"Recent posts
#1
German - Deutsch / Re: [Hardware] Temperaturen
Last post by viragomann - Today at 09:15:48 PMQuote from: HBerger on Today at 10:57:29 AMWieviel RAM hasst du da der opnsense gegeben ?2 GB.
Ich weiß, heute werden 4 empfohlen. Allerdings muss man überlegen, wofür. Und meine alte Kiste hat insgesamt nur 8. Mehr kann die CPU nicht.
Bei menem Eisatz ist meist noch knapp 1 GB frei. Und für den Notfall gibt rs noch Swap.
Quotehasst du die NICs reingereicht(PCI passThrough)Auch das kann die CPU nicht.
Also Linux Bridges und virtIO NICs. Funktioniert wunderbar. Auch mit PPPoE WAN.
QuoteIrgend welche Auswirkungen (Höhere Latenz z.b.)?Ich habe in diesem Fall nicht nachgemessen, aber erfahrungsgemäß ist die Auswirkung vernachlässigbar.
Meine CPU (Mobil-Harfware) ist aber ohnehin nicht auf Top-Lazenz ausgelegt.
QuoteVielleicht sollt ich auch mal versuchen, das ding zu virtualisierenDas war nicht als dringende Empfehlung gemeint. Es musste nur an diser Stelle erwähnt werden.
Ich habe OPNsense (zuvor pfSense) daheim virtualisiert, um Hardeare, Strom und Kabelsalat zu sparen.
Ich betreibe aber auch für meinen Arbeitgeber OPNsense virtualisiert, ebenfalls auf KVM. Hier, weil das gesamte Netzwerk in einer Cloud läuft. Kann von da her auch keine Probleme melden
Ob Linux das Power Management besser macht, kann ich nicht sagen. Meine Hardware daheim ist vom Konzept her ganz anders (Mobil). Deine ist Server-Hardware. Daher vielleicht nicht zu vergleichen. Aber Temperaturen über 60° beim Nichtstun scheinen mir in jedem Fall zu hoch, auch ohne Lüfter.
#2
Zenarmor (Sensei) / Re: Cancelling my subscription...
Last post by abenaou - Today at 07:07:54 PMQuote from: Patrick M. Hausen on September 09, 2026, 08:42:04 AMOut of curiosity: can't you use an off device Elastic installation? E.g I run Elastic as an "app" on TrueNAS for my FreeBSD jail based Nextcloud to use.I did use an elasticsearch container running docker/portainer but I just feel it is an overkill for a home lab or even an SMB, sqlite being transactional nothing would stop mysql from replacing it and having far more benefits, as I said before I don't know if there are architectural limitations or roadblocks for the devs, but from my perspective I think it is far better to have a mysql/mariadb back end for performance and redundancy, homelabbers like me would choose mysql/mariadb for its "simplicity" and bigger players could use elasticsearch for their bigger databases.
I used to run a master/slave mariadb cluster years ago, and it was one of the ways to minimize the load on my production server, I can't see that happening with SQLite that lives in the same nvme as opnsense (I know I can always use a mount), or using elasticsearch for that purpose, it just gives me less possibilities overall.
#3
German - Deutsch / Re: KI oder AI
Last post by bamf - Today at 06:20:11 PMBlocklist für was? Eingehenden Traffic? Ausgehenden Traffic? Was willst du erreichen?
#4
26.1, 26,4 Series / Re: samplicate pegging cpu
Last post by franco - Today at 05:45:03 PMA stuck template perhaps, but clearing the settings would disable it in that case. There's no reason it wouldn't. The stack trace at hand is also unknown, which could confirm the issue or point elsewhere.
What's in /etc/rc.conf.d/netflow ? Removing the file would also cause it not to start although in practice the reboot rebuilds the file so whatever the config mandates is going to steer the YES/No decision.
Cheers,
Franco
What's in /etc/rc.conf.d/netflow ? Removing the file would also cause it not to start although in practice the reboot rebuilds the file so whatever the config mandates is going to steer the YES/No decision.
Cheers,
Franco
#5
Q-Feeds (Threat intelligence) / [Feature Request] DNSBL in Wil...
Last post by Wrigleys - Today at 05:43:32 PMHi all
I would like to ask, if your malware_domain feed is planned to support other formats like Domain Wildcard (Asterisk)?
In OPNsense Unbound, this malware_domain feed isn't parsing in the wildcard format and therefore only exact matches will gets blocked.
Export from Log File:
Thanks for your awesome service.
Take care and all the best,
Wrigleys
I would like to ask, if your malware_domain feed is planned to support other formats like Domain Wildcard (Asterisk)?
In OPNsense Unbound, this malware_domain feed isn't parsing in the wildcard format and therefore only exact matches will gets blocked.
