Recent posts

#1

French - Français / OPNsense chez mes clients PME ...

Last post by Souad - Today at 05:41:57 AM

Salut à tous, ça fait maintenant plusieurs années que je gère le parc OPNsense d'une douzaine de PME sur Saint-Étienne et la Loire, avec quelques clients aussi sur Lyon.

Du VPN site-à-site, des règles NAT à revoir régulièrement, des migrations de temps en temps. Il y a environ deux mois j'ai terminé une migration chez un cabinet comptable, tout le le VPN site-à-site à remonter proprement entre leurs deux sites, et ça m'a pris un temps fou. Le genre de mission où t'es à fond dessus pendant des jours et où pendant ce temps là tu prospectes zéro. Et c'est là que je me suis dit, bon, à ce rythme je vais jamais développer mon portefeuille toute seule. Voilà. Entre le technique et l'administratif j'ai déjà plus vraiment de créneau pour aller démarcher des nouvelles PME. Du coup je suis passée par pour publier une annonce et voir si je pouvais trouver un agent commercial indépendant qui présente mes prestations OPNsense à des PME que je n'ai pas le temps de démarcher.

J'ai reçu quelques profils en une dizaine de jours, franchement plus vite que ce que j'imaginais. Après je découvre un peu le système, je viens plutôt du monde technique donc gérer une relation avec un commercial terrain c'est nouveau pour moi... Si certains ici ont déjà mis en place ce genre de fonctionnement pour leur activité de conseil, je suis preneuse de retours sur comment vous cadrez les mandats. Merci d'avance pour vos retours

[meyergru]

#2

Hardware and Performance / Re: Warning about RealTek adap...

Last post by moonman - Today at 01:02:19 AM

I have x570 motherboard (AsRock x570 Phantom Gaming 4) with 5950x. I used to have AQC113 (non-C) installed into the bottom PCIe x1 slot and it was working fine at Gen4 speeds. The card itself was x4, but AsRock has those open ended slots where you can actually insert any card in them. I also made sure to get AQC113 and not AQC113C or other variant as that the one wiht PCIe Gen4 support. HWINFO64 confirmed it was Gen4 x1 speeds and iperf3 as well. The only problem was that every time I made my computer go to sleep it would come back with a non-working LAN. I had to reboot (or hibernate) for the card to start working again.

I bought rtl8127 card from amazon and it's working flawlessly in the same slot now. No issues at all.

My point, meyergru, it could be just your particular motherboard and not all x570 motherboards out there.

#3

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by Patrick M. Hausen - Today at 12:41:46 AM

What makes you think that you need to install the bootloader to the secondary drive?

How are you going to boot from the secondary drive when the primary one fails?

#4

26.7 Series / Re: No install on my new CWWK

Last post by jxxaxxy - Today at 12:26:58 AM

Your welcome.  I had to do the same thing when upgrading failed due to UFS and I have an n200 mini pc.  I wanted to switch over to ZFS anyways so it wasn't that big of a deal.  Just not sure why the underlying OS has the issue with UFS after it worked well for so long.

#5

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by Kevin G. - August 16, 2026, 11:39:44 PM

with loads of successful upgrades so far I can only assume some sort of setup/settings have come to bite.

Thank you for the reply.

What makes you think that you need to install the bootloader to the secondary drive?

It was just part of what I have been reading needs to be done to get ZFS corrected?

Do you have a mirrored pair of disks for the OS ? If yes, then it is a likely possibility but if you can boot after the upgrade, then you can look at that afterwards.

Yes, and i can boot to OpnSense and look at (what appears to be) a working build...other than no internet access.

What's the status now, is it rolledback via a snapshot?

No, it's completely in the state of the upgrade and migrated rules. UI works, I get the new dashboard, Rules appear to be in place...I had too many questions to give up on it, or attempt a fresh install. Someone on the app thought it might be the kernel fail...but it doesn't (didn't) stay in the boot loop. When I manually restarted, the upgrade must have continued (or I hadn't waited long enough).

Note that if you had to put the isp router back in and then had router-behind-a-router, then that could account for no clients hitting it.

I only put the ISP provided router in to get things working. My wife works from home, so I need a contingency to keep her up and running. The OpnSense box is offline while the ISP router is in place. I can only devote time to the fix late at night, or on the weekends.

#6

Intrusion Detection and Prevention / Re: Optimization up and drops ...

Last post by jonny5 - August 16, 2026, 11:22:56 PM

If you have enabled stats in your custom.yaml for the eve.json output, this works quite well to watch your drop rate:

Code Select Expand

tail -f -n 100000 /var/log/suricata/eve.json | jq -c 'select(.event_type=="stats") | select(.stats.capture.kernel_packets > 0) | {timestamp: .timestamp, drop_pct: (.stats.capture.kernel_drops / .stats.capture.kernel_packets * 100)}' ;

[One:]

#7

Intrusion Detection and Prevention / Optimization up and drops decr...

