Recent posts

#1

26.7 Series / Re: Crashes, and Kea DHCP Serv...

Last post by computer_freak_8 - Today at 05:22:57 PM

Kernel panic screenshot from this morning, immediately prior to submitting via the Reporter.

#2

26.7 Series / Crashes, and Kea DHCP Server r...

Last post by computer_freak_8 - Today at 05:21:41 PM

Hello,
After a very chaotic upgrade on my HomeLab firewall, I took extra care with my HomeProd, and the process went entirely differently. No packages were removed, the DHCP server was not cut over, etc. I had to do all that manually, even though I'd done the pre-work to make it a smooth transition.

I've had a few times now, over the past few weeks, two events that seem unrelated but both keep occurring. One, is the firewall itself crashing. This is annoying, but not a huge issue since it automatically reboots. A couple weeks ago (I think - I didn't write down exactly when), it had one of these crashes, only it didn't bring up the Kea DHCP server when it restarted. I've had it on my list to investigate more, and then this morning, there was no crash (uptime of 9 days, so perhaps that's when the previous crash was), but Kea was stopped again. In both cases that Kea has been stopped, clicking the "Play" button on the "Services --> Kea DHCP --> Kea DHCPv4" page is all I've had to do to resolve the issue.

As I was getting ready to make this post, I decided to check for updates, and in the process of applying them, the firewall crashed again. Kea came up properly from the crash, but it's concerning I have two different critical components (the kernel and Kea) that can't seem to stay running.

Every time I have a crash, I submit the logs using the webUI reporter page, but never get any feedback whatsoever on it.

Attaching the Kea logs where the service stopped. Also attaching a screenshot of the latest kernel panic.(May take a 2nd post because apparently I've hit a space limit.)

Was on 26.7.2 prior to this morning's updates; now on 26.7.3.

#3

26.7 Series / Re: Unbound Not Actually Block...

Last post by ticker - Today at 05:01:36 PM

Following up from my previous message, I double-checked everything and added a few of my custom blocklists back in.
I am still curious about this?

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?

Anyways..
I restarted the Unbound service and there was no yellow notification dot. I then rebooted the entire firewall, and again, no yellow dot. Saved everything and left it at that. Just using that as an indicator all my lists are parsing fine now.

I then enabled Flush the Unbound cache on reboot, restarted the service, and reset the Unbound Reporting stats. After that, I restarted the service again, turned Flush the Unbound cache on reboot back off, and restarted the service one more time.

After that I already notice after 1minute, 7 things on the blocklist which weren't even up before. The funny thing is the 7 things it already blocked were from the default lists, not my custom lists. Weird how it wasn't catching them before.

Might be a bit overkill to do all the restarts, but can't hurt.
At this point I'm going to let it sit for a few hours while I go out and see what things look like when I come back.
Edit: 5min later already at 30 blocks.

#4

German - Deutsch / Re: Log File -> Live View

Last post by meyergru - Today at 04:38:13 PM

Darin, dass es sich dabei um Layer-2-Traffic handelt, den Deine Firewall nicht sieht?

[extremely]

#5

26.7 Series / Re: Unbound Not Actually Block...

Last post by ticker - Today at 04:35:12 PM

The built-in blocklist tester returns:
{"status":"error"}

This is a clue to your problem. When operating normally it will report as "OK".

Review Unbound log file for problems.

I am looking through the logs again, but I'm not seeing much that stands out. I'm not sure why.

I did notice one thing, though. I rebooted the Unbound service and noticed the OPNsense notification dot in the top right of the GUI turned yellow. When I clicked it, it said that one of the lists couldn't be parsed due to a format error. Ok that's a hint.

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?


For testing, I removed all of my custom-added lists and left only the integrated lists enabled. I applied the changes and restarted the service, and the yellow notification did not come back.

It does seem like things are working better now, at least it's not 0 blocked.. but I'm still not sure if they're working completely. I'm seeing an extremely small number of blocked queries compared to what I remember seeing in the past. I have a handful of devices on my network, including devices that should be generating plenty of questionable/tracking DNS queries simply by being on the network, so I would expect to see significantly more blocked traffic.

For example, I just tried going to ibrainer.net from my phone's web browser. I can reach the site, and it doesn't show up in Unbound Reporting at all. However, I do see my phone's client IP appearing many times in the Unbound reporting, so the phone is definitely generating DNS queries through Unbound. I can also only 2 domains that it did block, and it does mention the blocklist: LIGHT - Relaxed Blocking - Hagezi Multi; which is a good sign.

