Recent posts

#1

General Discussion / Re: Can interfaces switch on r...

Last post by nero355 - Today at 11:19:30 PM

That is a bit of a weird question - we are hosted on ovhcloud, and after the latest update to 26.1.7_1 the interfaces vtnet0 (LAN) and vtnet1 (WAN) have switched places. So to fix, I had to reassign the interfaces, vtnet0 is now WAN and vtnet1 is now LAN, and everything works again.

Your VM heard that I think it's more logical to have it the way it is now and decided to switch the interfaces! LOL! ^_^

#2

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by OPNenthu - Today at 11:18:34 PM

Update:

I had installed the 'igc_aspm' kernel on a system with all i226-V NICs having NVM firmware 2.13 (an old version).  The patch appears safe on this older firmware and hasn't caused any problems that I've seen so far.  The earlier advice to start from at least a 2.25 baseline is probably sound, but at least there's no observed impact here.

I was not having link flaps or speed degradation in any case.  I was hoping to clear up the frequent dpinger drops that I see which cause a lot of unecessary failovers for gatways groups (such as VPNs), but unfortunately the patch didn't help that.  I'm guessing my issue is not localized and could just be the ISP infrastructure or upstream routers.

Might work up the courage to upgrade the NVM but I really don't have any of the typical problem indications that are worth the risk AFAICT.

WAN link data for reference...

Code Select Expand

root@firewall:~ # netstat -I igc1
Name    Mtu Network                 Address                                   Ipkts Ierrs Idrop     Opkts Oerrs  Coll
igc1   1500 <Link#2>                xx:xx:xx:xx:xx:xx                     100279348     0     0  38220783     0     0
igc1      - fe80::%igc1/64          fe80::xx:xxxx:xxxx:xxxx%igc1               2242     -     -      2728     -     -
igc1      - 69.xxx.xxx.xxx/22       xxx.xxx.xx.comcast.net                 42381670     -     -  13944744     -     -
igc1      - 10.0.0.0/30             10.0.0.2                                      0     -     -         0     -     -
igc1      - xxxx:xx:xxxx:1b77::/64  xxxx:xx:xxxx:1b77:xxxx:xxxx:xxxx:xxxx    331055     -     -    394721     -     -