Last post by jonny5 - August 16, 2026, 11:06:15 PM

One:
Running IDS mode via PCAP, with buffer modifications

Two:
I've modified the suricata service file to achieve this, not a permanent fix, wanting to discuss and see if it helps others before attempting to see how to integrate this improvement

The whole of my /usr/local/etc/rc.d/suricata:

Code Select Expand

#                Default: root
# suricata_pidfile (str):    Pidfile to store pid of suricata process
#                Default: /var/run/suricata.pid

. /etc/rc.subr

name="suricata"
rcvar=suricata_enable

start_precmd="suricata_prestart"
command="/usr/local/bin/suricata"

load_rc_config $name

[ -z "$suricata_enable" ]    && suricata_enable="NO"
[ -z "$suricata_conf" ]        && suricata_conf="/usr/local/etc/suricata/suricata.yaml"
# [ -z "$suricata_flags" ]    && suricata_flags="-D"
suricata_flags="-D --pcap-buffer-size=2147483647 -F /usr/local/etc/suricata/capture-filter.bpf"
[ -z "$suricata_divertport" ]    && suricata_divertport="8000"
[ -z "$suricata_netmap" ]    && suricata_netmap="NO"
[ -z "$suricata_user" ]        && suricata_user="root"
[ -z "$suricata_pidfile" ]    && suricata_pidfile="/var/run/suricata.pid"

if [ -n "$suricata_interface" ]; then
    for interface in $suricata_interface; do
        suricata_flags="$suricata_flags --pcap=$interface"
    done
elif [ "$suricata_netmap" != "NO" ]; then
    suricata_flags="$suricata_flags --netmap"
else
    suricata_flags="$suricata_flags -d $suricata_divertport"
    info "Inline Mode on divert port $suricata_divertport (suricata_interface not defined)"
fi

pidfile=$suricata_pidfile
suricata_flags="$suricata_flags --pidfile $pidfile"

[ -n "$suricata_conf" ]    && suricata_flags="$suricata_flags -c $suricata_conf"

suricata_prestart()
{
    if ! run_rc_command status > /dev/null; then
        rm -f "$pidfile"
    fi
}
run_rc_command "$1"
Three:
I've found that if I watch the interfaces/trunks that have the VLANs I get less drops and I believe this is because of fewer "interfaces", I update/modify this in my custom.yaml in /usr/local/etc/suricata/conf.d/custom.yaml it gets loaded after the suricata.yaml and is a permanent element of OPNSense that can be manually changed

Important elements of my custom.yaml:

Code Select Expand

host-mode: auto
runmode: autofp
default-packet-size: 1584
max-pending-packets: 25000
defrag:
  memcap: 2gb
  hash-size: 65536
  trackers: 65535
  max-frags: 65535
  prealloc: yes
  timeout: 60
flow:
  memcap: 6gb
  hash-size: 65536
  prealloc: 25600
  emergency-recovery: 30
vlan:
  use-for-tracking: true
stream:
  memcap: 6gb
  # memcap-policy: ignore
  checksum-validation: no
  prealloc-sessions: 262144
  #midstream: false
  #midstream-policy: ignore
  inline: no
  bypass: yes
  # midstream-policy: bypass
  reassembly:
    memcap: 1gb
    # memcap-policy: bypass
    depth: 2mb
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560
    randomize-chunk-size: yes
    # randomize-chunk-range: 10
    # raw: yes
    segment-prealloc: 4096
    # check-overlap-different-data: true
mpm-algo: hs
spm-algo: auto
threading:
  set-cpu-affinity: yes
  detect-thread-ratio: 0.75
pcap:
  - interface: ix0
    buffer-size: 2147483647
  - interface: ix1
    buffer-size: 2147483647
  - interface: lagg0
    buffer-size: 2147483647
With PCAP in Autofp mode and threading:set-cpu-affinity: yes and threading:detect-thread-ratio: 0.75 then at least one or more cores is free to IRQ/etc. and with the BPF I have a three stage filter

BPF Filter lightening the load on the CPUs:
1st group - the VLANs I do not want, including the not element as we are excluding all of this:

Code Select Expand

not ((ether[12:2] = 0x8100 and (ether[14:2] & 0x0fff = 78 or ether[14:2] & 0x0fff = 234 or ether[14:2] & 0x0fff = 345)) or 2nd group - following the above line (no return/new-line):

