"Recent posts
#1
26.7 Series / Re: Upgrade 26.1 to 26.7 - bnx...
Last post by lando4k2 - Today at 01:04:08 PMok, bugreport is created: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298337
#2
26.7 Series / Re: 26.7.3 boot loop on Hyper-...
Last post by iorx - Today at 12:54:53 PMLLM generated:
Compared loader.conf between the two systems. Key differences:
RSS is the most notable difference. The test VM has none of those set, the production system has RSS enabled with 8 queues and net.isr.maxthreads=-1, which increases the number of active threads at boot and likely widens the race window for the hv_hid_probe page fault.
Next test: disable RSS (net.inet.rss.enabled=0, remove net.inet.rss.bits and net.isr.maxthreads) on the production system and retry with 8 vCPU.
Can't test right now, family is online 😁
But have rebooted the newly installed 27.7.3_11 a couple of times and it also boot looped now. Interesting.
Behavior, it loops a couple of times and then manage to do a complete boot.
Compared loader.conf between the two systems. Key differences:
Code Select
Boot loop system Test VM (OK)
net.inet.rss.enabled 1 not set (=0)
net.inet.rss.bits 3 not set
net.isr.dispatch deferred not set
net.isr.maxthreads -1 not set
RSS is the most notable difference. The test VM has none of those set, the production system has RSS enabled with 8 queues and net.isr.maxthreads=-1, which increases the number of active threads at boot and likely widens the race window for the hv_hid_probe page fault.
Next test: disable RSS (net.inet.rss.enabled=0, remove net.inet.rss.bits and net.isr.maxthreads) on the production system and retry with 8 vCPU.
Can't test right now, family is online 😁
But have rebooted the newly installed 27.7.3_11 a couple of times and it also boot looped now. Interesting.
Behavior, it loops a couple of times and then manage to do a complete boot.
#3
26.7 Series / Re: 26.7.3 boot loop on Hyper-...
Last post by iorx - Today at 11:38:13 AMHi again!
Updated again, to _11, this update didn't require a reboot but did one anyway.
Ended up in a bootloop. Tried kern.panic_reboot_wait_time=-1 too, but that didn't work, no stop to see what actually happen.
So, a MacGyver solution was to record the console 🙂
Got this (extracted from video frames):
To add:
Updated again, to _11, this update didn't require a reboot but did one anyway.
Ended up in a bootloop. Tried kern.panic_reboot_wait_time=-1 too, but that didn't work, no stop to see what actually happen.
So, a MacGyver solution was to record the console 🙂
Got this (extracted from video frames):
Code Select
panic: page fault
cpuid = 3
hv_hid_probe() at hv_hid_probe/frame 0xfffffe0070bd8a90
device_probe() at device_probe+0x71
bus_generic_driver_added() at bus_generic_driver_added+0x67
devclass_driver_added() at devclass_driver_added+0x29
device_do_deferred_actions() at device_do_deferred_actions+0x3b
devctl2_ioctl() at devctl2_ioctl+0x211
devfs_ioctl() at devfs_ioctl+0xcb
vn_ioctl() at vn_ioctl+0xc8
kern_ioctl() at kern_ioctl+0x286
sys_ioctl() at sys_ioctl+0x101
amd64_syscall() at amd64_syscall+0x126
fast_syscall_common() at fast_syscall_common+0xf8To add:
- Looks like it always manage to boot OK when vCPU=1
- vCPU=8 sometimes manage to boot but it can take some time before it succeeds...
#4
26.7 Series / Re: Problem DEC750 freeze with...
Last post by droumanet - Today at 09:28:18 AMThanks Patrick !
You're right, it's a
Transcend TS256GMTE712A (série MTE712A)
I've made some write reduction (outbound DNS, tested rules, etc.) and since that, no more error.
