"Recent posts
#1
26.1, 26,4 Series / Re: [SOLVED] 26.1.3 and Intel ...
Last post by luckman212 - September 27, 2026, 11:05:33 PMI think I might have been affected by this (pfSense not OPN) using a Protectli VP6670 (coreboot 0.9.2 + Intel X710-BM2 firmware 9.57).
I was getting those I40E_ERR_ADMIN_QUEUE_FULL errs on my console after the ixl interfaces went dead and I had to CTRL-ALT-DEL from the local console. Thanks @felipe0123 for the script, I adapted it and am using it on my pfSense - it's only been 24h but "so far so good". Will keep posted.
I was getting those I40E_ERR_ADMIN_QUEUE_FULL errs on my console after the ixl interfaces went dead and I had to CTRL-ALT-DEL from the local console. Thanks @felipe0123 for the script, I adapted it and am using it on my pfSense - it's only been 24h but "so far so good". Will keep posted.
#2
26.1, 26,4 Series / Re: Legacy FTP ON 26.X BE
Last post by nero355 - September 27, 2026, 10:42:14 PMQuote from: meyergru on September 25, 2026, 10:53:04 PMYou only need that for active FTP, which I assumed why the question was asked.I guess you were right :
Quote from: loiclegarrec56 on September 27, 2026, 07:51:27 PMTo answer nero355's question:But it would have been nice if he had mentioned it to avoid wrong assumptions :)
In my case it's not a choice, unfortunately.
I'm dealing with a legacy application talking to an old FTP server that only does active mode.
It's being decommissioned very soon , but it still needs to keep working for a few more months, so I can't just drop FTP support in the meantime.
QuoteI'll test setup on site and report back here in case it helps anyone else running into the same gap in the documentation.Please do!
I am very curious if it still works as it should...
#3
General Discussion / Re: Going from no VLAN to VLAN...
Last post by BoNetTech - September 27, 2026, 08:02:12 PMYour last idea (untagged + fixed PVID for the mesh ports) is the right one. You can make it even simpler, and avoid the "network down for days" scenario, because you don't need VLAN 10 at all, and OPNsense doesn't need to change.
VLAN 20 only has to be a "virtual cable" inside the switch between the MR LAN port and the MS. Since the MR bridges WAN↔LAN in AP mode, the MS clients get their IP from your main network through that bridge, exactly as you observed when you cabled them directly.
So, on the switch only:
VLAN 1 (default): leave everything as it is: OPNsense port, MR WAN, all other devices. Untagged, PVID 1.
VLAN 20: the two ports for MR LAN and MS as untagged members with PVID 20, removed from VLAN 1.
The OPNsense port is not a member of VLAN 20, and no VLAN 20 interface/DHCP on OPNsense.
Your 192.168.1.1/24 LAN, DHCP and static leases stay untouched, so no subnet conflict and nothing to migrate.
Two tips:
Configure from a PC on a port you're not changing, in this order: add the two ports to VLAN 20 → set PVID 20 → remove them from VLAN 1. That way you won't lock yourself out, and if something goes wrong you only need to revert two ports.
Leave loop prevention/STP off for this change. Most smart switches run a single STP instance that isn't VLAN-aware, so if the MR passes BPDUs across its bridge, the switch may see VLAN 1 → MR → VLAN 20 as a loop and block one of those ports. If you want STP back later as a safety net, disable it on the MR WAN port and the two VLAN 20 ports.
VLAN 20 only has to be a "virtual cable" inside the switch between the MR LAN port and the MS. Since the MR bridges WAN↔LAN in AP mode, the MS clients get their IP from your main network through that bridge, exactly as you observed when you cabled them directly.
So, on the switch only:
VLAN 1 (default): leave everything as it is: OPNsense port, MR WAN, all other devices. Untagged, PVID 1.
VLAN 20: the two ports for MR LAN and MS as untagged members with PVID 20, removed from VLAN 1.
The OPNsense port is not a member of VLAN 20, and no VLAN 20 interface/DHCP on OPNsense.
Your 192.168.1.1/24 LAN, DHCP and static leases stay untouched, so no subnet conflict and nothing to migrate.
Two tips:
Configure from a PC on a port you're not changing, in this order: add the two ports to VLAN 20 → set PVID 20 → remove them from VLAN 1. That way you won't lock yourself out, and if something goes wrong you only need to revert two ports.