Export from Log File:
Code Select
blocklist: https://api.qfeeds.com/api?feed_type=malware_domains&api_token=xxxxxxx (block: 121164 wildcard: 0)Thanks for your awesome service.
Take care and all the best,
Wrigleys
#6
German - Deutsch / Re: Umstieg auf Kea DHCP
Last post by spooner.arthur - Today at 04:37:51 PMAlso es funktioniert.
Hab einen anderen Switch Port mit einem anderen VLan genommen und siehe da, alles OK.
Hab aber noch eine komischen Meldung im Log:
WARN [kea-dhcp4.dhcp4.0x11acf9469010] DHCP4_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
Verstehe nicht was er mir sagen will.
Hab einen anderen Switch Port mit einem anderen VLan genommen und siehe da, alles OK.
Hab aber noch eine komischen Meldung im Log:
WARN [kea-dhcp4.dhcp4.0x11acf9469010] DHCP4_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
Verstehe nicht was er mir sagen will.
#7
26.7 Series / Unbound Not Actually Blocking ...
Last post by ticker - Today at 04:35:09 PMOPNsense 26.7.3_11 (amd64)
Everything was installed and configured using the GUI.
It has been running for over a year, I don't recall this being an issue previously, but I haven't looked at the machine beyond updating in a few months and I just noticed it this week.
I am having an issue where the Unbound DNS blocklist appears to download and load successfully, but domains are not actually being blocked for LAN clients.
It does seem to be resolving my domains without issue and properly. So I don't believe it is an issue with Unbound itself not being used, however an issue with Unblound actually blocking.
I could be wrong, but I believe it used to work without issue, I haven't messed with Opnsense in months. Just noticed this.
The Blocklist page reports approximately 1,327,249 entries loaded. I have several blocklists configured. I know that's a lot, and could cause false positives, don't really care.
As a test, ibrainer.net is known to be present in that list. I also manually added ibrainer.net under Blocklist Domains, but it continues to resolve normally.
This domain was just a random domain I chose in one of the blocklists to test with.
Testing:
From a Windows LAN client, I queried the firewall directly:
The client is definitely querying Unbound on OPNsense, but the real DNS records are returned.
Unbound Reporting shows the queries as Pass rather than Blocked. For example:
2026-09-11 03:08:58
[REDACTED CLIENT]
A
ibrainer.net.
Pass
Recursion
NOERROR
84ms
3600
2026-09-11 03:08:58
[REDACTED CLIENT]
AAAA
ibrainer.net.
Pass
Recursion
NOERROR
6ms
3600
After subsequent queries, they also appear as:
ibrainer.net.
Pass
Cache
NOERROR
I also tested metrics.icloud.com, which I manually added to Blocklist Domains, and it still resolves normally.
Other troubleshooting performed/settings statuses:
Confirmed Unbound DNS is enabled.
Confirmed all required LAN/VLAN interfaces are selected under Unbound.
Source Net(s) is empty/default.
Destination Address is empty/default.
Return NXDOMAIN is unchecked.
Cache TTL is set to 72000.
Unbound Access Lists are empty.
Restarted Unbound with Flush Cache on Restart enabled.
Flushed the Windows DNS cache with ipconfig /flushdns.
Retested using the firewall address directly (192.168.1.1).
Confirmed the blocklist downloads and reports approximately 1.33 million entries under Reporting > Unbound DNS.
Added ibrainer.net manually to Blocklist Domains as a direct test.
The built-in blocklist tester returns:
{"status":"error"}
I also tried fresh resetting the reporting. Shows 0 under blocked, while resolved is slowly going up.
I also tried manually clicking block on the ibrainer.net domain in the Reporting > Unbound DNS and it does toggle the icon so I can "allow it" after, so it seems to be "blocking it"... however it doens't actually appear to be blocking it.
The main issue appears to be that the blocklists are being downloaded/parsed, but the resulting DNSBL rules are not being applied to client queries. Fresh queries are still reported as Pass / Recursion / NOERROR instead of being blocked. Domains are resolving normally, my DNS is fine. I have my whole network set to use Unbound for DNS resolution. It just seems like absolutely NOTHING is being blocked for some reason.
Everything was installed and configured using the GUI.
It has been running for over a year, I don't recall this being an issue previously, but I haven't looked at the machine beyond updating in a few months and I just noticed it this week.
I am having an issue where the Unbound DNS blocklist appears to download and load successfully, but domains are not actually being blocked for LAN clients.
It does seem to be resolving my domains without issue and properly. So I don't believe it is an issue with Unbound itself not being used, however an issue with Unblound actually blocking.
I could be wrong, but I believe it used to work without issue, I haven't messed with Opnsense in months. Just noticed this.