Code Select Expand

root@firewall:~ # sysctl dev.igc.1
dev.igc.1.interrupts.rx_desc_min_thresh: 0
dev.igc.1.interrupts.asserts: 107822263
dev.igc.1.mac_stats.tso_txd: 0
dev.igc.1.mac_stats.tx_frames_1024_1522: 599302
dev.igc.1.mac_stats.tx_frames_512_1023: 460622
dev.igc.1.mac_stats.tx_frames_256_511: 210904
dev.igc.1.mac_stats.tx_frames_128_255: 13631408
dev.igc.1.mac_stats.tx_frames_65_127: 23107378
dev.igc.1.mac_stats.tx_frames_64: 213312
dev.igc.1.mac_stats.mcast_pkts_txd: 46
dev.igc.1.mac_stats.bcast_pkts_txd: 181
dev.igc.1.mac_stats.good_pkts_txd: 38222926
dev.igc.1.mac_stats.total_pkts_txd: 38222926
dev.igc.1.mac_stats.good_octets_txd: 4995909586
dev.igc.1.mac_stats.good_octets_recvd: 138811724686
dev.igc.1.mac_stats.rx_frames_1024_1522: 96022714
dev.igc.1.mac_stats.rx_frames_512_1023: 472886
dev.igc.1.mac_stats.rx_frames_256_511: 483889
dev.igc.1.mac_stats.rx_frames_128_255: 1734860
dev.igc.1.mac_stats.rx_frames_65_127: 1327632
dev.igc.1.mac_stats.rx_frames_64: 239883
dev.igc.1.mac_stats.mcast_pkts_recvd: 98216
dev.igc.1.mac_stats.bcast_pkts_recvd: 137
dev.igc.1.mac_stats.good_pkts_recvd: 100281864
dev.igc.1.mac_stats.total_pkts_recvd: 100283378
dev.igc.1.mac_stats.mgmt_pkts_txd: 0
dev.igc.1.mac_stats.mgmt_pkts_drop: 0
dev.igc.1.mac_stats.mgmt_pkts_recvd: 0
dev.igc.1.mac_stats.unsupported_fc_recvd: 0
dev.igc.1.mac_stats.xoff_txd: 0
dev.igc.1.mac_stats.xoff_recvd: 0
dev.igc.1.mac_stats.xon_txd: 0
dev.igc.1.mac_stats.xon_recvd: 0
dev.igc.1.mac_stats.alignment_errs: 0
dev.igc.1.mac_stats.crc_errs: 0
dev.igc.1.mac_stats.recv_errs: 0
dev.igc.1.mac_stats.recv_jabber: 0
dev.igc.1.mac_stats.recv_oversize: 0
dev.igc.1.mac_stats.recv_fragmented: 0
dev.igc.1.mac_stats.recv_undersize: 0
dev.igc.1.mac_stats.recv_no_buff: 0
dev.igc.1.mac_stats.recv_length_errors: 0
dev.igc.1.mac_stats.missed_packets: 0
dev.igc.1.mac_stats.defer_count: 0
dev.igc.1.mac_stats.sequence_errors: 0
dev.igc.1.mac_stats.symbol_errors: 0
dev.igc.1.mac_stats.collision_count: 0
dev.igc.1.mac_stats.late_coll: 0
dev.igc.1.mac_stats.multiple_coll: 0
dev.igc.1.mac_stats.single_coll: 0
dev.igc.1.mac_stats.excess_coll: 0
dev.igc.1.queue_rx_3.rx_irq: 0
dev.igc.1.queue_rx_3.rxd_tail: 733
dev.igc.1.queue_rx_3.rxd_head: 734
dev.igc.1.queue_rx_3.interrupt_rate: 20832
dev.igc.1.queue_rx_2.rx_irq: 0
dev.igc.1.queue_rx_2.rxd_tail: 621
dev.igc.1.queue_rx_2.rxd_head: 622
dev.igc.1.queue_rx_2.interrupt_rate: 20832
dev.igc.1.queue_rx_1.rx_irq: 0
dev.igc.1.queue_rx_1.rxd_tail: 145
dev.igc.1.queue_rx_1.rxd_head: 146
dev.igc.1.queue_rx_1.interrupt_rate: 20832
dev.igc.1.queue_rx_0.rx_irq: 0
dev.igc.1.queue_rx_0.rxd_tail: 808
dev.igc.1.queue_rx_0.rxd_head: 809
dev.igc.1.queue_rx_0.interrupt_rate: 20832
dev.igc.1.queue_tx_3.tx_irq: 0
dev.igc.1.queue_tx_3.txd_tail: 329
dev.igc.1.queue_tx_3.txd_head: 329
dev.igc.1.queue_tx_3.interrupt_rate: 20832
dev.igc.1.queue_tx_2.tx_irq: 0
dev.igc.1.queue_tx_2.txd_tail: 471
dev.igc.1.queue_tx_2.txd_head: 471
dev.igc.1.queue_tx_2.interrupt_rate: 20832
dev.igc.1.queue_tx_1.tx_irq: 0
dev.igc.1.queue_tx_1.txd_tail: 980
dev.igc.1.queue_tx_1.txd_head: 980
dev.igc.1.queue_tx_1.interrupt_rate: 20832
dev.igc.1.queue_tx_0.tx_irq: 0
dev.igc.1.queue_tx_0.txd_tail: 240
dev.igc.1.queue_tx_0.txd_head: 240
dev.igc.1.queue_tx_0.interrupt_rate: 20832
dev.igc.1.fc_low_water: 32752
dev.igc.1.fc_high_water: 32768
dev.igc.1.rx_control: 71335938
dev.igc.1.device_control: 404489793
dev.igc.1.watchdog_timeouts: 0
dev.igc.1.rx_overruns: 0
dev.igc.1.link_irq: 18
dev.igc.1.dropped: 0
dev.igc.1.eee_control: 1
dev.igc.1.tso_tcp_flags_mask_last_segment: 3967
dev.igc.1.tso_tcp_flags_mask_middle_segment: 3958
dev.igc.1.tso_tcp_flags_mask_first_segment: 4086
dev.igc.1.dmac: 0
dev.igc.1.rs_dump: 0
dev.igc.1.reg_dump: General Registers
CTRL 181c0641
STATUS 00780683
CTRL_EXIT 100000c0

