"Recent posts
#1
Hardware and Performance / Re: [solved] Intel i226 Firmwa...
Last post by He4DHuNt3r - Today at 04:47:01 PMQuote from: RobertoZ on Today at 04:01:55 PMTry the 2MB. I have the two port version and the 2MB version of the file worked.
No luck :(
So when I try the 2MB files, the update process fails pretty much instantly.... but if I use the 1MB files, it takes a good few minutes for the update to fail
Code Select
Num Description Ver.(hex) DevId S:B Status
=== ================================== ============ ===== ====== ==============
01) Intel(R) Ethernet Controller 2.19(2.13) 125C 00:013 Update failed
I226-V
Tool execution completed with the following status: An error occurred when updating a firmware module. #2
26.1 Series / Re: Firewall Rules migrated bu...
Last post by Nephiria - Today at 04:17:25 PMHello everyone,
As I already mentioned, the migration was performed in February 2026.
I only noticed yesterday after seeing that something was wrong with the Crowdsec alias; it seems to have been reset as well. Everything was set up on the OPNsense around the same time.
And yes, all the migrated rules appear to have been reset. My rules are back in their original location.
I deleted them from the "old location" after the migration, once I had verified that everything was working correctly.
The only changes I made were installing Crowdsec on the OPNsense and firmware updates. I personally suspect that a firmware update might have loaded the old snapshot taken before the migration, which is why everything was reset.
I'm currently on the following firmware version:
OPNsense 26.1.4-amd64
FreeBSD 14.3-RELEASE-p9
OpenSSL 3.0.19
It seems this happened during the upgrade from version 25.xx to 26.xx, but I can't say for sure. I'll probably have no choice but to perform this migration again. I just wanted to report it since these rules weren't deleted by me. I assume it was an automated process, like a firmware upgrade.
Unfortunately, I don't have any further information.
As I already mentioned, the migration was performed in February 2026.
I only noticed yesterday after seeing that something was wrong with the Crowdsec alias; it seems to have been reset as well. Everything was set up on the OPNsense around the same time.
And yes, all the migrated rules appear to have been reset. My rules are back in their original location.
I deleted them from the "old location" after the migration, once I had verified that everything was working correctly.
The only changes I made were installing Crowdsec on the OPNsense and firmware updates. I personally suspect that a firmware update might have loaded the old snapshot taken before the migration, which is why everything was reset.
I'm currently on the following firmware version:
OPNsense 26.1.4-amd64
FreeBSD 14.3-RELEASE-p9
OpenSSL 3.0.19
It seems this happened during the upgrade from version 25.xx to 26.xx, but I can't say for sure. I'll probably have no choice but to perform this migration again. I just wanted to report it since these rules weren't deleted by me. I assume it was an automated process, like a firmware upgrade.
Unfortunately, I don't have any further information.
#3
Russian - Русский / Re: os-amneziawg — плагин Amne...
Last post by Arxont - Today at 04:04:52 PMQuote from: Pavlik24rus on Today at 02:35:09 PMУ меня сожалению нет второй амнезии на моем впс, если поделитесь конфигом, для тестов, то думаю допилить будет не проблема
Code Select
[Interface]
Address = 10.8.1.2/32
DNS = 1.1.1.1, 1.0.0.1
PrivateKey = K0z+5CsdfNjiHGUIJ226544grbhuJjTxmZz+eSRTsZTzi0E=
Jc = 4
Jmin = 10
Jmax = 50
S1 = 42
S2 = 50
S3 = 5
S4 = 1
H1 = 244307677-989114229
H2 = 1598423081-1900657433
H3 = 2057278795-2140729835
H4 = 2147278520-2147373120
I1 = <b 0x084481800001000300000000077469636b65747306776964676574096b696e6f706f69736b0272750000010001c00c0005000100000039001806776964676574077469636b6574730679616e646578c025c0390005000100000039002b1765787465726e616c2d7469636b6574732d776964676574066166697368610679616e646578036e657400c05d000100010000001c000457fafe25>
I2 =
I3 =
I4 =
I5 =
[Peer]
PublicKey = sSfaf9Y56Pl2jVRNAlwmYuhNJGIWNJTWfDYjzdSk=
PresharedKey = 3qK5APpJNGJRNUyq/nr2vO/zbv/cHeSEw5125VGGHmEzY=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ххх.ххх.ххх.ххх:zzzzz
PersistentKeepalive = 25Я в плагине добавил новые параметры без проблем, подключение поднималось, хэндшейк был. Проблема в сохранении конкретно параметра I1 (все остальные параметры сохранялись нормально). В самом плагине я отключил все проверки и преобразования строк, но дальше в дело вступал сам opnsense, он отказывался хранить в своем конфиге строку параметра I1, он превращает ее в безопасный вариант, а нужна именно эта строка.
