Recent posts

#1

26.7 Series / WebUI SSL issue following 26.7...

Last post by SaltyBishop - Today at 12:33:42 AM

Hello

Sharing in case anyone else has a similar issue.

Following my upgrade to 26.7 (26.7.1_1), I was unable to access the web UI due to an invalid SSL certificate/configuration. The error was: SSL_ERROR_INTERNAL_ERROR_ALERT (Firefox) and ERR_SSL_PROTOCOL_ERROR (Chrome).

I just wanted to share how I fixed this. The steps I followed are very simple - available here.

Essentially:

• Login to box via console
• Select Shell
• Run: configctl webgui restart renew

Big thanks to the project, I love what you're doing! This is the first time I've had to intervene since I dropped Sophos UTM!

#2

General Discussion / Re: Trying to block an alias g...

Last post by Patrick M. Hausen - Today at 12:12:32 AM

That's not even a group alias. It's a host alias. I suspected there might possibly be a bug in the way groups are processes, but you are not using a group.

A group alias is one of type "Network group" containing other aliases. This can be helpful in implicit documentation. By creating your aliases as

Host_A, type "Host", content 10.42.69.13
Host_B, type "Host", content 10.42.69.39
Host_C, type "Host", content 10.42.70.39

and then

Blocked_from_Internet, type "Network group", content Host_A, Host_B, Host_C

you document what each of these IP addresses actually are.

That should work exactly the same but you get (IMHO) better discoverability when you look at it again 6 months from now ;-)

#3

Development and Code Review / Re: netflector available as pl...

Last post by UnicronHD - September 07, 2026, 11:14:50 PM

Thanks, great to hear that the first implementation is ready. I'm happy to test it.

I'm running:

OPNsense 26.7.3_11-amd64
FreeBSD 15.1-RELEASE-p3
OpenSSL 3.5.8
Architecture: amd64

Binary:
https://drive.google.com/uc?export=download&id=1VcsmIz9SZDM5Sxqav6a19TTZbojL_gCR

SHA256:
f485f068b0529f36851e8dfeeae06e1bd1f118b5405dadcd67b9eb78fe34a633  netflector-0.16.0-freebsd15-amd64

Here is a config (I assume you will call it roon.toml) you can use for Roon reflection. Feel free to enable more protocols if needed. It assumes that unicast replies are allowed in the firewall. Add more entries if you need reflection between more VLANs.

Code Select Expand

# "debug" shows every relayed datagram; drop to "info" once it works.
log_level = "debug"

[reflectors.roon]
# Interface names as ifconfig lists them, e.g. igb0 / igb1 or vtnet0 / vtnet1.
source_if = "lan"
target_if = "iot"
udp_ports = [9003]
udp_groups = ["239.255.90.90"]
udp_broadcast = true
bidirectional = true

First smoke test:

Code Select Expand

./netflector-0.16.0-freebsd15-amd64 --version
./netflector-0.16.0-freebsd15-amd64 --check-config roon.toml

Then run it (for the purity of this experiment make sure that netflector plugin is stopped):

Code Select Expand

./netflector-0.16.0-freebsd15-amd64 roon.toml

At start the log should show something like this:

Code Select Expand

reflector roon: lan <-> iot [udp(9003 on 239.255.90.90,broadcast)]

And then each reflected query will log something like this:

Code Select Expand

reflected UDP relay datagram from <ip>:<port> to ...


#4

General Discussion / Re: Trying to block an alias g...

Last post by The Crazy Squirrel - September 07, 2026, 11:14:26 PM

I don't know why, but now it's working.  I didn't change anything from my original post.
Was it time?  Was it a cache?  I have no idea.


Just in case someone else stumbles on this I'll go ahead and include the group alias.

#5

General Discussion / Re: Trying to block an alias g...

Last post by cookiemonster - September 07, 2026, 10:50:05 PM

Right. It's the inverted destination in your rule that made me think is what you wanted to do.
Should work then. Perhaps needs a reset of states.
Perhaps this helps https://forum.opnsense.org/index.php?topic=49147.0.
ps.The preferred way is using block to anything not in RFC1918

#6

General Discussion / Re: Trying to block an alias g...

Last post by Patrick M. Hausen - September 07, 2026, 10:31:15 PM

The rule looks ok, IMHO. Show the details of the alias definition, please.

#7

Hardware and Performance / Re: Power loss recovery on Pro...

Last post by OPNenthu - September 07, 2026, 10:28:49 PM

Hi @cottec,

Not sure what's going on with yours specifically but the COM issue sounds familiar.  I have a newer production run of the V1410 now and these issues haven't come back.  I would reach out to Protectli support.

You might be able to get COM port responding again with a CMOS reset: https://kb.protectli.com/kb/cmos-reset/.  I remember this working for me.

Replace the battery first if you can, and make sure you are on the latest firmware.

#8

General Discussion / Re: Trying to block an alias g...

Last post by The Crazy Squirrel - September 07, 2026, 10:23:51 PM

I'm not trying to block device to device traffic, just an alias group of devices from accessing the internet.
Yes, all devices are connected to a switch which is plugged into the internal_lan interface.

#9

Tutorials and FAQs / Re: HOWTO: monitor your SSD(s)...

Last post by cookiemonster - September 07, 2026, 10:23:03 PM

Thank you @Patrick M. Hausen. I meant to say thanks before and got distracted with implementing the thing.
I am old school and prefer non-docker things so this was in the end my first proper dabble with docker, so it took me longer than expected. A small LXC container on a proxmox node, all good and easy. But I wanted to also have notifications. That was what took me time to figure out -with help- how to get them. I ended up with a mattermost installation on the same container that is "part of the installation" of scrutiny. I now get them to my mobile phone as app notifications.
I feel a more in control of the status of disks all around the house: laptops of various OSes, NAS, workstations.
Thank you.

#10

26.7 Series / Re: Confused by 26.7 upgrade

Last post by defaultuserfoo - September 07, 2026, 10:22:03 PM

The community has spoken. My contribution is that I am not recommending 26.7 for my clients. I'm running 26.1 in home lab.

What do you recommend instead?