Interrupt Registers
ICR 00000000

RX Registers
RCTL 04408002
RDLEN 00004000
RDH 00000329
RDT 00000328
RXDCTL 02040808
RDBAL 76e4c000
RDBAH 00000000

TX Registers
TCTL a503f0fa
TDBAL 76dbc000
TDBAH 00000000
TDLEN 00004000
TDH 000000f0
TDT 000000f0
TXDCTL 0201011f
TDFH 00000000
TDFT 00000000
TDFHS 00000000
TDFPC 00000000


dev.igc.1.fc: 3
dev.igc.1.debug: -1
dev.igc.1.fw_version: EEPROM V2.13-0 eTrack 0x80000286
dev.igc.1.enable_aim: 1
dev.igc.1.nvm: -1
dev.igc.1.iflib.rxq3.rxq_fl0.buf_size: 2048
dev.igc.1.iflib.rxq3.rxq_fl0.credits: 1023
dev.igc.1.iflib.rxq3.rxq_fl0.cidx: 734
dev.igc.1.iflib.rxq3.rxq_fl0.pidx: 733
dev.igc.1.iflib.rxq3.cpu: 3
dev.igc.1.iflib.rxq2.rxq_fl0.buf_size: 2048
dev.igc.1.iflib.rxq2.rxq_fl0.credits: 1023
dev.igc.1.iflib.rxq2.rxq_fl0.cidx: 622
dev.igc.1.iflib.rxq2.rxq_fl0.pidx: 621
dev.igc.1.iflib.rxq2.cpu: 2
dev.igc.1.iflib.rxq1.rxq_fl0.buf_size: 2048
dev.igc.1.iflib.rxq1.rxq_fl0.credits: 1023
dev.igc.1.iflib.rxq1.rxq_fl0.cidx: 146
dev.igc.1.iflib.rxq1.rxq_fl0.pidx: 145
dev.igc.1.iflib.rxq1.cpu: 1
dev.igc.1.iflib.rxq0.rxq_fl0.buf_size: 2048
dev.igc.1.iflib.rxq0.rxq_fl0.credits: 1023
dev.igc.1.iflib.rxq0.rxq_fl0.cidx: 809
dev.igc.1.iflib.rxq0.rxq_fl0.pidx: 808
dev.igc.1.iflib.rxq0.cpu: 0
dev.igc.1.iflib.txq3.r_abdications: 0
dev.igc.1.iflib.txq3.r_restarts: 0
dev.igc.1.iflib.txq3.r_stalls: 0
dev.igc.1.iflib.txq3.r_starts: 7796885
dev.igc.1.iflib.txq3.r_drops: 0
dev.igc.1.iflib.txq3.r_enqueues: 7797973
dev.igc.1.iflib.txq3.ring_state: pidx_head: 1237 pidx_tail: 1237 cidx: 1237 state: IDLE
dev.igc.1.iflib.txq3.txq_cleaned: 7985439
dev.igc.1.iflib.txq3.txq_processed: 7985479
dev.igc.1.iflib.txq3.txq_in_use: 42
dev.igc.1.iflib.txq3.txq_cidx_processed: 327
dev.igc.1.iflib.txq3.txq_cidx: 287
dev.igc.1.iflib.txq3.txq_pidx: 329
dev.igc.1.iflib.txq3.no_tx_dma_setup: 0
dev.igc.1.iflib.txq3.txd_encap_efbig: 0
dev.igc.1.iflib.txq3.tx_map_failed: 0
dev.igc.1.iflib.txq3.no_desc_avail: 0
dev.igc.1.iflib.txq3.mbuf_defrag_failed: 0
dev.igc.1.iflib.txq3.m_pullups: 0
dev.igc.1.iflib.txq3.mbuf_defrag: 0
dev.igc.1.iflib.txq3.cpu: 3
dev.igc.1.iflib.txq2.r_abdications: 0
dev.igc.1.iflib.txq2.r_restarts: 0
dev.igc.1.iflib.txq2.r_stalls: 0
dev.igc.1.iflib.txq2.r_starts: 5389171
dev.igc.1.iflib.txq2.r_drops: 0
dev.igc.1.iflib.txq2.r_enqueues: 5389985
dev.igc.1.iflib.txq2.ring_state: pidx_head: 1697 pidx_tail: 1697 cidx: 1697 state: IDLE
dev.igc.1.iflib.txq2.txq_cleaned: 5407150
dev.igc.1.iflib.txq2.txq_processed: 5407190
dev.igc.1.iflib.txq2.txq_in_use: 41
dev.igc.1.iflib.txq2.txq_cidx_processed: 470
dev.igc.1.iflib.txq2.txq_cidx: 430
dev.igc.1.iflib.txq2.txq_pidx: 471
dev.igc.1.iflib.txq2.no_tx_dma_setup: 0
dev.igc.1.iflib.txq2.txd_encap_efbig: 0
