: ROUTING: entering configure using opt1, lan
rc.newwanipv6: plugins_configure monitor (... INTERNET_DHCP6)
/interfaces.php: The required INTERNET_DHCP6 IPv6 interface address could not be found, skipping.
dhcp6c: Sending Solicit on pppoe1
dhcp6c: transmit failed: Can't assign requested address
rc.newwanipv6: IP renewal starting (reason: force, address: misconfigured, ...)
