"Recent posts
#1
26.7 Series / Re: Unbound stopps suddenly
Last post by jonny5 - Today at 08:16:56 PMI've also see Unbound suddenly stop working, I also wrote a cronned script that checks if it is active and restarts it if necessary
#2
General Discussion / NRPE Service Doesn't Start
Last post by baqwas - Today at 08:00:05 PMHello!
Newbie here:
Trying to start NRPE from the Dashboard on OPNsense 26.7.2_2-amd64 but unable to sustain the service. The red triangle changes to a red check mark momentarily and then reverts to the start state. I didn't have this issue several releases ago.
What is my mistake, please? Thanks.
Regards.
Newbie here:
Trying to start NRPE from the Dashboard on OPNsense 26.7.2_2-amd64 but unable to sustain the service. The red triangle changes to a red check mark momentarily and then reverts to the start state. I didn't have this issue several releases ago.
What is my mistake, please? Thanks.
Regards.
#3
25.7, 25.10 Legacy Series / Re: os-net-snmp on 25.10.2_12
Last post by franco - Today at 07:17:32 PMSure, it's possible as long as the version is the latest stable from that series.
Cheers,
Franco
Cheers,
Franco
#4
26.7 Series / Re: can't find where to delete...
Last post by Patrick M. Hausen - Today at 06:21:06 PMRemove the dynamic range.
#5
26.7 Series / can't find where to delete a d...
Last post by RobLatour - Today at 06:16:18 PMI'm having trouble assigning a new device to an old ip address (I don't think it is the dnsmasq lease expiry issue - rather something else).
What I'm trying to do is to get a new device to come in and be assigned the address 192.168.7.24 which had previousily been assigned.
I waited until it had expired in the lease table, and then plugged in the new device - however it would not get the address I had wanted to spite me having already it defined in the dnsmasq host table (by its MAC) to be assigned to 192.168.7.24
I can get it assinged to 192.168.7.25 - but with that I get odd behaviours.
For example, the device is plugged directly into the OPNSense box's opt2 interface. There is only one device plugged into that interface - but regardless with that one device plugged in I can ping both 192.168.7.24 and 192.168.7.25.
As I'm using this device in conjunction with OPNSense's Time Service; I've tried stopping that server and turning it on at various points in my experementation to get this to work - just incase the time service has a hold on the IP address some how??
Also, oddly, while 192.168.7.24 no longer shows up in the lease table or the host table, I backed up my configuration and looked inside the back up file to find this (I just have no idea where to delete it from):
```
<opt2>
<gateway>192.168.7.1</gateway>
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
<numberoptions>
<item/>
</numberoptions>
<range>
<from>192.168.7.24</from>
<to>192.168.7.24</to>
</range>
<winsserver/>
<dnsserver>192.168.7.1</dnsserver>
<ntpserver/>
<staticmap>
<mac>24:0a:c4:26:9e:43</mac>
<ipaddr>192.168.7.24</ipaddr>
<hostname>MasterClock</hostname>
<descr>MasterClock</descr>
<arp_table_static_entry>1</arp_table_static_entry>
<winsserver/>
<dnsserver/>
<ntpserver/>
</staticmap>
</opt2>
```
edit: I thought maybe if I could delete / clear the above I could get it to work - but can't seem to find how to do that.
edit: I should note I am running OPNsense 26.7.2_2-amd64 ; FreeBSD 15.1-RELEASE-p2 ; OpenSSL 3.5.7
What I'm trying to do is to get a new device to come in and be assigned the address 192.168.7.24 which had previousily been assigned.
I waited until it had expired in the lease table, and then plugged in the new device - however it would not get the address I had wanted to spite me having already it defined in the dnsmasq host table (by its MAC) to be assigned to 192.168.7.24
I can get it assinged to 192.168.7.25 - but with that I get odd behaviours.
For example, the device is plugged directly into the OPNSense box's opt2 interface. There is only one device plugged into that interface - but regardless with that one device plugged in I can ping both 192.168.7.24 and 192.168.7.25.
As I'm using this device in conjunction with OPNSense's Time Service; I've tried stopping that server and turning it on at various points in my experementation to get this to work - just incase the time service has a hold on the IP address some how??
Also, oddly, while 192.168.7.24 no longer shows up in the lease table or the host table, I backed up my configuration and looked inside the back up file to find this (I just have no idea where to delete it from):
```
<opt2>
<gateway>192.168.7.1</gateway>
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
<numberoptions>
<item/>
</numberoptions>
<range>
<from>192.168.7.24</from>
<to>192.168.7.24</to>
</range>
<winsserver/>
<dnsserver>192.168.7.1</dnsserver>
<ntpserver/>
<staticmap>
<mac>24:0a:c4:26:9e:43</mac>
<ipaddr>192.168.7.24</ipaddr>
<hostname>MasterClock</hostname>
<descr>MasterClock</descr>
<arp_table_static_entry>1</arp_table_static_entry>
<winsserver/>
<dnsserver/>
<ntpserver/>
</staticmap>
</opt2>
```
edit: I thought maybe if I could delete / clear the above I could get it to work - but can't seem to find how to do that.
edit: I should note I am running OPNsense 26.7.2_2-amd64 ; FreeBSD 15.1-RELEASE-p2 ; OpenSSL 3.5.7
#6
25.7, 25.10 Legacy Series / Re: os-net-snmp on 25.10.2_12
Last post by Patrick M. Hausen - Today at 05:51:37 PMThe plugin is named os-net-snmp. OTOH I am not entirely sure it is possible to install any plugin on an outdated version at all.