#4
Hardware and Performance / Re: [solved] Intel i226 Firmwa...
Last post by RobertoZ - Today at 04:01:55 PMQuote from: He4DHuNt3r on Today at 03:14:12 PMHas anyone had any luck updating the NVM on this generic Aliexpress I226-V?
Try the 2MB. I have the two port version and the 2MB version of the file worked.
#5
Tutorials and FAQs / Re: IPv6 on OPNsense with Veri...
Last post by daemonhorn - Today at 03:25:57 PMWhile OPNsense has the necessary dhcp6c code path to allow your FiOS WAN interface IPv6 configuration to have both a link local (fe80:: prefix) and a global IPv6 address, it will not configure it that way by default (as of OPNsense 26.1.4 in March 2026).
You will need to also configure a custom dhcp6c client configuration file in [Interfaces->WAN->DHCPv6 Client Configuration, then select Override Configuration Mode] Example screenshot:
You cannot view this attachment.
Example /etc/dhcp6c.WAN_LAN.conf below:
You will need to also configure a custom dhcp6c client configuration file in [Interfaces->WAN->DHCPv6 Client Configuration, then select Override Configuration Mode] Example screenshot:
You cannot view this attachment.
Example /etc/dhcp6c.WAN_LAN.conf below:
- ssh into opnsense and create this text file from scratch, then apply to the web gui configuration
- adjust interface names to match your system (e.g. em0 to igc0 {do not use OPNsense alias names like WAN})
- You will need to specify every interface you want a prefix assigned to in the config. Example below include WAN, LAN, and a tagged vlan for GUEST_VLAN devices
- You can customize the sla-id per interface as desired (each interface must be unique for /64 out of PD provided /56)
Code Select
interface em0 {
send ia-pd 0; # request prefix delegation
request domain-name-servers;
request domain-name;
script "/var/etc/dhcp6c_wan_script.sh"; # we'd like some nameservers please
};
id-assoc pd 0 {
# Support prefix 0 on LAN interface (em1)
prefix ::/56 infinity;
prefix-interface em1 {
sla-id 0;
sla-len 8;
};
# Support prefix 1 on GUEST_VLAN interface (vlan0.20 with a parent of em1)
prefix-interface vlan0.20 {
sla-id 1;
sla-len 8;
};
# Support prefix 16 on WAN interface (em0) - requires patch to dhcp6c prefixconf.c to enable on pfSense, but works out of the box on OPNsense
prefix-interface em0 {
sla-id 16;
sla-len 8;
};
};
#6
Hardware and Performance / Re: [solved] Intel i226 Firmwa...
Last post by He4DHuNt3r - Today at 03:14:12 PM
Has anyone had any luck updating the NVM on this generic Aliexpress I226-V?
I've tried updating to 2.32 and lower firmware versions, but it always fails - Tried updating through Windows, EFI & Linux with iomem=relaxed
Inventory
Code Select
nvmupdatew64e -i -l log.txt
Config file will not be read.
Inventory
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Alternate MAC address is not set.
Flash inventory started.
Shadow RAM inventory started.
Shadow RAM inventory finished.
Flash inventory finished.
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Vendor : 8086
Device : 125C
Subvendor : 8086
Subdevice : 0000
Revision : 4
LAN MAC : XXXXXXXXXXXX
Alt MAC : 000000000000
SAN MAC : 000000000000
ETrackId : 80000286
SerialNumber : XXXXXXXXXXXXXXXX
NVM Version : 2.19(2.13)
PBA : G23456-000
VPD status : Not set
VPD size : 0
NVM update : No config file entry
checksum : ValidConfig
Code Select
CURRENT FAMILY: 1.0.0
CONFIG VERSION: 1.20.0
; NIC device
BEGIN DEVICE
DEVICENAME: Intel(R) Ethernet Controller I226-V
VENDOR: 8086
DEVICE: 125C
SUBVENDOR: 8086
SUBDEVICE: 0000
NVM IMAGE: FXVL_125C_V_1MB_2.32.bin
EEPID: 80000425
RESET TYPE: REBOOT
REPLACES: 80000286
END DEVICENVM.log
Code Select
nvmupdatew64e.exe -b -l nvm.log -m XXXXXXXXXXXX -f -u -c nvm.cfg
Config file read.
