"Recent posts
#1
Virtual private networks / Re: Hub-Spoke Wireguard VPN wo...
Last post by ala_nathaniel - Today at 08:08:36 PMAn update to this. We are still trying to figure this out. In the mean time, the following has changed.
We moved a location, which resulted in a rebuild of a firewall. When we did the rebuild, most everything worked. While we were still unable to ping from the console (still able to ping from Web GUI) we were able to use DNS and LDAP. This prompted us to believe that it really might be something related to ZeroTier still lingering in the System. However, once we patched and rebooted the firewalls during our maintenance cycle, it stopped working. All the same symptoms.
We are now on 26.4 on all the firewalls. We did migrate the rules to the new format and there was no change.
We added a Outbound NAT rule that looked like this
Interface Source Source Port Destination Destination Port NAT Address Static Port
WG_STS This Firewall * 10.1.0.0/24 * Interface Address No
This did not help as well.
We can ping and traceroute to external IPs just fine (1.1.1.1, 8.8.8.8, 4.2.2.1) and when we have live view open, it does not show that it is blocking the traffic, and we do see it pass, which is why we think it is something routing and WireGuard directly, not something to do with the rules.
There is one difference I did not put in the original post, which is that the HUB firewall has static routing, and the Site firewalls all use WG to push the routes. We did have one site on static routes as well, and saw the same issue.
We are still working on this, but it is kinda a low priority as other functions still work.
We moved a location, which resulted in a rebuild of a firewall. When we did the rebuild, most everything worked. While we were still unable to ping from the console (still able to ping from Web GUI) we were able to use DNS and LDAP. This prompted us to believe that it really might be something related to ZeroTier still lingering in the System. However, once we patched and rebooted the firewalls during our maintenance cycle, it stopped working. All the same symptoms.
We are now on 26.4 on all the firewalls. We did migrate the rules to the new format and there was no change.
We added a Outbound NAT rule that looked like this
Interface Source Source Port Destination Destination Port NAT Address Static Port
WG_STS This Firewall * 10.1.0.0/24 * Interface Address No
This did not help as well.
We can ping and traceroute to external IPs just fine (1.1.1.1, 8.8.8.8, 4.2.2.1) and when we have live view open, it does not show that it is blocking the traffic, and we do see it pass, which is why we think it is something routing and WireGuard directly, not something to do with the rules.
There is one difference I did not put in the original post, which is that the HUB firewall has static routing, and the Site firewalls all use WG to push the routes. We did have one site on static routes as well, and saw the same issue.
We are still working on this, but it is kinda a low priority as other functions still work.
#2
German - Deutsch / Re: [Hardware] Temperaturen
Last post by HBerger - Today at 05:07:57 PMQuoteAlso wenn die CPU Temp 55° ist bei einem aktiv gekühlten Server, würde ich von Stromverschwendung der Lüfter sprechen und die fan curve anpassenJa das sind die CPU Temps von den internen (CPU) Sensoren.
Da das teil aber nicht aktiv gekühlt ist, ist das auch ca. die Temperatur von allem, also auch der SSD.
Und ich hab keine Ahnung ob die Wärme von der CPU selber oder von der SSD (wobei die eher nicht, die hat keine Verbindung zum passiven Kühlkörper, zeigt auch um die 5x° im smart an) oder von den SPannungswandlern kommt.
#3
26.7 Series / ATTENTION: frr plugin is going...
Last post by Monviech (Cedrik) - Today at 05:06:18 PMI cleaned a lot of stuff up in the frr plugin.
I tested it all in my own test environment, but if somebody who also uses BGP/OSPF/OSPFv3 peering and has some basic development knowledge (aka how to build an opnsense plugin from master, deploy it, and report issues) it would be nice to get some feedback before pushing this out.
Please, test it if you can, its a lot of changes but less so feature wise, mostly corrections.
https://github.com/opnsense/plugins/blob/master/net/frr/pkg-descr
Check out the 2.0 changelog and the migration notes (there are a few migrations happening automatically).