#7
General Discussion / Re: The joys of Google AI
Last post by Greg_E - Today at 05:38:00 PMQuote from: keeka on August 20, 2026, 06:50:15 PMQuote from: marjohn56 on August 20, 2026, 03:55:16 PMWhat it also is very clever at, is making suggestions at how I can add and improve things. It wasn't my idea to add all of the monitoring
I only have experience of the free online LLMs and very recently running local models with LM studio. So far, I have only used it to generate (hesitate to use the word create!) standalone or loosely coupled shell or python scripts.
I'm getting started with small models running on severely underpowered computers, but it's working, it's local, and I can dig away at things for as many hours as I care without the thought of tokens running out. The light/basic tasks I'm asking it to do are working and results seem to be correct. Right now I'm still mostly asking questions that I already know an answer for, checking its work to make sure I can generally trust it. I'm using LocalAI in Vulkan mode which seems to be the highest performance I can get out of the little machine I'm using.
#8
25.7, 25.10 Legacy Series / os-net-snmp on 25.10.2_12
Last post by optize - Today at 05:27:29 PMI'm trying to install snmpd on version 25.10.2_12, but it doesn't show up under Plugins, even after clicking Update.
I've seen a few forum threads mention that bsnmpd can cause conflicts and needs to be disabled first, but I don't see bsnmpd listed anywhere either.
Is this because I'm running an EOL version, or am I missing something?
I've seen a few forum threads mention that bsnmpd can cause conflicts and needs to be disabled first, but I don't see bsnmpd listed anywhere either.
Is this because I'm running an EOL version, or am I missing something?
#9
26.7 Series / UDP Broadcast Relay – Blocking...
Last post by 8b4df00d - Today at 04:56:58 PMHi everyone,
My homelab is segmented into several VLANs. Certain devices use mDNS to advertise their services across subnets (e.g., AirPlay on Apple TVs). To make these services discoverable, I am using the UDP Broadcast Relay plugin (Relay Port: 5353, Broadcast Address: 224.0.0.251, Source Address: 1.1.1.1). I have also created the necessary firewall rules on each interface allowing traffic from the local subnet to 224.0.0.251 on UDP/5353.
This setup works flawlessly, and all mDNS services are forwarded as expected.
On the WAN side of my OPNsense, I have a standard FRITZ!Box network containing shared devices (such as an AirPrint-capable printer).
Technically, I could just add the WAN interface to the UDP Broadcast Relay configuration, add the corresponding firewall rule, and the printer would become available.
However, I have security concerns: adding WAN to the relay would mean that all mDNS broadcasts from my internal VLANs would also be forwarded/exposed to the WAN network. Even though this is just a homelab, I would like to prevent internal broadcasts from leaking into the WAN (since this interface is shared with others).
What I have tried so far:
My Question:
Is there a way to selectively listen to mDNS on internal interfaces and relay them to specific VLANs, while blocking the relay from broadcasting those gathered mDNS packets out onto the WAN interface?
Thanks in advance for any insights!
My homelab is segmented into several VLANs. Certain devices use mDNS to advertise their services across subnets (e.g., AirPlay on Apple TVs). To make these services discoverable, I am using the UDP Broadcast Relay plugin (Relay Port: 5353, Broadcast Address: 224.0.0.251, Source Address: 1.1.1.1). I have also created the necessary firewall rules on each interface allowing traffic from the local subnet to 224.0.0.251 on UDP/5353.
This setup works flawlessly, and all mDNS services are forwarded as expected.
On the WAN side of my OPNsense, I have a standard FRITZ!Box network containing shared devices (such as an AirPrint-capable printer).
Technically, I could just add the WAN interface to the UDP Broadcast Relay configuration, add the corresponding firewall rule, and the printer would become available.
However, I have security concerns: adding WAN to the relay would mean that all mDNS broadcasts from my internal VLANs would also be forwarded/exposed to the WAN network. Even though this is just a homelab, I would like to prevent internal broadcasts from leaking into the WAN (since this interface is shared with others).
What I have tried so far:
- I added a floating/outbound rule on the WAN interface to block traffic from any to 224.0.0.251 on UDP/5353. This did not work; the broadcasts are still sent out on WAN.
- Blocking incoming traffic to 224.0.0.251:5353 on the internal interfaces does stop the broadcast on WAN, but it also breaks mDNS functionality entirely because OPNsense no longer receives the initial mDNS requests.
My Question:
Is there a way to selectively listen to mDNS on internal interfaces and relay them to specific VLANs, while blocking the relay from broadcasting those gathered mDNS packets out onto the WAN interface?
Thanks in advance for any insights!
#10
High availability / Re: [Plugin] os-carp-vip-dhc...
Last post by toreamun - Today at 04:40:24 PMA few things have moved since the first post:
Docs and installer: https://github.com/toreamun/opnsense-plugins
- Single-IP is now field-validated. The whole single-IP topology has run on a live one-IP DHCP WAN, including a real CARP failover (the promoted node routed straight out the VIP). Still a single deployment, so more field reports across different ISP/CPE combinations are very welcome.
- Backup egress is now built in. On a single-IP setup the backup node reaches the internet through the master automatically (a leak-safe route set, withdrawn again on promotion), instead of a manual or gateway-group workaround.
- Default-route ownership by CARP role. The keeper can own the WAN default route as a function of CARP role and lease (off / observe / enforce), so a failover moves the default with the role and a backup never black-holes a route it cannot use.
Docs and installer: https://github.com/toreamun/opnsense-plugins
