"Recent posts
#1
General Discussion / Re: New WAN failover configura...
Last post by bob9999 - Today at 07:39:41 PMThanks. I read this as try it again and then reboot. Ok.
Edit.
I played around with the dns rule and it finally accepted the /32 address without the gui telling me it didn't exist. I have the rule set to inactive until I have the time to go at it again. Maybe Thursday.
Edit.
I played around with the dns rule and it finally accepted the /32 address without the gui telling me it didn't exist. I have the rule set to inactive until I have the time to go at it again. Maybe Thursday.
#3
26.7 Series / Re: OPNsense 26.7.6_3 → 26.7.7...
Last post by nero355 - Today at 07:30:05 PMThat's nice and all, but I simply wonder :
- What kind of SSD are you using ?
- Which file system are you using ?
- Has your OPNsense ever experienced unsafe shutdowns in the past ?
- Did you update/upgrade the FreeBSD Boot Loader when upgrading from 26.1.x to 26.7.x ?
- Did you perhaps update/upgrade the ZFS Pool without updating/upgrading the FreeBSD Boot Loader first ?
- Any chance the PSU or adapter of your OPNsense machine got weak after many years and had some reboots in the past without you knowing it ?
Since this is pretty much a file system issue and not an update issue I would look at these things first together with the output of 'smartctl -a /dev/<yourstoragedevice>' :)
- What kind of SSD are you using ?
- Which file system are you using ?
- Has your OPNsense ever experienced unsafe shutdowns in the past ?
- Did you update/upgrade the FreeBSD Boot Loader when upgrading from 26.1.x to 26.7.x ?
- Did you perhaps update/upgrade the ZFS Pool without updating/upgrading the FreeBSD Boot Loader first ?
- Any chance the PSU or adapter of your OPNsense machine got weak after many years and had some reboots in the past without you knowing it ?
Since this is pretty much a file system issue and not an update issue I would look at these things first together with the output of 'smartctl -a /dev/<yourstoragedevice>' :)
#4
General Discussion / Re: New WAN failover configura...
Last post by viragomann - Today at 06:14:35 PMQuote from: bob9999 on Today at 05:52:47 PMAs soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.Seems you made the same mistake as another guy recently. Look here: Setting up WAN failover
#5
German - Deutsch / Re: ACME all-inkl DNS-01 Chall...
Last post by Andi.K - Today at 06:13:29 PMDanke für die Antwort, soviel gibts da ja nicht einzustellen.
Name: irgendwas
Discription: irgendwas
Challenge Type: DNS-01
DNS Service: All-Inkl.com
DSN Sleep Time: 30sec
KAS login: mein KAS Username
KAS Authdata: mein KAS Passwort
KAS Authtype: plain
User/Pass sind die normalen Daten, die ich auch für die Webseite nutze. MFA ist deaktiviert.
Paket ist Business-Premium
VG Andi
Name: irgendwas
Discription: irgendwas
Challenge Type: DNS-01
DNS Service: All-Inkl.com
DSN Sleep Time: 30sec
KAS login: mein KAS Username
KAS Authdata: mein KAS Passwort
KAS Authtype: plain
User/Pass sind die normalen Daten, die ich auch für die Webseite nutze. MFA ist deaktiviert.
Paket ist Business-Premium
VG Andi
#6
General Discussion / New WAN failover configuration...
Last post by bob9999 - Today at 05:52:47 PMI have a problem setting up wan failover / load sharing.
Specifically, it seems to work acceptably when I leave a few steps out but dns fails if I follow all the steps that are commonly recommended.
I can't even log into 192.168.1.1:3000 (adguard home) when the final steps are attempted. Although 192.168.1.1 for Opnsense access works normally.
I have 2 gateway groups, Failover and LoadBalance. I have 2 but will probably settle on LoadBalance. Monitor IP addresses are correct.
Manually shutting one down fails over correctly to the other. Setting both WAN priorities the same seems to let the router decide. LoadBalance is RoundRobin Sticky on the gateway group. Currently, WAN1 is priority 254 and WAN2 is priority 255. 'Allow default gateway switching' makes no difference checked or unchecked.
As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.
Everything springs back to life when I remove the Gateway from the LAN.
Along the way I discovered DNS speeds up considerably when I stopped using unbound and allowed Adguard Home to be the sole DNS forwarder. That configuration stays. Unbound and DNSMasq are both disabled. I have some DNS servers also listed on the main system general page, FWIW.