Thank you for any help (and if not brace for impact on community at some point regardless :D)
I tested it all in my own test environment, but if somebody who also uses BGP/OSPF/OSPFv3 peering and has some basic development knowledge (aka how to build an opnsense plugin from master, deploy it, and report issues) it would be nice to get some feedback before pushing this out.
Please, test it if you can, its a lot of changes but less so feature wise, mostly corrections.
https://github.com/opnsense/plugins/blob/master/net/frr/pkg-descr
Check out the 2.0 changelog and the migration notes (there are a few migrations happening automatically).
Thank you for any help (and if not brace for impact on community at some point regardless :D)
#4
26.7 Series / Re: Quectel EC25‑E / EG25‑G Mi...
Last post by (MARLOO) - Today at 04:45:10 PMHi,
Thanks for the pointer to the docs.
Yes, both modems are supported on OPNsense 26.7.5 / FreeBSD 15.1.
The FreeBSD u3g driver (used by OPNsense for 3G/4G modems in PPP mode) explicitly lists Quectel EC25 (including EC25-E/EC25-A) and related models (EM05, EG91, EG25-G) as supported devices.
From what I understand, the issue there is a regression in PPP behavior after 24.7, not a lack of hardware support: the EC25 is still listed in the FreeBSD u3g driver, but some users saw dial-up failures or needed extra AT commands/init strings.
Other users with Quectel EC25/EG25-G on OPNsense 24.7+ reported:
PPP dial-up failing after upgrade (worked on 24.1, broken on 24.7/25.x).
Chat script errors in logs:
CHAT: The modem is not responding to "AT" at MomCmd: labeell.
CHAT: line 358: label "MomIdentGeneriicc" not found (typos in internal script).
Reconnection loops:
Link: reconnection attempt 148 in 3 seconds
LCP: Down event, MODEM: chat script failed. [github.com]
PPP interface never gets IP/gateway:
ROUTING: refusing to set interface route on addressless opt1(ppp1). [github.com]
Common workarounds:
Add custom init string in PPP device (e.g. &F&C1&D2E0S0=0${temp}). [github.com]
Manually patch /usr/local/opnsense/scripts/interfaces/mpd.script to fix label typos (lost on each update). [github.com]
Some switched to an external 4G/5G router instead of internal modem. [github.com]
------------------------------------------------------------------------------------------------------------------------------------------------------------------
My question is specifically about the current stack:
OPNsense 26.7.5‑amd64
FreeBSD 15.1‑RELEASE‑p3
On this version, has anyone successfully run:
Quectel EC25‑E Mini PCIe
Quectel EG25‑G Mini PCIe
as a secondary WAN (failover) without major issues? Or have the PPP problems persisted into 26.7?
Thanks for the pointer to the docs.
Yes, both modems are supported on OPNsense 26.7.5 / FreeBSD 15.1.
The FreeBSD u3g driver (used by OPNsense for 3G/4G modems in PPP mode) explicitly lists Quectel EC25 (including EC25-E/EC25-A) and related models (EM05, EG91, EG25-G) as supported devices.
From what I understand, the issue there is a regression in PPP behavior after 24.7, not a lack of hardware support: the EC25 is still listed in the FreeBSD u3g driver, but some users saw dial-up failures or needed extra AT commands/init strings.
Other users with Quectel EC25/EG25-G on OPNsense 24.7+ reported:
PPP dial-up failing after upgrade (worked on 24.1, broken on 24.7/25.x).
Chat script errors in logs:
CHAT: The modem is not responding to "AT" at MomCmd: labeell.
CHAT: line 358: label "MomIdentGeneriicc" not found (typos in internal script).
