Quote from: cookiemonster on August 16, 2026, 10:42:25 PMWhat makes you think that you need to install the bootloader to the secondary drive?
Quote from: cookiemonster on August 16, 2026, 10:42:25 PMwith loads of successful upgrades so far I can only assume some sort of setup/settings have come to bite.Thank you for the reply.
QuoteWhat makes you think that you need to install the bootloader to the secondary drive?It was just part of what I have been reading needs to be done to get ZFS corrected?
QuoteDo you have a mirrored pair of disks for the OS ? If yes, then it is a likely possibility but if you can boot after the upgrade, then you can look at that afterwards.Yes, and i can boot to OpnSense and look at (what appears to be) a working build...other than no internet access.
QuoteWhat's the status now, is it rolledback via a snapshot?No, it's completely in the state of the upgrade and migrated rules. UI works, I get the new dashboard, Rules appear to be in place...I had too many questions to give up on it, or attempt a fresh install. Someone on the app thought it might be the kernel fail...but it doesn't (didn't) stay in the boot loop. When I manually restarted, the upgrade must have continued (or I hadn't waited long enough).
QuoteNote that if you had to put the isp router back in and then had router-behind-a-router, then that could account for no clients hitting it.I only put the ISP provided router in to get things working. My wife works from home, so I need a contingency to keep her up and running. The OpnSense box is offline while the ISP router is in place. I can only devote time to the fix late at night, or on the weekends.
tail -f -n 100000 /var/log/suricata/eve.json | jq -c 'select(.event_type=="stats") | select(.stats.capture.kernel_packets > 0) | {timestamp: .timestamp, drop_pct: (.stats.capture.kernel_drops / .stats.capture.kernel_packets * 100)}' ;# Default: root
# suricata_pidfile (str): Pidfile to store pid of suricata process
# Default: /var/run/suricata.pid
. /etc/rc.subr
name="suricata"
rcvar=suricata_enable
start_precmd="suricata_prestart"
command="/usr/local/bin/suricata"
load_rc_config $name
[ -z "$suricata_enable" ] && suricata_enable="NO"
[ -z "$suricata_conf" ] && suricata_conf="/usr/local/etc/suricata/suricata.yaml"
# [ -z "$suricata_flags" ] && suricata_flags="-D"
suricata_flags="-D --pcap-buffer-size=2147483647 -F /usr/local/etc/suricata/capture-filter.bpf"
[ -z "$suricata_divertport" ] && suricata_divertport="8000"
[ -z "$suricata_netmap" ] && suricata_netmap="NO"
[ -z "$suricata_user" ] && suricata_user="root"
[ -z "$suricata_pidfile" ] && suricata_pidfile="/var/run/suricata.pid"
if [ -n "$suricata_interface" ]; then
for interface in $suricata_interface; do
suricata_flags="$suricata_flags --pcap=$interface"
done
elif [ "$suricata_netmap" != "NO" ]; then
suricata_flags="$suricata_flags --netmap"
else
suricata_flags="$suricata_flags -d $suricata_divertport"
info "Inline Mode on divert port $suricata_divertport (suricata_interface not defined)"
fi
pidfile=$suricata_pidfile
suricata_flags="$suricata_flags --pidfile $pidfile"
[ -n "$suricata_conf" ] && suricata_flags="$suricata_flags -c $suricata_conf"
suricata_prestart()
{
if ! run_rc_command status > /dev/null; then
rm -f "$pidfile"
fi
}
run_rc_command "$1"host-mode: auto
runmode: autofp
default-packet-size: 1584
max-pending-packets: 25000