Leave loop prevention/STP off for this change. Most smart switches run a single STP instance that isn't VLAN-aware, so if the MR passes BPDUs across its bridge, the switch may see VLAN 1 → MR → VLAN 20 as a loop and block one of those ports. If you want STP back later as a safety net, disable it on the MR WAN port and the two VLAN 20 ports.
#4
26.1, 26,4 Series / Re: Legacy FTP ON 26.X BE
Last post by loiclegarrec56 - September 27, 2026, 07:51:27 PMThanks both for the clarification, and to meyergru for the excellent write-up — this is exactly the missing piece the docs don't mention.
To answer nero355's question: in my case it's not a choice, unfortunately. I'm dealing with a legacy application talking to an old FTP server that only does active mode It's being decommissioned very soon , but it still needs to keep working for a few more months, so I can't just drop FTP support in the meantime.
I followed meyergru's setup (NAT redirect to the ftp-proxy listener, TCP only, port 21) and it looks correct on my OPNsense 26.4 box — pfctl shows the rdr rule pointing to the proxy, and the service is listening. I'll test setup on site and report back here in case it helps anyone else running into the same gap in the documentation.
To answer nero355's question: in my case it's not a choice, unfortunately. I'm dealing with a legacy application talking to an old FTP server that only does active mode It's being decommissioned very soon , but it still needs to keep working for a few more months, so I can't just drop FTP support in the meantime.
I followed meyergru's setup (NAT redirect to the ftp-proxy listener, TCP only, port 21) and it looks correct on my OPNsense 26.4 box — pfctl shows the rdr rule pointing to the proxy, and the service is listening. I'll test setup on site and report back here in case it helps anyone else running into the same gap in the documentation.
#5
General Discussion / OPNsense-Dashboard is maintain...
Last post by highwalker - September 27, 2026, 05:53:18 PMHi all,
Some of you have used bsmithio/OPNsense-Dashboard, the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.
I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard
Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard, which it grew from. The history is in the NOTICE file.
What it shows
What changed for current OPNsense
Monitoring host
A single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.
Getting started
The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.
Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues, questions to Discussions, or reply here.
The attached screenshots show synthetic test data.
Some of you have used bsmithio/OPNsense-Dashboard, the Grafana dashboards for OPNsense fed by Telegraf, InfluxDB and Graylog. It hasn't been updated since October 2023, and newer OPNsense releases broke parts of it: the gateway script's get_interfaces_info() error, empty dashboards, and the Suricata hook that 26.1 removed.
I've picked it up and maintain it here:
github.com/tekgnosis-net/OPNsense-Dashboard
Credit goes to bsmithio and to Victor Robellini's pfSense-Dashboard, which it grew from. The history is in the NOTICE file.
What it shows
- System: CPU, load, RAM, disk, temperatures, uptime and pf statistics
- Gateways: RTT, loss and status from dpinger
- Interfaces: addresses, status, and WAN/LAN traffic and throughput, labelled with your OPNsense interface names
- Firewall log through Graylog: blocked events, ports, protocols and a GeoIP map. The top blocked flows are split into "from the internet" and "from your own networks", and each row shows whether it was a new connection or a late packet of a closed connection. Click a source to filter the whole row to it.
- Suricata alerts on a separate dashboard
What changed for current OPNsense
- Written for OPNsense 26.7, against the 26.7.4 source. The interface and gateway collector is rewritten for the current API.
- No sudoers edits any more. os-telegraf's "Run as Root" option covers what needs root: pf statistics, dpinger status and Suricata's eve.json.
- Suricata alerts come from os-telegraf's built-in Intrusion Detection Alerts input.
- The Graylog extractors follow the current filterlog format, including IPv6 and ICMPv6.
Monitoring host
A single docker compose stack, configured from one .env file: Grafana 13.2, InfluxDB 2.9, Graylog 7.1 with OpenSearch 2.19, and MongoDB 7.0. A one-shot graylog-init sets up Graylog (syslog input, extractors, stream, index set, GeoIP). If you only want metrics, a metrics-only mode runs just InfluxDB and Grafana.
Getting started
- Monitoring host: docs/stack.md
- Firewall: docs/opnsense.md covers the os-telegraf plugin, the two collector scripts and remote syslog. An Ansible playbook installs the collectors.
- Coming from the bsmithio version: the monitoring stack needs a fresh install. The playbook removes the old sudoers lines and Suricata files from the firewall.
The repository has unit tests for the firewall scripts and an end-to-end test that brings up the whole stack with synthetic data and checks every dashboard query. I run it on my own firewall.
