Recent posts

#1

26.7 Series / Re: 26.7.6: unbound (and syslo...

Last post by Canardo96 - Today at 08:23:57 AM

Hi all,

I am troubleshooting recurring Unbound crashes on OPNsense 26.7.6_3 running under Microsoft Hyper-V.

The error is:

pid XXXXX (unbound), jid 0, uid 59: exited on signal 11
(no core dump - sugid process denied by kern.sugid_coredump)

I previously had several stability problems on this OPNsense VM, including Zenarmor/netmap and syslog-ng issues.

To eliminate configuration corruption and other variables, I completely abandoned that VM.

I created a new Hyper-V VM, performed a clean OPNsense installation and manually rebuilt the configuration. No configuration backup from the previous installation was restored.

The good news:
- Zenarmor is now stable
- No previous netmap problems
- syslog-ng is stable
- The firewall itself is operating normally

Unfortunately, Unbound has started crashing with signal 11 again.

Environment:
- OPNsense 26.7.6_3
- FreeBSD 15.1-RELEASE-p4
- Microsoft Hyper-V
- 4 vCPU
- ~12 GB RAM
- hn0/hn1
- Zenarmor 2.7

Has anyone seen recurring Unbound SIGSEGV crashes on OPNsense 26.7.x under Hyper-V?

Since the problem returned on a clean VM without restoring the old configuration, I am especially interested in what debugging information I should collect to determine the cause.

Thanks,
Maxim

#2

26.7 Series / Unbound repeatedly crashes wit...

Last post by Canardo96 - Today at 08:23:13 AM

Hi all,

I am experiencing repeated Unbound crashes on OPNsense 26.7.6_3 running under Microsoft Hyper-V.

The recurring kernel message is:

pid XXXXX (unbound), jid 0, uid 59: exited on signal 11
(no core dump - sugid process denied by kern.sugid_coredump)

Environment:
- OPNsense 26.7.6_3
- FreeBSD 15.1-RELEASE-p4
- Microsoft Hyper-V
- 4 vCPU
- Approx. 12 GB RAM
- Hyper-V network interfaces hn0 / hn1
- Zenarmor 2.7
- Unbound DNS Resolver

I originally had a very unstable OPNsense VM. Besides the Unbound SIGSEGV crashes, I saw syslog-ng aborts, Zenarmor agent crashes and netmap-related issues.

Because it was becoming almost impossible to determine the root cause, I decided not to restore or repair that VM.

Instead, I created a completely new Hyper-V VM and installed OPNsense from scratch.

Important:
- New VM
- Clean OPNsense installation
- Configuration manually recreated
- No old OPNsense configuration backup restored
- Zenarmor freshly installed and configured

The new VM is now operating normally and Zenarmor/netmap also appears to be working correctly.

However, Unbound is crashing again with signal 11.

So the persistent issue that remains after a completely clean rebuild is specifically:

    unbound: exited on signal 11

This makes the Unbound crash particularly interesting, because it has now occurred on both the original installation and a completely new Hyper-V VM without restoring the previous configuration.

Has anyone experienced similar Unbound SIGSEGV crashes with:

- OPNsense 26.7.x
- FreeBSD 15.1
- Microsoft Hyper-V
- hn(4) network interfaces

I would particularly like to determine whether this is a known Unbound/FreeBSD/Hyper-V issue, or whether there is something specific I should collect or enable to obtain a useful Unbound core dump.

At this point I do NOT see the previous Zenarmor/netmap instability on the newly built VM. Zenarmor is currently running normally.

Any suggestions on what Unbound debugging information I should collect next would be very welcome.

Thanks,
Maxim

#3

26.7 Series / Re: 26.7.6: unbound (and syslo...

Last post by magnust - Today at 08:02:24 AM

On Hyper-V here too, same problem. Just did the "opnsense-update -zkr 26.7.6-hyperv" and hope for the best :-D

Looking good so far

#4

26.7 Series / Re: Gradual Internet Performan...

Last post by pfry - Today at 04:57:13 AM

[...]shitty Phison Controller[...]

It's a low-capacity SATA device. It's probably competitive within its class. Not what I would choose (SATA, M.2), but appropriate for the VP2420. From the SMART output, it looks happy.