Today
SMART/Health Information Log
============================
Critical Warning State: 0x00
Available spare: 0
Temperature: 0
Device reliability: 0
Read only: 0
Volatile memory backup: 0
Temperature: 325 K, 51.85 C, 125.33 F
Available spare: 100
Available spare threshold: 10
Percentage used: 13
Data units (512,000 byte) read: 858477
Data units written: 24738666
Host read commands: 4822576
Host write commands: 468806337
Controller busy time (minutes): 4513573
Power cycles: 30
Power on hours: 4823
Unsafe shutdowns: 24
Media errors: 0
No. error info log entries: 0
Warning Temp Composite Time: 0
Error Temp Composite Time: 0
Temperature Sensor 1: 340 K, 66.85 C, 152.33 F
Temperature Sensor 2: 315 K, 41.85 C, 107.33 F
Temperature Sensor 3: 325 K, 51.85 C, 125.33 F
Temperature 1 Transition Count: 93
Temperature 2 Transition Count: 0
Total Time For Temperature 1: 4478
Total Time For Temperature 2: 0
You're right, it's a
Transcend TS256GMTE712A (série MTE712A)
I've made some write reduction (outbound DNS, tested rules, etc.) and since that, no more error.
Today
SMART/Health Information Log
============================
Critical Warning State: 0x00
Available spare: 0
Temperature: 0
Device reliability: 0
Read only: 0
Volatile memory backup: 0
Temperature: 325 K, 51.85 C, 125.33 F
Available spare: 100
Available spare threshold: 10
Percentage used: 13
Data units (512,000 byte) read: 858477
Data units written: 24738666
Host read commands: 4822576
Host write commands: 468806337
Controller busy time (minutes): 4513573
Power cycles: 30
Power on hours: 4823
Unsafe shutdowns: 24
Media errors: 0
No. error info log entries: 0
Warning Temp Composite Time: 0
Error Temp Composite Time: 0
Temperature Sensor 1: 340 K, 66.85 C, 152.33 F
Temperature Sensor 2: 315 K, 41.85 C, 107.33 F
Temperature Sensor 3: 325 K, 51.85 C, 125.33 F
Temperature 1 Transition Count: 93
Temperature 2 Transition Count: 0
Total Time For Temperature 1: 4478
Total Time For Temperature 2: 0
#5
26.7 Series / Re: Confused by 26.7 upgrade
Last post by franco - Today at 09:27:40 AM> IIUC, someone created this thread when he found that he can not enable or disable firewall rules after an upgrade anymore, and was advised to install a plug-in to fix that.
Which is correct, but that's in the release notes. You don't need the plugin to use and/or migrate the rules, but you need the plugin to administrate them.
> but I made the experience that the firewall rules didn't work after the migration and had all to be redone
Which is entirely different. It may be because of FreeBSD 15.1 or something else. It looks like we don't know?
> Don't continue to pretend that it is an easy and harmless migration that wouldn't even require a big fat warning. It is not.
I never pretended it was easy and harmless for you. This is the core of the issue. It is your experience. Not everyone else's.
> I wonder why that is.
Because you don't know what the problem is, but feel entitled to raise your concern in advance? If I know your exact problem I can probably help or point to the right bits of documentation.
> However, if you use the Community Edition, I believe you also bear some responsibility for regularly reading forum posts; otherwise, you might find yourself facing a problem eight months down the line that has already been thoroughly discussed and addressed. This applies equally to experienced forum members and OPNsense newcomers.
Sometimes perhaps, but I'm surprised at the trivial questions that are being raised seeing the code that was touched and people not realising how many technical issues they would never notice because a) they don't have the setup or b) changes are handled in a way that few regressions arise to begin with.
> A great example is the Intel microcode plugin that if I had read the forum properly would have known I should have removed it before upgrading to 26.7.
It's a very complex issue involving the microcode updates and the operating system that has been going on for years now -- and both are not under our immediate influence. And here, also, it was clearly in the release notes:
https://github.com/opnsense/changelog/blob/b0be678d6235cb8da05446df7ea233c38cdcd0a7/community/26.7/26.7#L101
Cheers,
Franco
Which is correct, but that's in the release notes. You don't need the plugin to use and/or migrate the rules, but you need the plugin to administrate them.
> but I made the experience that the firewall rules didn't work after the migration and had all to be redone
Which is entirely different. It may be because of FreeBSD 15.1 or something else. It looks like we don't know?
> Don't continue to pretend that it is an easy and harmless migration that wouldn't even require a big fat warning. It is not.
I never pretended it was easy and harmless for you. This is the core of the issue. It is your experience. Not everyone else's.
> I wonder why that is.
Because you don't know what the problem is, but feel entitled to raise your concern in advance? If I know your exact problem I can probably help or point to the right bits of documentation.