Feedback is welcome, especially from multi-WAN, IPv6 and HA setups. Bugs and feature requests go to GitHub issues, questions to Discussions, or reply here.
The attached screenshots show synthetic test data.
#6
Hardware and Performance / Re: amd-xgbe ("ax"): interface...
Last post by BrandyWine - September 27, 2026, 05:19:28 PMQuote from: patient0 on September 17, 2026, 06:54:38 AMDoes this mean the freeBSD version in the OPNsense installer is a custom compiled version?Quote from: nero355 on September 16, 2026, 11:24:11 PMOK, but is it this for exampleI have no idea, I assume it's that but not sure.
The driver is maintained by AMD AFAIK but OPNsense made changes too since their boxes use it.
It would be much easier if the OS used KLM drivers making it much easier to swap them out.
#7
Hardware and Performance / Re: DEC-850v1 serial console o...
Last post by N0b0dy1985 - September 27, 2026, 04:43:20 PMQuote from: patient0 on September 26, 2026, 05:27:25 AMQuote from: N0b0dy1985 on September 25, 2026, 07:31:37 PMAnyone have any clue what I should be doing here? IYou can also search for DEC740/DEC750 and serial port configuration, they seem to use the same hardware (serial mmio at address 0xfedc9000).
What settings did you try so far? And do you get any output at all when booting Linux? Are you booting using grub and 'console=ttyS0,115200' was added to the 'linux' line in grub?
This blog post [Proxmox on DEC740](https://loganmarchione.com/2025/10/proxmox-backup-server-on-the-opnsense-dec740/) doesn't mention any special steps.
LLM suggests:
"Before you can get a Debian installer's serial output to appear, you must enable legacy UART in the BIOS,
At the UEFI/BIOS prompt, navigate to:
Setup Utility → AMD CBS → FCH Common Options → Uart Configuration Options
and enable the legacy UART features."
_But_ the OPNsense documentation recommends the opposite for OPNsense:
https://docs.opnsense.org/hardware/serial_connectivity.html#legacy-uart-vs-uefi-serial
"... support for EFI serial has changed, which requires EFI based systems to disable legacy support to prevent confusing the operating system"
It's probably worth changing this setting and give it a go.
Addition: I remember using clonezilla to make a complete backup of my DEC740. And adding 'console=ttyS0,115200n81' to the grub commandline (and some clonezilla specific stuff) was enough to make it work. But I'm not sure about the BIOS UART setting, I lent the DEC740 to someone and haven't got it right now.
Yep, I think you and Patrick nailed it. I cannot tell you how long I've been f***ing with this. I'll check it out and report back.
#8
Hardware and Performance / Re: DEC-850v1 serial console o...
Last post by N0b0dy1985 - September 27, 2026, 04:41:52 PMQuote from: Patrick M. Hausen on September 25, 2026, 09:33:24 PMThe ig4iic0 device is IMHO not related to the serial device. ig4iic0/Designware is an SMBus/I2C controller. There must be a way to force that uart2 to behave. Did you go into the BIOS/firmware setup and check the "legacy serial console" or some such setting?
I had forgotten all about this. I bet that's it. I'll check it and report back
#9
26.7 Series / Re: System unusable after star...
Last post by notspam - September 27, 2026, 01:07:51 PMProtectli VP2420 with 16 GB of RAM ......
Intel Celeron J6412
* Quad Core
* 1,5 MB L2-Cache
* 2,0 GHz with burst till 2,6 GHz
* Intel AES-NI hardware acceleration
is really fast enough.
A mismatch with suricata on the same interface ?
100% is in top viewed on cli?
And which are the processes using the whole cpu cores ?
Zenarmor free edition can only use 1 cpu core.
Intel Celeron J6412
* Quad Core
* 1,5 MB L2-Cache
* 2,0 GHz with burst till 2,6 GHz
* Intel AES-NI hardware acceleration
is really fast enough.
A mismatch with suricata on the same interface ?
100% is in top viewed on cli?
And which are the processes using the whole cpu cores ?
Zenarmor free edition can only use 1 cpu core.
#10
26.7 Series / Re: System unusable after star...
Last post by Seimus - September 27, 2026, 07:44:06 AMHello,
What deployment you are using, driver, interfaces, DB, etc. ?
Did you check top output?
If its ZA doing this,
Best to contact ZA support directly via a ticket using the UI.
Regards,
S.
What deployment you are using, driver, interfaces, DB, etc. ?
Did you check top output?
If its ZA doing this,
Best to contact ZA support directly via a ticket using the UI.
Regards,
S.