#5

Zenarmor (Sensei) / Re: Cancelling my subscription...

Last post by abenaou - Today at 04:54:33 AM

Funny enough, last week I sent them an email to get current pricing for my work system... No replies yet. I have another support contract for a different product that we aren't renewing, and I wanted to see if ZA could fit in its spot.

I do wish they would make a reduced price lab license with full multithreaded support. Not sure how to keep people honest, but it would be nice.

On this part I am cutting them some slack as I think it is a smaller team, so normal to need some time, so far the only ticket I opened was dealt with acceptably swiftly.

As for the multi-core support unless you have some 2.5gb/s or more bandwidth I genuinely don't think it is need, I have never enabled the option and when I thought about upgrading my CPU I was simply on the wrong troubleshooting path, I was wrongly confusing chocking IOPS with high cpu load, the latter was a direct result of queues forming up as a result of a slow nvme (lacked a dram cache), having a database like SQLite or elasticsearch on a slower nvme/ssd might give the false impression that the CPU is slow to process the traffic.

#6

26.7 Series / Re: How to remove stuck DHCP l...

Last post by julsssark - Today at 03:34:07 AM

I ran into this last week when I rebuilt some VMs. I use DNSmasq and my understanding is that there is no clean way to remove a lease. My leases did not have dates in the past and all I needed to do was wait a day.

See here for a recent thread on this topic and why it requires an upstream solution: https://github.com/opnsense/core/issues/9747

#7

26.7 Series / Re: how to recover using an ol...

Last post by Netlearn - Today at 03:12:23 AM

It sucks that we can't automatically store the config on an ftp server or send it by email at least once daily when it has been changed.  If that were possible I would have set that up and I'd have the current config now.

Wrong statement: There are several plugins that provide configuration backup service. I personally use 'os-sftp-backup' and works perfectly. You even have 'os-git-backup', so you can trace every single modification in a git server.

[TL:DR] Do no blame others for your own lazyness/lack of knowledge.

Apart from that, you should always make a backup before any upgrade, so your last config would be on the last-1 version. Plus you should also take a snapshot, assuming your system uses zfs, which it's the recommended.

Make a backup before and after you make important changes. It can also help to find which change was wrong by just making a 'diff' between them.
Gonna play with firewall rules? Have a backup before just in case you even get to lose connectivity with the machine. It will take almost no time to go back.

If you follow those well-known basic advices, you won't have any problem recovering from even the total disaster. Of course, everyone is free to not make regular backups, snapshots before upgrades, or any prevention measure at all, but must be conscious of the risk it implies and don't cry if/when sh*it hits the fan.

Last but not least, being polite with the people usually gets best results when asking for help.

#8

General Discussion / Re: Virtual IP/NAT/Virtual Mac...

Last post by dsnyc - Today at 01:03:06 AM

The HYPER-V NIC that connects to the physical opensense firewall is assigned a LAN IP of 192.168.251.1 for example. This gives the HYPER-V host access to the Internet. The HYPER-V Opensense VM has the same HYPER-V NIC connected as it's WAN interface. I need to be able to have traffic to the Virtual IP to go to the WAN IP of the HYPER-V Virtual Machine Opensense. Not sure how to do this.

#9

26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...

Last post by (MARLOO) - Today at 12:44:01 AM

@Patrick M. Hausen

I understand your point: in a carefully maintained DNS zone, dynamic client names would be unwanted noise.

In my home lab, however, dynamic registration is a deliberate convenience. It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.

Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.

For servers, infrastructure and services that need stable names or certificates, I agree that explicit static DNS records are the right approach. So it is not really Dnsmasq versus Kea: it is whether you want automatic client-name registration or a clean, manually managed DNS zone.

I will stay with Dnsmasq, but use static records for the important services and infrastructure.

Both approaches are valid; yours is probably the better fit for a production-like DNS environment, while mine is the better fit for a frequently changing home lab.

#10

26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...

Last post by Patrick M. Hausen - Today at 12:26:52 AM

I use Kea and Unbound because it's simpler. I don't want dynamic DHCP clients polluting my carefully maintained DNS zone. Why would I want "Paddys-Macbook-Pro" in my DNS? DNS entries are for servers that need to be reachable by clients, have certificates, etc.

My approach. Yours is different.