Internets are Comcast and T-Mobile 5G. CGNAT from TM appears to work great double natted. T-Mobile is 192.168.12.1 from them as WAN2 address.
Question: Should I leave well enough alone? Or is there a way to make all the known and recommended configuration steps work as described in almost every article I can find on the subject?
Specifically, it seems to work acceptably when I leave a few steps out but dns fails if I follow all the steps that are commonly recommended.
I can't even log into 192.168.1.1:3000 (adguard home) when the final steps are attempted. Although 192.168.1.1 for Opnsense access works normally.
I have 2 gateway groups, Failover and LoadBalance. I have 2 but will probably settle on LoadBalance. Monitor IP addresses are correct.
Manually shutting one down fails over correctly to the other. Setting both WAN priorities the same seems to let the router decide. LoadBalance is RoundRobin Sticky on the gateway group. Currently, WAN1 is priority 254 and WAN2 is priority 255. 'Allow default gateway switching' makes no difference checked or unchecked.
As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.
Everything springs back to life when I remove the Gateway from the LAN.
Along the way I discovered DNS speeds up considerably when I stopped using unbound and allowed Adguard Home to be the sole DNS forwarder. That configuration stays. Unbound and DNSMasq are both disabled. I have some DNS servers also listed on the main system general page, FWIW.
Internets are Comcast and T-Mobile 5G. CGNAT from TM appears to work great double natted. T-Mobile is 192.168.12.1 from them as WAN2 address.
Question: Should I leave well enough alone? Or is there a way to make all the known and recommended configuration steps work as described in almost every article I can find on the subject?
#7
Web Proxy Filtering and Caching / eMudhra Intermediate CA Compro...
Last post by bamf - Today at 05:42:18 PMHi,
Using Squid on my OPNsense and the test website tells me that 6 (emSign Root TLS CA - G3) out of 12 Domains are able to connect https://emudhra.we-have-a-problem.com/
How do we get the updated revocation list into Squid?
Using Squid on my OPNsense and the test website tells me that 6 (emSign Root TLS CA - G3) out of 12 Domains are able to connect https://emudhra.we-have-a-problem.com/
How do we get the updated revocation list into Squid?
#8
26.7 Series / Re: frr plugin 2.0 was release...
Last post by Monviech (Cedrik) - Today at 05:20:08 PMSounds like a core issue to me, better go there:
https://github.com/opnsense/core
I would imagine you have the same issue e.g in the wireguard instance selectpicker where its also using the same depend on carp logic.
https://github.com/opnsense/core
I would imagine you have the same issue e.g in the wireguard instance selectpicker where its also using the same depend on carp logic.
#9
Zenarmor (Sensei) / Re: Cancelling my subscription...
Last post by abenaou - Today at 05:11:35 PMQuote from: colourcode on October 19, 2026, 10:32:45 AMWhat kind of traffic and host count are we talking about where you manage to practically kill the device?I run a 1gb download/200 mbps upload, but it wasn't the traffic that was causing the crashes/freezes, it was SQLite litterally strangling the nvme through successive writing requests, since the nvme doesn't have a cache and relies on memory, soon it runs out of "borrowed" cache memory and starts queuing up the write requests, then using all of the swap, then making ZFS ARC memory balloon, Zenarmor didn't like to be waiting for SQLite so everything was super super slow.
I didn't try TMPFS because any reboot would have resulted in me losing my data plus I wanted to kick out anything database related from the firewall, that's how I always functionned, from my experience (even professional) it is never a good idea to place the database and apps on the same server.
#10
26.7 Series / Re: SSD drive died - I disable...
Last post by pfry - Today at 04:40:29 PMQuote from: oc on Today at 05:29:50 AM[...]Interestingly enough, amazon doesn't have any Crucial MX500 size in stock[...]
The thing's been out of production for years. There might be some NOS flying around. Beware fakes/scams.
Quote from: oc on Today at 05:35:45 AMcan you please enlighten me what I need to do to achieve that?
I just boot an installation or utility image and use the appropriate partition utility. In the case of FreeBSD, the installer, which has a "live" option, and gpart. I haven't (yet) tried to install OPNsense on an existing partition setup, though - that depends on the installer. For FreeBSD, I occasionally use unequal devices as ZFS mirrors, and ZFS (and BTRFS, IIRC) on unpartitioned devices has the wacky behavior of creating an unequal mirror. I've never found documentation on how this is supposed to behave. So I install into equal partitions. The installers are largely garbage as far as partitioning and file system options; some will install into existing partitions and file systems, so you can work around them.