dev.igc.1.iflib.txq2.tx_map_failed: 0
dev.igc.1.iflib.txq2.no_desc_avail: 0
dev.igc.1.iflib.txq2.mbuf_defrag_failed: 0
dev.igc.1.iflib.txq2.m_pullups: 0
dev.igc.1.iflib.txq2.mbuf_defrag: 0
dev.igc.1.iflib.txq2.cpu: 2
dev.igc.1.iflib.txq1.r_abdications: 0
dev.igc.1.iflib.txq1.r_restarts: 0
dev.igc.1.iflib.txq1.r_stalls: 0
dev.igc.1.iflib.txq1.r_starts: 18676639
dev.igc.1.iflib.txq1.r_drops: 0
dev.igc.1.iflib.txq1.r_enqueues: 18677616
dev.igc.1.iflib.txq1.ring_state: pidx_head: 1904 pidx_tail: 1904 cidx: 1904 state: IDLE
dev.igc.1.iflib.txq1.txq_cleaned: 33628074
dev.igc.1.iflib.txq1.txq_processed: 33628114
dev.igc.1.iflib.txq1.txq_in_use: 42
dev.igc.1.iflib.txq1.txq_cidx_processed: 978
dev.igc.1.iflib.txq1.txq_cidx: 938
dev.igc.1.iflib.txq1.txq_pidx: 980
dev.igc.1.iflib.txq1.no_tx_dma_setup: 0
dev.igc.1.iflib.txq1.txd_encap_efbig: 0
dev.igc.1.iflib.txq1.tx_map_failed: 0
dev.igc.1.iflib.txq1.no_desc_avail: 0
dev.igc.1.iflib.txq1.mbuf_defrag_failed: 0
dev.igc.1.iflib.txq1.m_pullups: 0
dev.igc.1.iflib.txq1.mbuf_defrag: 0
dev.igc.1.iflib.txq1.cpu: 1
dev.igc.1.iflib.txq0.r_abdications: 0
dev.igc.1.iflib.txq0.r_restarts: 0
dev.igc.1.iflib.txq0.r_stalls: 0
dev.igc.1.iflib.txq0.r_starts: 6354534
dev.igc.1.iflib.txq0.r_drops: 0
dev.igc.1.iflib.txq0.r_enqueues: 6358392
dev.igc.1.iflib.txq0.ring_state: pidx_head: 1400 pidx_tail: 1400 cidx: 1400 state: IDLE
dev.igc.1.iflib.txq0.txq_cleaned: 6376647
dev.igc.1.iflib.txq0.txq_processed: 6376687
dev.igc.1.iflib.txq0.txq_in_use: 41
dev.igc.1.iflib.txq0.txq_cidx_processed: 239
dev.igc.1.iflib.txq0.txq_cidx: 199
dev.igc.1.iflib.txq0.txq_pidx: 240
dev.igc.1.iflib.txq0.no_tx_dma_setup: 0
dev.igc.1.iflib.txq0.txd_encap_efbig: 0
dev.igc.1.iflib.txq0.tx_map_failed: 0
dev.igc.1.iflib.txq0.no_desc_avail: 0
dev.igc.1.iflib.txq0.mbuf_defrag_failed: 0
dev.igc.1.iflib.txq0.m_pullups: 0
dev.igc.1.iflib.txq0.mbuf_defrag: 0
dev.igc.1.iflib.txq0.cpu: 0
dev.igc.1.iflib.override_nrxds: 0
dev.igc.1.iflib.override_ntxds: 0
dev.igc.1.iflib.allocated_msix_vectors: 5
dev.igc.1.iflib.use_extra_msix_vectors: 0
dev.igc.1.iflib.use_logical_cores: 0
dev.igc.1.iflib.separate_txrx: 0
dev.igc.1.iflib.core_offset: 0
dev.igc.1.iflib.tx_abdicate: 0
dev.igc.1.iflib.rx_budget: 0
dev.igc.1.iflib.disable_msix: 0
dev.igc.1.iflib.override_qs_enable: 0
dev.igc.1.iflib.override_nrxqs: 0
dev.igc.1.iflib.override_ntxqs: 0
dev.igc.1.iflib.driver_version: 1
dev.igc.1.%iommu: rid=0x200
dev.igc.1.%parent: pci2
dev.igc.1.%pnpinfo: vendor=0x8086 device=0x125c subvendor=0x8086 subdevice=0x0000 class=0x020000
dev.igc.1.%location: slot=0 function=0 dbsf=pci0:2:0:0
dev.igc.1.%driver: igc
dev.igc.1.%desc: Intel(R) Ethernet Controller I226-V