defrag:
memcap: 2gb
hash-size: 65536
trackers: 65535
max-frags: 65535
prealloc: yes
timeout: 60
flow:
memcap: 6gb
hash-size: 65536
prealloc: 25600
emergency-recovery: 30
vlan:
use-for-tracking: true
stream:
memcap: 6gb
# memcap-policy: ignore
checksum-validation: no
prealloc-sessions: 262144
#midstream: false
#midstream-policy: ignore
inline: no
bypass: yes
# midstream-policy: bypass
reassembly:
memcap: 1gb
# memcap-policy: bypass
depth: 2mb
toserver-chunk-size: 2560
toclient-chunk-size: 2560
randomize-chunk-size: yes
# randomize-chunk-range: 10
# raw: yes
segment-prealloc: 4096
# check-overlap-different-data: true
mpm-algo: hs
spm-algo: auto
threading:
set-cpu-affinity: yes
detect-thread-ratio: 0.75
pcap:
- interface: ix0
buffer-size: 2147483647
- interface: ix1
buffer-size: 2147483647
- interface: lagg0
buffer-size: 2147483647not ((ether[12:2] = 0x8100 and (ether[14:2] & 0x0fff = 78 or ether[14:2] & 0x0fff = 234 or ether[14:2] & 0x0fff = 345)) or 2nd group - following the above line (no return/new-line):(vlan and ((net 192.168.15.0/24 and 192.168.16.0/24) or (net 192.168.15.0/24 and 192.168.89.0/24)) or (net ipv6subnet1 and ipv6subnet2) or (net ipv6subnet1 and ipv6subnet3) or (broadcast or multicast) or (net 192.168.230/24 or 192.168.240.0/24 or 224.0.0.0/4 or ff00::/8 or fe80::/10) or (((icmp or icmp6) or (port 0 or 67 or 68 or 123 or 137 or 138 or 139 or 445 or 514 or 853 or 1900 or 2055 or 2056 or 3000 or 5044 or 5140 or 5142 or 5143 or 5353 or 5355 or 6060 or 8006 or 8291 or 9001 or 9090 or 9200 or 9600)) and (net 192.168.0.0/16 or ipv6subnet::/56)) or (host 192.168.33.44 or 192.168.55.66) or (host ipv6host1 or ipv6host2) or (src host publicip and ((dst port 853) or (src port 00000) or (src portrange 00000-00000 or 00000-00000))) or (dst host publicip and ((src port 853) or (dst port 00000) or (dst portrange 00000-00000 or 00000-00000)))) or 3rd group - following the above line (no return/new-line) is the final and third part (effectively the same as above, only we are say it is not vlan tagged):(ether[12:2] != 0x8100 and ((net 192.168.15.0/24 and 192.168.16.0/24) or (net 192.168.32.0/24 and 192.168.89.0/24)) or (net ipv6subnet1 and ipv6subnet2) or (net ipv6subnet2 and ipv6subnet3) or (broadcast or multicast) or (net 192.168.230/24 or 192.168.240.0/24 or 224.0.0.0/4 or ff00::/8 or fe80::/10) or (((icmp or icmp6) or (port 0 or 67 or 68 or 123 or 137 or 138 or 139 or 445 or 514 or 853 or 1900 or 2055 or 2056 or 3000 or 5044 or 5140 or 5142 or 5143 or 5353 or 5355 or 6060 or 8006 or 8291 or 9001 or 9090 or 9200 or 9600)) and (net 192.168.0.0/16 or ipv6subnet::/56)) or (host 192.168.33.44 or 192.168.55.66) or (host ipv6host1 or ipv6host2) or (src host publicip and ((dst port 853) or (src port 00000) or (src portrange 00000-00000 or 00000-00000))) or (dst host publicip and ((src port 853) or (dst port 00000) or (dst portrange 00000-00000 or 00000-00000)))))Please specify a valid port number (1-65535). A service name is also possible (afs3-fileserver, aol, auth, avt-profile-1, cvsup, domain, ftp, hbci, http, https, igmpv3lite, imap, imaps, ipsec-msft, ipsec-nat-t, isakmp, l2f, ldap, microsoft-ds, ms-streaming, ms-wbt-server, msnp, nat-stun-port, netbios-dgm, netbios-ns, netbios-ssn, nntp, ntp, openvpn, pop3, pop3s, pptp, radius, radius-acct, rfb, sip, smtp, snmp, snmptrap, ssh, submission, telnet, teredo, tftp, urd, wins).