Recent posts

#1

26.7 Series / Re: Gradual Internet Performan...

Last post by Patrick M. Hausen - Today at 09:44:10 PM

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

#2

26.7 Series / Re: Deny or Isolate any and al...

Last post by Patrick M. Hausen - Today at 09:40:21 PM

You can still - and possibly your ISP router did not do more than that - disable DHCP for unknown MAC addresses and add all clients explicitly and statically. While not a strong security measure against an experienced attacker it will still puzzle the occasional wardriver who somehow got hold of your WiFi secret. It will also keep out phones that change MAC addresses as a privacy measure etc. until you configure them to not do that.

People with the correct secret can still authenticate to your WiFi, try to catch some broadcast traffic, and give themselves a static IP address. But it's better than nothing.

Best if combined with client isolation on your access point.

#3

26.7 Series / Re: Deny or Isolate any and al...

Last post by Monviech (Cedrik) - Today at 09:39:31 PM

You could look into the zenarmor plugin I think it can whitelist new devices. But not an expert with it.

Good luck :)

#4

Zenarmor (Sensei) / Re: Cancelling my subscription...

Last post by abenaou - Today at 09:33:56 PM

That is something to consider, I hadn't thought about the storage being any part of the slowness. There are other reason to buy the product, the policies flexibility is one of them. And when you find a product that you like, it's nice when you can support it and keep it moving forward.

For me what gave me the hint is these errors  :

Code Select Expand

[52805] 196.658358 [1089] netmap_obj_free          ouch, double free on buffer 18426

[52805] 196.658370 [1089] netmap_obj_free          ouch, double free on buffer 18428

[52805] 196.658381 [1089] netmap_obj_free          ouch, double free on buffer 18432

[52807] igb1: link state changed to UP

[52854] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2101141, size: 65536

[52866] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2108016, size: 16384

[52874] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2101141, size: 65536

[52886] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2108016, size: 16384
Also, I noticed that sometimes the zenarmor live  session dashboard would throw a : Error (200), and that anything related to zenarmor was way too slow (policies, reports), and this had a snowball effect, SQLite has a single writer, it cannot write concurrently write data, having a dramless nvme meant that SQLite would "run out" of IOPS meaning that while locking the database it was also making zenarmor wait and freeze, it  caused a cascading failure where SQLite would get stuck, dragging zenarmor and then the netmap driver making the nics flap very often.

I think the most reliable solution would be to externalize elasticsearch, even if you install it locally you would reserve a big amount of resources to elasticsearch and might hit a performance bottleneck.

I know the Zenarmor team have their reasons for removing remote database support from the free tier plan, but it is almost a must to fully experience the benefits of the product, and this is not mentioned anywhere, and some people, me included, simply underestimate how demanding to run SQLite as a back-end, which means that it would be difficult to really appreciate the free tier without remote database support.

#5

26.7 Series / Re: Deny or Isolate any and al...

Last post by sorin - Today at 09:32:51 PM

Ahhhhh okay. Thank you again for your help!
The clarity is much appreciated, so I don't keep banging my head against this needlessly.

#6

26.7 Series / Re: Deny or Isolate any and al...

Last post by Monviech (Cedrik) - Today at 09:31:12 PM

No, as I said the interface needs the static arp flag, otherwise static assignments are just additional entries in the arp table (they dont enforce "only these are allowed" without that flag)

Its essentially this (search for "staticarp"):

https://man.freebsd.org/cgi/man.cgi?query=ifconfig


The GUI currently lacks a way to set it, as referenced in the github issue.

#7

26.7 Series / Re: Gradual Internet Performan...

Last post by tonys - Today at 09:28:48 PM

After upgrading to 27.7.7, the GUI is almost completely dead. I'm having trouble logging into the GUI now and I've restarted web gui multiple times. If I do get to the dashboard on a login, going to any other page is slow and attempting to look at firewall liveview log or states results in a complete stall of the GUI with the spinning icon. I have rebooted OPNSense from the command line multiple times, but the GUI is virtually useless at this point.

Looking at the lighttpd log via the ssh shell, I'm seeing these errors. You can see the forced restart of the GUI from the command line and the lack of socket connections. I did manage to login once after this restart and will reboot from the GUI now.

 # tail -f latest.log
<27>1 2026-10-13T13:44:40-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="9"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-3: Connection refused
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="2"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-3: Connection refused
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="3"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="4"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-0: Connection refused
<29>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="5"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.1272) [note] graceful shutdown started
<29>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="6"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.2384) server stopped by UID = 0 PID = 21007
<29>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="7"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/server.c.1973) server started (lighttpd/1.4.85)
<27>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="8"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-1: Connection refused
<27>1 2026-10-13T14:15:50-05:00 OPNsense.home.lan lighttpd 22500 - [meta sequenceId="9"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.534) connect() /var/lib/php/tmp/php-fastcgi.socket-2: Connection refused

#8

26.7 Series / Re: Deny or Isolate any and al...

Last post by sorin - Today at 09:25:40 PM

Wait, would this work? And if so, how best to implement it? Also, might it work for different subnets?
https://docs.opnsense.org/manual/neighbors.html

#9

26.7 Series / Re: Deny or Isolate any and al...

Last post by sorin - Today at 09:17:14 PM

Ahh, hmm, ok.
Then I will try to lock it down from my wifi mesh, and wait for later. Ostensibly no one is breaking into my house to plug into my network lol.
Thank you for your assistance. I will keep learning and wait till that's available in Kea.

Thank you!

#10

High availability / Re: Is CARP required on WAN wh...

Last post by viragomann - Today at 08:57:27 PM

2. What would happen if I configured a separate WAN IP address on each OPNsense node but kept CARP only on the internal interfaces?

So WAN IP of node A would only be available if A has the master role and the WAN IP of B would only be available if B is master. I think, that's not what you want at all.

Could the secondary node take over the internal VIPs and continue operating through its own WAN connection?

Yes, but your WAN IP changes then. This might not be desired.

What's the goal of this idea?