#3

General Discussion / Re: Unbound DNS keeps crashing...

Last post by nero355 - Today at 11:16:37 PM

Perhaps its not Windows itself but some other application installed on the computer which has hard coded DNS server entries to use.

No it's really Windows 10 itself but I can't remember what it was about...

Grab a Window 10 PC or Laptop and search for it with regedit.msc and you will probably find it :)

#4

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by fornax - Today at 09:24:08 PM

#2 they offered another document regarding ASPM for the older devices:
https://kb.protectli.com/wp-content/uploads/sites/9/2026/02/TSB-2025-001_VP2440-ASPM-Network-Interface-Performance-Issue-v2_0.pdf

Sounds like their coreboot fix is doing the same/similar thing as the kernel patch? If so, I wonder why they didn't extend that to their other models with i226-Vs.

#5

26.1, 26,4 Series / Re: tunables set to unknown va...

Last post by onnieoneone - Today at 09:01:54 PM

I'm also having this problem (running 26.1.11_6), things I definitely didn't change are showing a difference between Value and Default.

Maybe options elsewhere are affecting this, e.g. net.inet6.ip6.log_cannot_forward is Value = 1, Default = 0. I've made a number of ipv6 changes in other areas...

Anyway, related to this I'm also seeing my intentional changes to Tunables not sticking.

I'm trying to set some tunables and they land in /boot/loader.conf but just don't get set.

Code Select Expand

# cat /conf/config.xml|grep performance -A 1 -B 3 | sed 's/uuid=".*"/uuid="dummy"/g'
    <item uuid="dummy">
      <tunable>net.inet.rss.enabled</tunable>
      <value>1</value>
      <descr>My changes to increase performance</descr>
    </item>
    <item uuid="dummy">
      <tunable>net.isr.bindthreads</tunable>
      <value>1</value>
      <descr>My changes to increase performance</descr>
    </item>
    <item uuid="dummy">
      <tunable>net.isr.maxthreads</tunable>
      <value>-1</value>
      <descr>My changes to increase performance</descr>
    </item>
    <item uuid="dummy">
      <tunable>net.inet.rss.bits</tunable>
      <value>2</value>
      <descr>My changes to increase performance</descr>
    </item>
---reboot---
# cat /boot/loader.conf|grep -e rss -e isr
net.inet.rss.bits="2"
net.inet.rss.enabled="1"
net.isr.bindthreads="1"
net.isr.maxthreads="-1"
# sysctl net.inet.rss.enabled net.inet.rss.bits net.isr.bindthreads net.isr.maxthreads
net.inet.rss.enabled: 0
net.inet.rss.bits: 2
net.isr.bindthreads: 0
net.isr.maxthreads: 1

Could this be related to this issue? Happy to raise a new issue...

