Recent posts

#1

26.7, 26.10 Series / Re: os-upnp plugin not working...

Last post by AlpAne - Today at 12:07:43 PM

miniupnpd 2.3.11 has been released, is it not possible to update the plugin to this version?

Netgate seems to be working on it...  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298991

Unfortunately FreeBSD ports is notoriously slow with such things, too, but we try not to make it our problem anymore.


Cheers,
Franco

Hi Franco,

Can you please give a short update on the status for this? I have been monitoring https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298991 for a while but to be honest I don't have the knowledge to interpret the information in a sensible way...

Thanks in advance!

#2

26.7, 26.10 Series / ACME, sftp upload - New Client...

Last post by bensommer - Today at 12:07:28 PM

Hi
I use `acme` with HAProxy to distribute Let's Encrypt certificates via SFTP upload. This works without any issues on Ubuntu 22 clients, but it no longer works on versions 24 and 26. The certificates cannot be found on the client, even though I copied them exactly the same way as I did for Ubuntu 22. The same problem occurs with Debian 13. Does anyone have a working solution?

Regards Ben

#3

26.7, 26.10 Series / Re: WAN PPPoE IPv6 default rou...

Last post by Taomyn - Today at 12:07:05 PM

Hi!

What is in:

# ifctl -6r -i pppoe0

And which version are you using?


Cheers,
Franco

It shows

ifctl -6r -i pppoe0
fe80::b614:89ff:fe08:5d00

I'm on 26.7.8_1-amd64

#4

26.7, 26.10 Series / Re: WAN PPPoE IPv6 default rou...

Last post by franco - Today at 11:51:50 AM

Hi!

What is in:

# ifctl -6r -i pppoe0

And which version are you using?


Cheers,
Franco

#5

26.7, 26.10 Series / WAN PPPoE IPv6 default route s...

Last post by Taomyn - Today at 11:45:46 AM

After many years my ISP has finally sorted IPv6 for my connection (over PPPoE IPv4) but it seems OPNsense is not setting the default route correctly i.e. uses vtnet0_vlan100 instead of pppoe0, and thus traffic fails to leave my firewall.

The gateway is scoped to the parent VLAN but the output interface is a different VLAN:

default  fe80::be24:11ff:fe78:54d5%vtnet0_vlan100  UG  vtnet0_vlan1

Should be:

default  fe80::be24:11ff:fe78:54d5%pppoe0  UG  pppoe0

Impact: LAN clients get SLAAC addresses and default routes from radvd but packets are dropped at the firewall ("No route" ICMPv6).

Workaround:

route -6 delete default
route -6 add default fe80::be24:11ff:fe78:54d5%pppoe0

• UI reload of WAN does NOT fix it (re-triggers the bad route even when removed using the workaround)
• net.inet6.ip6.forwarding is 1
• radvd config is correct, RAs are being sent
• IPv4 over the same PPPoE link works fine

Possibly related: https://github.com/opnsense/core/issues/2186 but was closed due to inactivity

For now I can utilise a cron job to fix it, but is there another way I'm missing?

#6

26.7, 26.10 Series / Re: ISC➞Kea migration

Last post by Monviech (Cedrik) - Today at 10:23:36 AM

Great :)

#7

26.7, 26.10 Series / Re: ISC➞Kea migration

Last post by chemlud - Today at 09:24:55 AM

Disabled ISC, reboot, flag gone, all good, apparently! :-D

Thanks for your time and knowledge...

Will enable again when the feature will be exposed in the GUI.

#8

26.7, 26.10 Series / Re: WAN_DHCP6 learns OPNsense ...

Last post by noclue68 - Today at 09:14:40 AM

At this point, I believe the best approach is either to rebuild the setup from scratch or to go through the network configuration step by step again to identify what may have been missed.

Thank you very much for your support so far. I appreciate your help and will keep you informed of the results after I have completed the review.

#9

26.7, 26.10 Series / Re: ISC➞Kea migration

Last post by chemlud - Today at 09:06:30 AM

Again, many thanks for clarifications!

#10

Zenarmor (Sensei) / Am I missing something or has ...

Last post by fvnet - Today at 08:54:03 AM

Hello, setting up OPNsense for a small company of accountants, about 35-40 employees, a couple of servers, 3 printers etc. So, about 45-50 active hosts in network everyday (not counting their wifi connected phones, they are completely in another isolated VLAN which I don't care).
I notified boss that he has to expect about yearly 800-900$ for ZA NGFW subscription which (my fault there) is legacy now and has been replaced with Unified Secure  $2,040.00 billed annually for 40 users. They mention something about one user license covering two devices so even with 20 user licenses $1,020.00 billed annually.

Am I missing something here??