Inventory
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Alternate MAC address is not set.
Flash inventory started.
Shadow RAM inventory started.
Shadow RAM inventory finished.
Flash inventory finished.
Update
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Creating backup images in directory: XXXXXXXXXXXX .
Backup images created.
Flash update started.
Error: Flash update failed.
Device update failed.
Update security revisions
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Skipping update minimum security revisions.
Update VPD with VPD template
[00:013:00:00]: Intel(R) Ethernet Controller I226-V
Skipping VPD update with VPD template. #7
Russian - Русский / Re: os-amneziawg — плагин Amne...
Last post by Pavlik24rus - Today at 02:35:09 PMQuote from: Arxont on Today at 02:05:32 PMУ меня сожалению нет второй амнезии на моем впс, если поделитесь конфигом, для тестов, то думаю допилить будет не проблемаQuote from: Zlobniy Shurik on March 21, 2026, 01:03:03 PMТут, в идеале, надо подымать opnsense с ноля (на виртуалке ли, на реальном железе ли) и пошагово, без каких-либо отклонений проверять инструкцию - работает или нет.
На уже работающей машине выверять не стоит - возможно, часть необходимых настроек/установки пакетов была сделана при установке других модулей. Соответственно, эту зависимость можно ненароком пропустить.
Я так по работе делаю, тоже пошаговые инструкции писать приходится. И вот когда начинаешь эмулировать неподготовленного юзера с нулевой тачкой из шаблона, выполняя скрупулёзно эту самую инструкцию, вот тут-то и вылезает - там настройку забыл указать, тут последовательность действий чуть другая, e.t.c.
P.S. Кстати, вполне возможно что инструкция рабочая, но, например, только для 25.xx
P.S.S. А, может, я тупо делаю какую-то незаметную для себя ошибку каждый раз, когда пытаюсь эту штуку настроить. Тут помогает забросить проект на несколько дней и начать воплощать его с ноля - авось, дойдёт в процессе - где собака порылась.
Тоже думаю уже чистый OPNSense поднять и на нем попробовать сделать, пока просто времени нет с этим возиться, а на основном я уже откатил изменения в Proxmox, а то совсем уже какая то хрень началась после кучи попыток заставить работать.
А вообще надеюсь автор плагина добавит поддержку v2, а то я так то переделал плагин под v2, но одну проблему так решить и не смог, в итоге вручную на самом opnsense правил конфиги.
#8
Russian - Русский / Re: os-amneziawg — плагин Amne...
Last post by Arxont - Today at 02:05:32 PMQuote from: Zlobniy Shurik on March 21, 2026, 01:03:03 PMТут, в идеале, надо подымать opnsense с ноля (на виртуалке ли, на реальном железе ли) и пошагово, без каких-либо отклонений проверять инструкцию - работает или нет.
На уже работающей машине выверять не стоит - возможно, часть необходимых настроек/установки пакетов была сделана при установке других модулей. Соответственно, эту зависимость можно ненароком пропустить.
Я так по работе делаю, тоже пошаговые инструкции писать приходится. И вот когда начинаешь эмулировать неподготовленного юзера с нулевой тачкой из шаблона, выполняя скрупулёзно эту самую инструкцию, вот тут-то и вылезает - там настройку забыл указать, тут последовательность действий чуть другая, e.t.c.
P.S. Кстати, вполне возможно что инструкция рабочая, но, например, только для 25.xx
P.S.S. А, может, я тупо делаю какую-то незаметную для себя ошибку каждый раз, когда пытаюсь эту штуку настроить. Тут помогает забросить проект на несколько дней и начать воплощать его с ноля - авось, дойдёт в процессе - где собака порылась.
Тоже думаю уже чистый OPNSense поднять и на нем попробовать сделать, пока просто времени нет с этим возиться, а на основном я уже откатил изменения в Proxmox, а то совсем уже какая то хрень началась после кучи попыток заставить работать.
