"Recent posts
#1
26.7 Series / Re: Invalid argument errors wh...
Last post by (MARLOO) - Today at 10:37:52 PMQuote from: Shad on Today at 05:28:02 PMNew smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
Hi Shad,
Unknown_Attribute alone does not indicate a faulty obsolete drive. Several Micron models are already supported, so could you post:
smartctl -i /dev/ada0
smartctl -P show /dev/ada0
You can remove the serial number before posting.
You can also try a newer drive database without replacing the installed one:
fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0
Let us know whether any of the Unknown_Attribute names change.
#2
26.7 Series / Re: 26.7.7 — Security audit re...
Last post by franco - Today at 06:24:19 PM> However, the security audit reports six vulnerable packages:
I'm curious... what is the motivation for these random security vulnerability posts? We're not fast enough? We're not aware of this?
I checked the release date for 26.7.7 and it was just 13 days ago. Since then FreeBSD released TWO batches of security advisories we miss. Unbound, Curl, NSS, Brotli, OpenSSH 10.6 breaking their own PQ compatibility they introduced in 10.5.
I've not even mentioned last weeks PHP surprise or any of the AI security reports we received, are fixing and trying to manage while releasing 26.10 business major update on Wednesday and a 26.7.8 very likely on Thursday.
Last week was one of the craziest weeks I've ever seen. We're going to see more of it. If you can please don't try to nudge us for something we very likely already work on. This would be my takeaway from last week.
Thank you,
Franco
I'm curious... what is the motivation for these random security vulnerability posts? We're not fast enough? We're not aware of this?
I checked the release date for 26.7.7 and it was just 13 days ago. Since then FreeBSD released TWO batches of security advisories we miss. Unbound, Curl, NSS, Brotli, OpenSSH 10.6 breaking their own PQ compatibility they introduced in 10.5.
I've not even mentioned last weeks PHP surprise or any of the AI security reports we received, are fixing and trying to manage while releasing 26.10 business major update on Wednesday and a 26.7.8 very likely on Thursday.
Last week was one of the craziest weeks I've ever seen. We're going to see more of it. If you can please don't try to nudge us for something we very likely already work on. This would be my takeaway from last week.
Thank you,
Franco
#3
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - Today at 05:49:08 PMHi babagoo,
Good, that is some progress: this time 8 packages came down instead of 4. Since it stops at a different package each time (before it was php85 dom, now krb5), I do not think a single file is the problem. It looks more like the connection drops now and then during longer downloads.
Things to try:
1. Just run the update again. Packages already downloaded are kept, so every new try should get a bit further. It may need a few tries.
2. If your virtual machines use the NAT network of VMware, try a bridged network adapter for the WAN interface instead, or the other adapter type if you have a choice. NAT in VMware Workstation is a common source of dropped long transfers.
3. Test the connection from the firewall with a longer ping to a public address, and look at whether you lose packets. Packet loss would explain what you see.
4. If your host computer runs a VPN, a firewall program or an antivirus with web scanning, switch it off for a moment during the update.
Please tell us if one of these changes anything.
Sergio
Good, that is some progress: this time 8 packages came down instead of 4. Since it stops at a different package each time (before it was php85 dom, now krb5), I do not think a single file is the problem. It looks more like the connection drops now and then during longer downloads.
Things to try:
1. Just run the update again. Packages already downloaded are kept, so every new try should get a bit further. It may need a few tries.
2. If your virtual machines use the NAT network of VMware, try a bridged network adapter for the WAN interface instead, or the other adapter type if you have a choice. NAT in VMware Workstation is a common source of dropped long transfers.
3. Test the connection from the firewall with a longer ping to a public address, and look at whether you lose packets. Packet loss would explain what you see.
4. If your host computer runs a VPN, a firewall program or an antivirus with web scanning, switch it off for a moment during the update.
Please tell us if one of these changes anything.
Sergio
#4
26.7 Series / Re: Invalid argument errors wh...
Last post by Shad - Today at 05:28:02 PMI tried to repair the file system, for some reasons it completed almost instantly and said that the file system had recovered.
but I already had some problems with this disk, and given that I had bought a 2nd hand msata disk (basically new ones are more expensive than nvme for some reasons), I seized the opportunity to migrate to the new disk.
Apart from the isc -> kea unexpected migration, it was smooth.
New smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
For now I'll keep it as it is, and look after periodic smart tests to see how it's going.
Thanks for your help.
but I already had some problems with this disk, and given that I had bought a 2nd hand msata disk (basically new ones are more expensive than nvme for some reasons), I seized the opportunity to migrate to the new disk.
Apart from the isc -> kea unexpected migration, it was smooth.
New smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
For now I'll keep it as it is, and look after periodic smart tests to see how it's going.
Thanks for your help.
#5
Hardware and Performance / Re: Mono Gateway (an NXP-based...
Last post by Greg_E - Today at 05:26:21 PMThat's not a good sign!
#6
Hardware and Performance / Re: Semi parts bin new build
Last post by Greg_E - Today at 05:24:53 PMQuote from: pfry on October 23, 2026, 01:19:34 AMHeh. I haven't seen a quad X710 for $125, though (unless $150 counts).
They have gone up recently, I probably should have bought 3 of them when I bought. The dual 25g x710 have also gone up recently.
One thing to note about these cards, not all speeds are available in the x710 series. You may be limited to 1/10 or 10/25. But the twisted pair should offer multi-gig speeds from 10m up through 10g.
#7
High availability / Re: CARP update of backup fire...
Last post by babagoo - Today at 04:52:02 PMThanks for the suggestions Sergio. I tried them and this time the download stops at the package: krb5: 1.22.2_3.