Code Select Expand

(vlan and ((net 192.168.15.0/24 and 192.168.16.0/24) or (net 192.168.15.0/24 and 192.168.89.0/24)) or (net ipv6subnet1 and ipv6subnet2) or (net ipv6subnet1 and ipv6subnet3) or (broadcast or multicast) or (net 192.168.230/24 or 192.168.240.0/24 or 224.0.0.0/4 or ff00::/8 or fe80::/10) or (((icmp or icmp6) or (port 0 or 67 or 68 or 123 or 137 or 138 or 139 or 445 or 514 or 853 or 1900 or 2055 or 2056 or 3000 or 5044 or 5140 or 5142 or 5143 or 5353 or 5355 or 6060 or 8006 or 8291 or 9001 or 9090 or 9200 or 9600)) and (net 192.168.0.0/16 or ipv6subnet::/56)) or (host 192.168.33.44 or 192.168.55.66) or (host ipv6host1 or ipv6host2) or (src host publicip and ((dst port 853) or (src port 00000) or (src portrange 00000-00000 or 00000-00000))) or (dst host publicip and ((src port 853) or (dst port 00000) or (dst portrange 00000-00000 or 00000-00000)))) or 3rd group - following the above line (no return/new-line) is the final and third part (effectively the same as above, only we are say it is not vlan tagged):

Code Select Expand

(ether[12:2] != 0x8100 and ((net 192.168.15.0/24 and 192.168.16.0/24) or (net 192.168.32.0/24 and 192.168.89.0/24)) or (net ipv6subnet1 and ipv6subnet2) or (net ipv6subnet2 and ipv6subnet3) or (broadcast or multicast) or (net 192.168.230/24 or 192.168.240.0/24 or 224.0.0.0/4 or ff00::/8 or fe80::/10) or (((icmp or icmp6) or (port 0 or 67 or 68 or 123 or 137 or 138 or 139 or 445 or 514 or 853 or 1900 or 2055 or 2056 or 3000 or 5044 or 5140 or 5142 or 5143 or 5353 or 5355 or 6060 or 8006 or 8291 or 9001 or 9090 or 9200 or 9600)) and (net 192.168.0.0/16 or ipv6subnet::/56)) or (host 192.168.33.44 or 192.168.55.66) or (host ipv6host1 or ipv6host2) or (src host publicip and ((dst port 853) or (src port 00000) or (src portrange 00000-00000 or 00000-00000))) or (dst host publicip and ((src port 853) or (dst port 00000) or (dst portrange 00000-00000 or 00000-00000)))))
^ Note about the above bit of BPF, it seems with the Code block when you copy misses the space at the end, the first and second group have a space after the "or" and before the next group, be sure to add it back

Extra edit: The "vlan" element of BPF shifts the inspection point for the host and port elements in the packet, it does not filter in or out VLAN packets, and might be the one place for a logic upgrade to this

#8

26.7 Series / Re: update 26.7.1 to 26.7.2 fa...

Last post by cookiemonster - August 16, 2026, 10:47:17 PM

It might just need to install the bootloader to the disk. Can you boot to a usb stick/live freebsd distro? Easier to use the native freeBSD tools not the linux ones for this case.
When booted to the live session, show the partitions on this disk.:
$gpart show

#9

26.7 Series / Re: Another 26.7 "Upgrade Fail...

Last post by cookiemonster - August 16, 2026, 10:42:25 PM

with loads of successful upgrades so far I can only assume some sort of setup/settings have come to bite.
What makes you think that you need to install the bootloader to the secondary drive? Do you have a mirrored pair of disks for the OS ? If yes, then it is a likely possibility but if you can boot after the upgrade, then you can look at that afterwards.
What's the status now, is it rolledback via a snapshot?

Note that if you had to put the isp router back in and then had router-behind-a-router, then that could account for no clients hitting it.

#10

26.7 Series / Ability to select from Transla...

Last post by jonny5 - August 16, 2026, 10:29:51 PM

In https://opnsense/ui/firewall/source_nat#:

Since I believe our Firewall Rule Migration, when you create a Source NAT Firewall rule, and try to select a port alias you have created that is a numeric port/portrange the UI will tell you that you must use a port name word to select that port.

The error message:

Code Select Expand

Please specify a valid port number (1-65535). A service name is also possible (afs3-fileserver, aol, auth, avt-profile-1, cvsup, domain, ftp, hbci, http, https, igmpv3lite, imap, imaps, ipsec-msft, ipsec-nat-t, isakmp, l2f, ldap, microsoft-ds, ms-streaming, ms-wbt-server, msnp, nat-stun-port, netbios-dgm, netbios-ns, netbios-ssn, nntp, ntp, openvpn, pop3, pop3s, pptp, radius, radius-acct, rfb, sip, smtp, snmp, snmptrap, ssh, submission, telnet, teredo, tftp, urd, wins).
Effectively to enter a natural port/portrange you have to type the numeric values in manually.

I would think that since the alias is a numeric value it would work here, but you have to select "Single port or range" and then enter the numeric value manually?

Extra:
Other than this, it would appear quite an improvement to move into 27 and now 27.2, also love the fix to the Service status, looks great!!