А вообще надеюсь автор плагина добавит поддержку v2, а то я так то переделал плагин под v2, но одну проблему так решить и не смог, в итоге вручную на самом opnsense правил конфиги.
#9
26.1 Series / Re: How to keep gateway on Gat...
Last post by pfry - Today at 01:46:03 PMQuote from: gnsinfo on Today at 07:13:29 AM[...]I can't find Disable reply-to[...]
Firewall: Settings: Advanced -> Miscellaneous.
#10
General Discussion / Re: WAN IPv6 Privacy Extension...
Last post by drosophila - Today at 12:49:21 PMI had read through the entire thread and it was indeed established that PE is only defined for SLAAC, not for DHCP6 (counter-intuitively at first, but of course it makes sense that an address that is assigned explicitly by central management should be used). However, the final post
https://forum.opnsense.org/index.php?msg=230300
voiced the observation that with requesting a prefix only the PE would, if enabled, also generate a proper address just like it would in the SLAAC case, but the problem might be the priority of it being used for outgoing traffic.
Be that as it may, I always get the MAC-derived address first in the list and the PE second so the picker always uses the MAC-derived one. Probably the kernel would chose the PE properly but the NAT picker doesn't. Removing the MAC-derived address obviously always works so there is no priority ambiguity. Maybe I can do something with aliases, but since the prefixes change regularly, I don't see how I could pin it down. Regularly changing prefixes are just as desirable as it is to randomize the suffix since otherwise trackers will simply track by prefix.
I'm aware that the OPNSense box normally only uses its IP for its own traffic and that a public address is helpful for inbound connectivity that also will be advertised to a DynDNS provider (I need to look into this as well for IPv6, but if it works, it would also work with PE addresses).
Anyway, I've noticed that each time a new prefix is assigned, the WAN interface gets a new set of addresses but the old one pervails, so it'll end up accumulating addresses (I assign two prefixes (one from the ISP and one ULA) so maybe that is the issue). ifconfig output lists the old ones as "deprecated" though, so they should not be used and hopefully get cleared automatically eventually. The script doesn't catch the newly assigned one, possibly it is only run at start-up, I'll need to look into this some more. Also, it needs to be made more robust in both the selection and handling of multiple matches.
And yes, I am using a VPN, but it's not always desirable to use it so I'd like working PE as "backup".
I still hope to find a way to get NAT to hit before the scope check, so I could go fully local-only on the LAN. That way, if pf goes down or forgets its rules for any reason, I will be fully closed instead of being fully open (like it would be now).
https://forum.opnsense.org/index.php?msg=230300
voiced the observation that with requesting a prefix only the PE would, if enabled, also generate a proper address just like it would in the SLAAC case, but the problem might be the priority of it being used for outgoing traffic.
Be that as it may, I always get the MAC-derived address first in the list and the PE second so the picker always uses the MAC-derived one. Probably the kernel would chose the PE properly but the NAT picker doesn't. Removing the MAC-derived address obviously always works so there is no priority ambiguity. Maybe I can do something with aliases, but since the prefixes change regularly, I don't see how I could pin it down. Regularly changing prefixes are just as desirable as it is to randomize the suffix since otherwise trackers will simply track by prefix.
I'm aware that the OPNSense box normally only uses its IP for its own traffic and that a public address is helpful for inbound connectivity that also will be advertised to a DynDNS provider (I need to look into this as well for IPv6, but if it works, it would also work with PE addresses).
Anyway, I've noticed that each time a new prefix is assigned, the WAN interface gets a new set of addresses but the old one pervails, so it'll end up accumulating addresses (I assign two prefixes (one from the ISP and one ULA) so maybe that is the issue). ifconfig output lists the old ones as "deprecated" though, so they should not be used and hopefully get cleared automatically eventually. The script doesn't catch the newly assigned one, possibly it is only run at start-up, I'll need to look into this some more. Also, it needs to be made more robust in both the selection and handling of multiple matches.
And yes, I am using a VPN, but it's not always desirable to use it so I'd like working PE as "backup".
I still hope to find a way to get NAT to hit before the scope check, so I could go fully local-only on the LAN. That way, if pf goes down or forgets its rules for any reason, I will be fully closed instead of being fully open (like it would be now).