See below:
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Mon Oct 26 15:46:34 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: .......... done
[ 5/21] Fetching php85-filter-8.5.12: .... done
[ 6/21] Fetching php85-simplexml-8.5.12: .... done
[ 7/21] Fetching php85-pdo-8.5.12: ........ done
[ 8/21] Fetching cyrus-sasl-gssapi-2.1.28: .... done
[ 9/21] Fetching krb5-1.22.2_3: ..
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
See below:
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Mon Oct 26 15:46:34 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: .......... done
[ 5/21] Fetching php85-filter-8.5.12: .... done
[ 6/21] Fetching php85-simplexml-8.5.12: .... done
[ 7/21] Fetching php85-pdo-8.5.12: ........ done
[ 8/21] Fetching cyrus-sasl-gssapi-2.1.28: .... done
[ 9/21] Fetching krb5-1.22.2_3: ..
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
#8
German - Deutsch / Re: Upgrade 26.7.5 > 26.7.6 od...
Last post by Hellgirl - Today at 04:10:36 PM@meyergru: Du bist der Beste! Genau das war das Problem! Diesen Config Fehler schleppe ich wohl seit Anbeginn meiner Installation mit und da die Reihenfolge nun scheinbar anders initialisiert, fiel das ganze erst ab Version 26.7.6 auf und führte erst ab dann zu dem besagten Phänomen.
Ich danke Dir vielmals für Deine Unterstützung, genauso natürlich @viragomann, welcher mich in die richtigen Analysen geführt hat!
Ich habe also nun nicht die IP aus dem LAN Interface entfernt, weil er mich dann ja mangels IP nicht speichern lässt. Ich habe stattdessen das ganze LAN Interface einfach deaktiviert (Haken bei enalbe Interface entfernt) und alle Problem sind damit nach einem Reboot verschwunden.
Die OPNsense ist wirklich ein hervorragendes Produkt, aber vielmehr lebt es von einer sehr starken Community, was man hier wieder gesehen hat :-)
Vielen Dank nochmal, dass Ihr Euch die Zeit genommen habt. Darauf wäre ich wohl alleine nicht gekommen. Ich war immer der Meinung, ein LAN Interface muss enabled sein. Muss es natürlich nicht, wenn darauf lauter VLAN´s laufen ;-)
Ich danke Dir vielmals für Deine Unterstützung, genauso natürlich @viragomann, welcher mich in die richtigen Analysen geführt hat!
Ich habe also nun nicht die IP aus dem LAN Interface entfernt, weil er mich dann ja mangels IP nicht speichern lässt. Ich habe stattdessen das ganze LAN Interface einfach deaktiviert (Haken bei enalbe Interface entfernt) und alle Problem sind damit nach einem Reboot verschwunden.
Die OPNsense ist wirklich ein hervorragendes Produkt, aber vielmehr lebt es von einer sehr starken Community, was man hier wieder gesehen hat :-)
Vielen Dank nochmal, dass Ihr Euch die Zeit genommen habt. Darauf wäre ich wohl alleine nicht gekommen. Ich war immer der Meinung, ein LAN Interface muss enabled sein. Muss es natürlich nicht, wenn darauf lauter VLAN´s laufen ;-)
#9
26.7 Series / Re: 26.7.7 — Security audit re...
Last post by Amodin - Today at 03:44:38 PMWell first, I don't know why you're using the Community Edition for business, but secondly, your list appears that it would be a FreeBSD issue and/or the providers of the packages that would need to update them, wouldn't it? OPN isn't the developer for packages/plugins and they are actually quite active in letting FreeBSD know about issues that are problematic.
Things like Unbound don't have to be used in the firewall. I don't use it on OPN, I maintain recursive DNS servers separate from OPN that use Unbound. Instead, you could use another package other than keeping it on the firewall, or alternative that's offered in OPN. Disabling SSH should be your go-to anyways, so it can't even be used, and only turn it on when/if you need it.
Franco is really, really good about getting updates out as quickly as they are available, but they aren't necessarily his responsibility for updating them.
And if you wait for every package to be patched, you're essentially going to play whack a mole, because there's always something found, something fixed. The PHP2Shell vulns have been around for 10 years, and they were only discovered because AI found them, not a hacktivist. So, you'd be waiting forever to put something into production.
Things like Unbound don't have to be used in the firewall. I don't use it on OPN, I maintain recursive DNS servers separate from OPN that use Unbound. Instead, you could use another package other than keeping it on the firewall, or alternative that's offered in OPN. Disabling SSH should be your go-to anyways, so it can't even be used, and only turn it on when/if you need it.
Franco is really, really good about getting updates out as quickly as they are available, but they aren't necessarily his responsibility for updating them.
And if you wait for every package to be patched, you're essentially going to play whack a mole, because there's always something found, something fixed. The PHP2Shell vulns have been around for 10 years, and they were only discovered because AI found them, not a hacktivist. So, you'd be waiting forever to put something into production.
#10
26.7 Series / Re: Crowdsec not starting (fou...
Last post by Amodin - Today at 03:34:29 PMYeah, I read that too which is what's perplexing and filtering doesn't seem to be consistent, because I have multiple DNS names in my exception alias, and one of them is this domain we are at, lol. But others simply won't go through. The only thing I can figure is what I saw in the referenced post about Crowdsec hosting in Ireland which I tend to receive a lot of port scanning and it's on my GeoIP blocklist. I confirmed it's GeoIP blocking, because I can disable the rule and everything is accessible.
I even forced the tables to update after making the changes in SSH, and it didn't update.
I'll double check the rule I have in place, as I believe that I have my Interface set to 'any' and see how that impacts my exceptions.
I even forced the tables to update after making the changes in SSH, and it didn't update.
I'll double check the rule I have in place, as I believe that I have my Interface set to 'any' and see how that impacts my exceptions.
