"Recent posts
#1
General Discussion / Re: Lost GUI and "Media discon...
Last post by AlexOd - Today at 03:23:53 AMQuote from: patient0 on July 23, 2026, 09:35:44 AMDoes a client connected to Lan2 get an IP? Can you post screenshots of interface, dhcp and firewall rules?
Is the ASUS AP is in AP mode, not router mode I assume? And do you restart the AP if you switch between LAN and lan2?
I posted screens here- https://imgur.com/a/4w0TVLL
changed the ASUS to AP mode and it started behaving differently—the pink light is gone (it's steady white now), but it now says connection failed or can't get IP. It means Asus comminating now with AP mode.
Thank you for your time to help me.
Alex
#2
26.7 Series / Re: Trouble with Apple Private...
Last post by Igor - Today at 02:38:00 AM #3
Hardware and Performance / Re: Network setup with OPNsens...
Last post by BrandyWine - Today at 01:57:52 AMHow does the video get from vehicle to the livestream PC?
What's the internet link, your 5GLTE device? If everyone else is using the same cell then bandwidth could/might be impacted.
Anything streaming to a utoob channel, you can buy a small device from amzon or the like that takes in video (hdmi, composite, ntsc/pal), hardware encodes it, and then streams it to the utoob channel. So basically no work for that part, dont need a PC. Use the one that has eth port so no reliance on wifi.
Wifi for the team, you just need a wifi AP. What are they doing on the wifi (internet, other)?
What's the internet link, your 5GLTE device? If everyone else is using the same cell then bandwidth could/might be impacted.
Anything streaming to a utoob channel, you can buy a small device from amzon or the like that takes in video (hdmi, composite, ntsc/pal), hardware encodes it, and then streams it to the utoob channel. So basically no work for that part, dont need a PC. Use the one that has eth port so no reliance on wifi.
Wifi for the team, you just need a wifi AP. What are they doing on the wifi (internet, other)?
#4
Virtual private networks / Re: FreeBSD native TUN port of...
Last post by vamp - Today at 12:24:22 AMI have started working on my own solution, based on the Rust implementation of the following project:
https://github.com/Diniboy1123/usque-rs
My FreeBSD-focused fork is available here:
https://github.com/vampywiz17/usque-rs-bsd
The project is intended to provide a clean, tunnel-only implementation. Removed the proxy-related features and other components that are not necessary for establishing and maintaining the tunnel.
The main goals are:
* Keep as much of the native Cloudflare functionality as possible.
* Minimize the amount of userspace processing and additional components.
* Keep the implementation lightweight and suitable for firewall environments.
* Provide a reliable native tunnel implementation for FreeBSD.
The long-term goal is to create a pure Cloudflare WARP tunnel client that can eventually be integrated into, or used directly on, OPNsense.
I would be very happy to get feedback from testers, especially from people running FreeBSD or OPNsense. Pull requests, bug reports, and other contributions are also very welcome.
https://github.com/Diniboy1123/usque-rs
My FreeBSD-focused fork is available here:
https://github.com/vampywiz17/usque-rs-bsd
The project is intended to provide a clean, tunnel-only implementation. Removed the proxy-related features and other components that are not necessary for establishing and maintaining the tunnel.
The main goals are:
* Keep as much of the native Cloudflare functionality as possible.
* Minimize the amount of userspace processing and additional components.
* Keep the implementation lightweight and suitable for firewall environments.
* Provide a reliable native tunnel implementation for FreeBSD.
The long-term goal is to create a pure Cloudflare WARP tunnel client that can eventually be integrated into, or used directly on, OPNsense.
I would be very happy to get feedback from testers, especially from people running FreeBSD or OPNsense. Pull requests, bug reports, and other contributions are also very welcome.
#5
26.7 Series / Re: Trouble with Apple Private...
Last post by tonys - July 23, 2026, 11:51:15 PMQuick update: I discovered that turning on a third-party VPN (ProtonVPN) on both the Mac and iPhone seems to work around this problem. I think that turning on ProtonVPN turns off Apple's Private Relay which would validate the problem area.
#6
26.7 Series / Are RSA-7680 Trust store certi...
Last post by gromit - July 23, 2026, 10:53:50 PMI seem to be having problems with 7680-bit RSA certificates now, so I am wondering if that length of key is still supported.
I noticed recently that my ACME certificate was no longer being renewed---at least in the Trust store. The ACME logs would show a successful renewal via LetsEncrypt, but it would not update the certificate in the Trust store that eventually expired (July 11, 2026, shortly after which this came to my attention).
I was running 26.1.11 when this came to my notice, so today I upgraded to 26.7.1_1 in the hope this might "fix" whatever problems I was having with ACME and the Trust store. It didn't.