Reconnection loops:
Link: reconnection attempt 148 in 3 seconds
LCP: Down event, MODEM: chat script failed. [github.com]
PPP interface never gets IP/gateway:
ROUTING: refusing to set interface route on addressless opt1(ppp1). [github.com]
Common workarounds:
Add custom init string in PPP device (e.g. &F&C1&D2E0S0=0${temp}). [github.com]
Manually patch /usr/local/opnsense/scripts/interfaces/mpd.script to fix label typos (lost on each update). [github.com]
Some switched to an external 4G/5G router instead of internal modem. [github.com]
------------------------------------------------------------------------------------------------------------------------------------------------------------------
My question is specifically about the current stack:
OPNsense 26.7.5‑amd64
FreeBSD 15.1‑RELEASE‑p3
On this version, has anyone successfully run:
Quectel EC25‑E Mini PCIe
Quectel EG25‑G Mini PCIe
as a secondary WAN (failover) without major issues? Or have the PPP problems persisted into 26.7?
#5
German - Deutsch / Re: [Hardware] Temperaturen
Last post by JamesFrisch - Today at 04:27:59 PMQuote from: HBerger on Today at 02:50:03 PMIst aber immer noch sehr warm denk ich.
QuoteDas ding idled die ganze Zeit rum, macht nix aufregendes, dann sollts auch ned so warm werden ...
Sprechen wir von 55° CPU Temp? Wenn du von P1 und P2 sprichst?
Also wenn die CPU Temp 55° ist bei einem aktiv gekühlten Server, würde ich von Stromverschwendung der Lüfter sprechen und die fan curve anpassen :)
#6
General Discussion / Re: Network map with connectio...
Last post by Monviech (Cedrik) - Today at 04:14:37 PMYou can build the same kinda topology in dedicated tools for monitoring like CheckMK (also open source).
I did that before for customer networks, but of course its manual work even when using snmp, lldp and the like. No free lunch.
I did that before for customer networks, but of course its manual work even when using snmp, lldp and the like. No free lunch.
#7
26.7 Series / Video Calls, Fire TVs, Fire TV...
Last post by allenlook - Today at 03:49:21 PMUpdated yesterday to 26.7.5 in the morning, and noted video conferencing call issues the rest of the day - not constant but consistently dropping video and making audio "janky" just for me, not other participants.
In the evening I noted that video streams inside the house were just fine, but video streams to the Internet (YouTube, SmartTube) were dropping every few seconds, even if I turned the video quality *way* down.
A speed test to my provider using speedtest.net showed 300Mbps+ over both wifi and wired connections.
Has anyone else noted issues with Internet video over 26.7.5?
In the evening I noted that video streams inside the house were just fine, but video streams to the Internet (YouTube, SmartTube) were dropping every few seconds, even if I turned the video quality *way* down.
A speed test to my provider using speedtest.net showed 300Mbps+ over both wifi and wired connections.
Has anyone else noted issues with Internet video over 26.7.5?
#8
26.7 Series / Re: Quectel EC25‑E / EG25‑G Mi...
Last post by nero355 - Today at 03:28:47 PMHave a look at https://docs.opnsense.org/manual/how-tos/cellular.html#configuring-cellular-modems and see if they are listed there :)
#9
General Discussion / Re: School Chromebook bypasses...
Last post by nero355 - Today at 03:23:57 PMQuote from: Patrick M. Hausen on October 05, 2026, 10:17:14 PMWhat would he do with that second hand laptop?It was meant as an option to be able to monitor his network traffic while using a device for 'non-school things' so to speak...
#10
General Discussion / Re: Network map with connectio...
Last post by nero355 - Today at 03:21:16 PMQuote from: meyergru on October 05, 2026, 10:54:49 PMThe plugin does not actually discover the network topology. It merely collects clients from ARP/Kea; the relationships between clients, switches and APs are then defined manually by the user via drag & drop and stored in topology.json.Too bad... :(
There is no LLDP, SNMP, switch MAC-table or controller data being queried. Therefore, the plugin cannot determine which switch/port a client is actually connected through, nor can it detect when a wireless client roams from one AP to another.
So essentially, it is a graphical network diagram editor with an automatically populated client list, not an automatic topology discovery tool.
I have no secondary OPNsense instance to test it on and reviewing code is not something I am good at (or developing software in general) so thanks for the time and effort you took to do so :)