> However, if you use the Community Edition, I believe you also bear some responsibility for regularly reading forum posts; otherwise, you might find yourself facing a problem eight months down the line that has already been thoroughly discussed and addressed. This applies equally to experienced forum members and OPNsense newcomers.
Sometimes perhaps, but I'm surprised at the trivial questions that are being raised seeing the code that was touched and people not realising how many technical issues they would never notice because a) they don't have the setup or b) changes are handled in a way that few regressions arise to begin with.
> A great example is the Intel microcode plugin that if I had read the forum properly would have known I should have removed it before upgrading to 26.7.
It's a very complex issue involving the microcode updates and the operating system that has been going on for years now -- and both are not under our immediate influence. And here, also, it was clearly in the release notes:
https://github.com/opnsense/changelog/blob/b0be678d6235cb8da05446df7ea233c38cdcd0a7/community/26.7/26.7#L101
Cheers,
Franco
#6
26.7 Series / Re: Confused by 26.7 upgrade
Last post by Stormscape - Today at 08:57:53 AMA great example is the Intel microcode plugin that if I had read the forum properly would have known I should have removed it before upgrading to 26.7.
I didn't, so I had a broken install since it timed out trying to upgrade and I had to use the bootstrap script to fix it.
I didn't, so I had a broken install since it timed out trying to upgrade and I had to use the bootstrap script to fix it.
#7
26.7 Series / Re: Unbound stopps suddenly
Last post by Patrick M. Hausen - Today at 08:50:28 AMAGH (and Pihole) already implement blocking in that or a similar way.
In contrast Unbound AFAIK takes a straightforward ("naive") approach treating block lists like overrides internally. Obviously that does not scale well with millions of entries.
I prefer AGH over Pihole if only because I can easily run it on OPNsense without the need for a Linux host.
In contrast Unbound AFAIK takes a straightforward ("naive") approach treating block lists like overrides internally. Obviously that does not scale well with millions of entries.
I prefer AGH over Pihole if only because I can easily run it on OPNsense without the need for a Linux host.
#8
26.7 Series / Re: Confused by 26.7 upgrade
Last post by RES217AIII - Today at 08:46:38 AMRegarding the specific topic at hand: The transition to the new rule framework has been a subject of discussion in this forum since January 2026. The migration assistant is a no-brainer; thanks to it—and the available backup and restore options—the transition poses absolutely no risk.
In general, users of the OPNsense Community Edition should be aware that they are, to some extent, testers for new features that eventually make their way into the paid version of OPNsense.
In return, however, they receive a fantastic firewall for free—one that need not shy away from comparison with expensive commercial competitors.
This forum is active and monitored by highly experienced users who are always ready to help—often even when a topic has been discussed repeatedly and the answer could have been found via a simple search.
It is up to the individual whether to adopt changes early during version updates or to wait for reliable, rapid bug fixes.
However, if you use the Community Edition, I believe you also bear some responsibility for regularly reading forum posts; otherwise, you might find yourself facing a problem eight months down the line that has already been thoroughly discussed and addressed. This applies equally to experienced forum members and OPNsense newcomers.
In general, users of the OPNsense Community Edition should be aware that they are, to some extent, testers for new features that eventually make their way into the paid version of OPNsense.
In return, however, they receive a fantastic firewall for free—one that need not shy away from comparison with expensive commercial competitors.
This forum is active and monitored by highly experienced users who are always ready to help—often even when a topic has been discussed repeatedly and the answer could have been found via a simple search.
It is up to the individual whether to adopt changes early during version updates or to wait for reliable, rapid bug fixes.
However, if you use the Community Edition, I believe you also bear some responsibility for regularly reading forum posts; otherwise, you might find yourself facing a problem eight months down the line that has already been thoroughly discussed and addressed. This applies equally to experienced forum members and OPNsense newcomers.
#9
26.7 Series / Re: Firewall can't access serv...
Last post by Patrick M. Hausen - Today at 08:43:42 AMHaving HAproxy listen to 0.0.0.0 should work.
#10
Zenarmor (Sensei) / Re: Cancelling my subscription...
Last post by Patrick M. Hausen - Today at 08:42:04 AMOut of curiosity: can't you use an off device Elastic installation? E.g I run Elastic as an "app" on TrueNAS for my FreeBSD jail based Nextcloud to use.