I removed the ACME plugin; reset its configuration; deleted related certificates from the Trust store; and even deleted ACME files and directories from the file system before reinstalling the ACME plugin and setting up a new ACME config again. This still didn't work, but the ACME part seemed to work (like before) inasmuch as it would obtain and download a certificate---just not import it into the Trust store.
I've noticed a new message in System -> Firmware -> Reporter since trying to get a new ACME certificate today. Here are the PHP Errors:
The "Option [] not in list.{7680}" made me wonder whether it was referring to a RSA-7680 certificate. My OPNsense installation is rather old, and I do have two internal certificate authorities in the Trust -> Authorities section, created in 2018, that are RSA-7680, at least according to the certificate info ("Public-Key: (7680 bit)"). (The ACME certificate I am obtaining has an ec-384 key length.)
Is that type of 7680-bit certificate supported any more? When I looked at the key types when creating a new CA, 7680-bit is not listed as an option (it goes RSA-4096 and then RSA-8192).
I'm wondering whether this exception being thrown is what is causing the import into the Trust store to fail.
Cheers,
Paul.
I noticed recently that my ACME certificate was no longer being renewed---at least in the Trust store. The ACME logs would show a successful renewal via LetsEncrypt, but it would not update the certificate in the Trust store that eventually expired (July 11, 2026, shortly after which this came to my attention).
I was running 26.1.11 when this came to my notice, so today I upgraded to 26.7.1_1 in the hope this might "fix" whatever problems I was having with ACME and the Trust store. It didn't.
I removed the ACME plugin; reset its configuration; deleted related certificates from the Trust store; and even deleted ACME files and directories from the file system before reinstalling the ACME plugin and setting up a new ACME config again. This still didn't work, but the ACME part seemed to work (like before) inasmuch as it would obtain and download a certificate---just not import it into the Trust store.
I've noticed a new message in System -> Firmware -> Reporter since trying to get a new ACME certificate today. Here are the PHP Errors:
Code Select
[23-Jul-2026 18:09:38 Etc/UTC] PHP Fatal error: Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(175): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#3 {main}
thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822
[23-Jul-2026 19:21:25 Etc/UTC] PHP Fatal error: Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(381): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(164): OPNsense\AcmeClient\LeCertificate->issue()
#3 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#4 {main}
thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822The "Option [] not in list.{7680}" made me wonder whether it was referring to a RSA-7680 certificate. My OPNsense installation is rather old, and I do have two internal certificate authorities in the Trust -> Authorities section, created in 2018, that are RSA-7680, at least according to the certificate info ("Public-Key: (7680 bit)"). (The ACME certificate I am obtaining has an ec-384 key length.)
Is that type of 7680-bit certificate supported any more? When I looked at the key types when creating a new CA, 7680-bit is not listed as an option (it goes RSA-4096 and then RSA-8192).
I'm wondering whether this exception being thrown is what is causing the import into the Trust store to fail.
Cheers,
Paul.
#7
General Discussion / Re: Help needed to update boot...
Last post by Patrick M. Hausen - July 23, 2026, 10:34:41 PMQuote from: hushcoden on July 23, 2026, 10:28:54 PMAnd least now I understand that it's completely beyond my capabilities, so will plan a new/fresh install.
Please report back after your fresh install and I can at least guide you through getting the boot loader on the second drive.
If all you ever did was use the OPNsense installer your second drive is not bootable. Not OPNsense's fault! But it's a 50/50 gamble when one drive fails if your system still boots, despite the fact that everything else is properly mirrored.
#8
General Discussion / Re: Help needed to update boot...
Last post by hushcoden - July 23, 2026, 10:28:54 PMThank you Patrick, much appreciated.
And least now I understand that it's completely beyond my capabilities, so will plan a new/fresh install.
And least now I understand that it's completely beyond my capabilities, so will plan a new/fresh install.
#9
26.7 Series / Re: Error on upgrading - pkg-s...
Last post by firefart - July 23, 2026, 10:21:13 PMUpdate: I installed the latest iso image over the existing one with a config restore to upgrade so I can no longer help in narrowing down this particular issue as I'm now running 26.7
#10
General Discussion / Re: Periodic NIC issues (?) wi...
Last post by OPNenthu - July 23, 2026, 10:03:40 PMQuote from: tuto2 on July 23, 2026, 01:27:50 PMEdit: kernel for 26.7 is up as well:
# opnsense-update -zkr 26.7-igc2
I'm happy to try this as I'm on 26.7 now but I'm not sure if my symptoms indicate me as a test candidate. After re-reading @fornax's posts and #62 especially, I think you guys might be targeting a different set of issues than I have. It's been hard to tell.
Do you have field complaints other than this thread? Would you be open to setting up a "Call for testing" thread with a description of the specific problem(s) that the OPNsense team is targeting, a description of who is/isn't a test candidate, etc.?