I don't see anything under /var/log or in dmesg that looks like /boot/loader.conf got skipped...

Update: I rebooted once more and the settings stuck. Odd, I got these settings from a config restore which took me down for the original reboot. After that reboot the changes weren't applied, but with no further changes and just another reboot they finally stuck.

The original thread's problems remain though...

#6

General Discussion / Re: Can interfaces switch on r...

Last post by sopex - Today at 07:19:21 PM

It's a combination of the virtualized host you are using and the way FreeBSD assigns interfaces.

Make sure "Prevent interface removal" is ticked on all your interfaces.

Also, we are at 26.1.11 now :)

#7

26.1, 26,4 Series / Re: Strange issue with Firewal...

Last post by lmoore - Today at 07:18:14 PM

If the 10.100.100.64/?? subnet is on <obscured>_Lab_Network interface, check your logs to see if the rule is hit. If so, check your outbound rules on the interface which goes to 172.17.12.155.

You could have a floating rule which may be blocking the connection or even a 'Destination Nat' (RDR) rule which is directing it elsewhere.

#8

26.7 Release Candidate Series / DNS redirect on 26.7 RC2

Last post by Jimmy007 - Today at 07:07:01 PM

Greetings,
I did a test install of 27.RC1 and updated to RC2. I reinstalled my backup from 26.1.11_6. However, It seems the DNS redirect to Unbound became non-functional. Any clues?

#9

Development and Code Review / Re: Blocky DNS (Alternate to A...

Last post by gspannu - Today at 06:47:07 PM

Hi gspannu, thanks for creating the repo but Blocky is outdated by many versions now.
What do you think about an Autobuilder script that creates a FreeBSD package for Blocky automatically when an update is released by the official project?

I have updated the repo for now... with the latest version of Blocky; but I will look at automating this.

#10

German - Deutsch / OPNsense Ansible Oxlorg Purge

Last post by Fenris14 - Today at 06:46:08 PM

Hallo,

ich versuche seit einigen Tagen mit Ansible und Git einige Playbooks umzusetzen. Einstellungen setzen und Standards definieren, ist soweit kein Problem.

Am meisten hänge ich bei dem Modulen rule und rule_multi. Es geht im Prinzip darum das Git als einzige Quelle der Wahrheit zu bauen. Vor allem die Funktion purge_all ist eigentlich interessant. Wenn ich es richtig verstanden habe, kann man damit alle Regeln im Zusammenspiel mit purge_filter von definierten Interfaces löschen und mit dem Stand abgleichen den man pushen möchte.

https://ansible-opnsense.oxl.app/modules/rule_multi.html

Bisher sieht es bei mir so hier aus:

Code Select Expand

---
  tasks:
       - name: Purge and Apply
      oxlorg.opnsense.rule_multi:
        multi_control:
          fail_verify: true
          purge_all: true         
          purge_filter:
            interface: "lan,opt1,opt2,opt3,opt4" 
        rules: >                 
          {{
            [
              (global_multi_interface_rules | default([])), (custom_multi_interface_rules | default([])),
              (global_server_rules | default([])), (custom_server_rules | default([])),
              (global_client_rules | default([])), (custom_client_rules | default([])),
              (global_voip_rules | default([])), (custom_voip_rules | default([])),
              (global_management_rules | default([])), (custom_management_rules | default([])),
            ] | flatten
          }}
      register: rule_sync

    - name: Trigger Firewall Filter Reload
      oxlorg.opnsense.reload:
        target: rule
      when: rule_sync.changed

Das Problem: Er schreibt die Regeln und macht auch einen Reload. Aber wenn eine manuell erstellte Regel oder eine Regel im Git nicht mehr existent ist, dann löscht er diese nicht.

Bisher konnte ich das nur erreichen wenn ich eine vorher vorhandene Regel im Git auf

Code Select Expand

state: absent setze. Das löst aber mein Problem mit manuell erstellten Regeln nicht. Und ja, ganz bewusst will ich alles purgen und dann die Regeln drüber ziehen. Deshalb ich den filter auf bestimmte Interfaces gesetzt und nicht auf alle.

Wie funktioniert die purge Funktion? Hat das mal jemand versucht?

Grüße