The confusing part is that I have ibrainer.net manually added under:
Unbound → Blocklists → Blocklist Domains

The Blocklist Tester also confirms that it is being blocked:

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "Primary Blocklist",
    "id": "ddbb5190-43e0-4d07-89d3-25e95053bbbf",
    "passlist": "",
    "prio": 3.402823669209385e+38,
    "hidx": 0,
    "bl": "Custom"
  }
}


So Unbound clearly knows that ibrainer.net should be blocked, yet I can still access it from the phone.


And I just triple checked, my iPhone is manually configured to use the firewall as its DNS server, so I'm not intentionally using another DNS server. And as mentioned above, I can see plenty of DNS queries from the phone in Unbound Reporting. Furthermore, I had setup Opnsense so all the devices on the network use Unbound by default. So I don't believe it's an issue that the clients simply aren't using it.

One other thing I noticed: if I query a domain, ex: ads.youtube.com without the trailing dot, Windows sometimes ends up querying ads.youtube.com.lan.. If I use the trailing dot, it correctly queries ads.youtube.com.. I don't think that's related, since OPNsense Reporting itself displays normal DNS names with the trailing dot. But just something I noticed that I wansn't sure about. I don't notice this on all the domains, idk.


I'm wondering if there is something else going on with the blocklist generation/loading, because the Blocklist Tester says the domains are blocked, but actual client behavior and the amount of blocked traffic don't seem to match what I would expect at all.

In my initial setup over a year ago and afterwards while I remember it working, Unbound was SIGNIFICANTLY much "noisier", and I saw considerably more blocked queries from the devices on my network. Now I'm seeing basically nothing, even though I have the general blocklists and several HaGeZi/OSID lists enabled.
And a few years before I had Unbound, I had a PiHole and it was just as noisy with blocking. So I know my baseline should be higher.

In the past 40 min I have 20 domains blocked, 3 which were manual inquiries.
That's not even peanuts. So something is still not working properly, but we're moving in the right direction..

#6

German - Deutsch / Log File -> Live View

Last post by feofan69 - Today at 03:33:23 PM

Hallo zusammen,

ich habe aktuell ein Problem mit der Live-View-Funktion zwischen zwei IP-Adressen innerhalb desselben Interfaces: Egal ob Ping, HTTP oder anderer Traffic, es wird in der Live-Ansicht kein Datenverkehr angezeigt, obwohl ich für alle relevanten Regeln das Logging aktiviert habe.

Wo kann mein Denkfehler liegen?

#7

Q-Feeds (Threat intelligence) / Re: [Feature Request] DNSBL in...

Last post by DEC740airp414user - Today at 03:10:45 PM

currently a paid user.   I am not sure I am understanding.

my account says : 121,281
Current Count
As of Sep 12, 2026 3:00 PM

unbound logs:   2026-09-11T23:00:03-04:00Noticeunbound blocklist parsing done in 2.88 seconds (121269 records)

its set to sync every 12 hours so the numbers may be sightly off

so its syncing everything included with your account.  correct?

#8

26.7 Series / Re: How does new firewall rule...

Last post by passeri - Today at 01:05:58 PM

I found this explanation pretty good: Opnsense firewall rules

Are you planning an initial setup or preparing to migrate? Following the relevant dialogs works with only rare exceptions.

#9

26.7 Series / How does new firewall rules wo...

Last post by BigFreddy - Today at 12:30:32 PM

Hi,

The major new feature in version 26.7 is the new firewall rules and I'm still used to the old way how firewall rules were working. Does anyone know if there is or can recommend any type of in-depth write-up or YouTube video explaining the differences and what's new and how it works now compared to the old way? I tried searching for it on YouTube but couldn't really find much.

Thanks

#10

26.1, 26,4 Series / Re: samplicate pegging cpu

Last post by ubu - Today at 11:41:48 AM

A stuck template perhaps, but clearing the settings would disable it in that case.  There's no reason it wouldn't.  The stack trace at hand is also unknown, which could confirm the issue or point elsewhere.

What's in /etc/rc.conf.d/netflow ? Removing the file would also cause it not to start although in practice the reboot rebuilds the file so whatever the config mandates is going to steer the YES/No decision.


Cheers,
Franco

Code Select Expand

root@OPNsense:~ # cat /etc/rc.conf.d/netflow
#
# Automatic generated configuration for netflow.
# Do not edit this file manually.
#
netflow_enable="YES