The Blocklist page reports approximately 1,327,249 entries loaded. I have several blocklists configured. I know that's a lot, and could cause false positives, don't really care.
As a test, ibrainer.net is known to be present in that list. I also manually added ibrainer.net under Blocklist Domains, but it continues to resolve normally.
This domain was just a random domain I chose in one of the blocklists to test with.
Testing:
From a Windows LAN client, I queried the firewall directly:
The client is definitely querying Unbound on OPNsense, but the real DNS records are returned.
Unbound Reporting shows the queries as Pass rather than Blocked. For example:
2026-09-11 03:08:58
[REDACTED CLIENT]
A
ibrainer.net.
Pass
Recursion
NOERROR
84ms
3600
2026-09-11 03:08:58
[REDACTED CLIENT]
AAAA
ibrainer.net.
Pass
Recursion
NOERROR
6ms
3600
After subsequent queries, they also appear as:
ibrainer.net.
Pass
Cache
NOERROR
I also tested metrics.icloud.com, which I manually added to Blocklist Domains, and it still resolves normally.
Other troubleshooting performed/settings statuses:
Confirmed Unbound DNS is enabled.
Confirmed all required LAN/VLAN interfaces are selected under Unbound.
Source Net(s) is empty/default.
Destination Address is empty/default.
Return NXDOMAIN is unchecked.
Cache TTL is set to 72000.
Unbound Access Lists are empty.
Restarted Unbound with Flush Cache on Restart enabled.
Flushed the Windows DNS cache with ipconfig /flushdns.
Retested using the firewall address directly (192.168.1.1).
Confirmed the blocklist downloads and reports approximately 1.33 million entries under Reporting > Unbound DNS.
Added ibrainer.net manually to Blocklist Domains as a direct test.
The built-in blocklist tester returns:
{"status":"error"}
I also tried fresh resetting the reporting. Shows 0 under blocked, while resolved is slowly going up.
I also tried manually clicking block on the ibrainer.net domain in the Reporting > Unbound DNS and it does toggle the icon so I can "allow it" after, so it seems to be "blocking it"... however it doens't actually appear to be blocking it.
The main issue appears to be that the blocklists are being downloaded/parsed, but the resulting DNSBL rules are not being applied to client queries. Fresh queries are still reported as Pass / Recursion / NOERROR instead of being blocked. Domains are resolving normally, my DNS is fine. I have my whole network set to use Unbound for DNS resolution. It just seems like absolutely NOTHING is being blocked for some reason.
#8
German - Deutsch / Re: [Hardware] Temperaturen
Last post by JamesFrisch - Today at 04:26:36 PMBezüglich TBW: IMHO auch totaler overkill für OPNsense, ausser du logst extrem viel. Kannst aber auch RAM dafür verwenden.
Bei mir werkeln schon seit Jahren irgendwelche 256GB Intel 550 Resteposten SSDs in mehrere OPNsense boxen. Gar kein Problem.
Kommt aber halt auf deinen Anwendungsfall an.
Bei mir werkeln schon seit Jahren irgendwelche 256GB Intel 550 Resteposten SSDs in mehrere OPNsense boxen. Gar kein Problem.
Kommt aber halt auf deinen Anwendungsfall an.
#9
German - Deutsch / Re: [Hardware] Temperaturen
Last post by JamesFrisch - Today at 04:24:06 PMQuote from: HBerger on September 10, 2026, 10:57:30 AMMacht es Sinn, zu versuchen das Ding Kühler zu bekommen?IMHO nein. Deine LLM blabbert Quatsch. Wie vieles im Internet. SSDs sind wie fast alle PC Bauteile locker auch mit 80° völlig im grünen Bereich.
Einzig bei HDDs sehe ich (oder besser gesagt die Hersteller) die Grenze eher bei 60°. Ist aber auch logisch, schliesslich drehen da Platten.
Was soll es deine SSD jucken, ob sie mit 40° oder 80° läuft? Wo soll da ein Unterschied sein?
#10
Hardware and Performance / Re: Mono Gateway (an NXP-based...
Last post by Greg_E - Today at 03:28:22 PMRegarding the price, I recently paid a bit over $900usd for Protectli i5 with 16GB of ram, some smallish SSD, and 6 ports of i226. I would have purchased an OPNsense hardware, but they are really hard to get in the USA, and the recent prices with tariffs made them impossible. So the Mono price at $600 might not be that far out of line, but for my lab, it was more than I was willing to go right now. I have many HP T740 and cards, and an HP T620+ with 4 port card that still seems to mostly work. Lab is swapped to a T740 with 16GB, 120GB ssd, and quad port i710 for 1/10g connections. Total for this was around $300 when I bought all the parts, but most of that was before the rampocalypse.
