"Recent posts
#1
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by chandrayandeepak - Today at 10:18:23 AMEven not permitting one by one import.
BTW, there is no other certificate visible in Authorities!
BTW, there is no other certificate visible in Authorities!
#2
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by ab - Today at 09:11:08 AMEven after hacking around the private key check, I can find no way to import a full Let's Encrypt cert bundle with its intermediate CAs so that they get picked up by the web server. All the prior CA imports have the multiple certs in one entry, which is what is now explicitly blocked.
I've filed https://github.com/opnsense/core/issues/11130
I've filed https://github.com/opnsense/core/issues/11130
#3
German - Deutsch / Re: Performance verbessern
Last post by tangofan - Today at 08:51:22 AMFalls du Zenarmor mit dem Emulated Netmap driver betreibst, sollte der Wechsel auf den Native Netmap driver noch etwas Geschwindigkeit herausholen. Ansonsten bin ich skeptisch, ob die Tunables etwas bringen, da die NICs ja anscheinend im Prinzip mit dem vollen Durchsatz laufen, sie werden halt durch Zenarmor im Single-Thread Modus ausgebremst. Du kannst natürlich mal im englischsprachigen Forum für Zenarmor nachfragen, ob da noch etwas geht.
Diese Tatsache (und ein gelegentliches Problem mit stotternden Videos in Youtube) hat letztendlich für mich den Ausschlag gegeben, Zenarmor zu deinstallieren, sogar bevor mein Premium-Abo abgelaufen war.
Diese Tatsache (und ein gelegentliches Problem mit stotternden Videos in Youtube) hat letztendlich für mich den Ausschlag gegeben, Zenarmor zu deinstallieren, sogar bevor mein Premium-Abo abgelaufen war.
#4
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by chandrayandeepak - Today at 06:55:43 AM@Monviech (Cedrik) : Yes, we tried single certificate at once, but unable to.
@ab : Your replication is exactly like ours. Without issuing PrivateCA in Trust, leaf aren't trusted.
@ab : Your replication is exactly like ours. Without issuing PrivateCA in Trust, leaf aren't trusted.
#5
Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...
Last post by mlenje - Today at 04:08:14 AMUpdate: the "heavy" runs stopped after a reboot, and here's why
Correction first: the scheduler isn't a fixed 5-hour timer. ipdrstreamer checks every hour and collects only if 4 hours have passed since the last heartbeat:
After rebooting (for the OPNsense 26.7.8 update), ipdrstreamer and zenarmor-agent both started at 16:16:12. At the next two coincidences the collectors started ~6 seconds apart and finished at the same millisecond:
Before the reboot, the 2.7.1 upgrade had started ipdrstreamer and the agent 30 seconds apart (22:14:38 vs 22:15:08), and each overlap ran two separate 30-day aggregations (~4m48s each, 90%+ CPU).
Workaround: a reboot that starts both processes together seems to eliminate the heavy runs. The light 5-hourly collection remains (~3.5 min vs ~0.4 s before 2.7.1), which I've reported to Zenarmor support.
Correction first: the scheduler isn't a fixed 5-hour timer. ipdrstreamer checks every hour and collects only if 4 hours have passed since the last heartbeat:
Code Select
19:16:12 heartbeat: not due last_sent=15:18:06 next_in=1m53s
20:16:12 -> collected (took 3m29s)
Because each collection finishes ~3.5 minutes after its check starts, the 4-hour mark always falls just after an hourly check, so it runs every 5th hour. The agent does the same thing with checks every 4 hours, so the two coincide every 20 hours.After rebooting (for the OPNsense 26.7.8 update), ipdrstreamer and zenarmor-agent both started at 16:16:12. At the next two coincidences the collectors started ~6 seconds apart and finished at the same millisecond:
Code Select
16:19:53.214 heartbeat: collected took=3m40.688s
16:19:53.214 heartbeat: collected triggered_by=agent took=3m35.185s
So the agent's request appears to join the collection already in progress. Only one 30-day aggregation runs, CPU stays around 55-60%, and there were no alerts.Before the reboot, the 2.7.1 upgrade had started ipdrstreamer and the agent 30 seconds apart (22:14:38 vs 22:15:08), and each overlap ran two separate 30-day aggregations (~4m48s each, 90%+ CPU).
Workaround: a reboot that starts both processes together seems to eliminate the heavy runs. The light 5-hourly collection remains (~3.5 min vs ~0.4 s before 2.7.1), which I've reported to Zenarmor support.
#6
26.7, 26.10 Series / Re: [26.7] UPnP/NAT-PMP leaks ...
Last post by Mann-IT - Today at 01:19:42 AMHi Franco,
quick follow-up: FreeBSD ports got net/miniupnpd 2.3.11 on Oct 16 (rcmcdonald91), which includes the delete_nat_rule() fix (463ec13). opnsense/ports and 26.7.8 are still on 2.3.9_3.
Any chance to get it into 26.7.9? Happy to test right away - NAT-PMP is still off here as a workaround.
Thanks!
quick follow-up: FreeBSD ports got net/miniupnpd 2.3.11 on Oct 16 (rcmcdonald91), which includes the delete_nat_rule() fix (463ec13). opnsense/ports and 26.7.8 are still on 2.3.9_3.
Any chance to get it into 26.7.9? Happy to test right away - NAT-PMP is still off here as a workaround.
Thanks!
#7
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by ab - October 31, 2026, 11:46:29 PMLikely a regression in https://github.com/opnsense/core/commit/b64be86839271b108e0c140fb53349303ddb6d5c
#8
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by ab - October 31, 2026, 11:38:48 PMI think I've hit the same issue. I'm trying to migrate from using os-acme-client to injecting certs from outside using the API. I can import a new leaf cert, but I cannot add any of the Let's Encrypt intermediate CAs. As a result, the web server serves only the leaf cert without any intermediates, and non-browser clients (e.g. curl) can't validate it.
Repro instructions from the UI:
1. Navigate to System: Trust: Authorities
2. Click Add
3. Choose "Import an existing Certificate Authority"
4. Enter a description, paste the single cert below into the Certificate data field, and leave the private key data blank
5. Click Save
This results in the error: "Only a single private key is allowed (found 0 sections)"
Needless to say, I don't have the key for this cert.
-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
-----END CERTIFICATE-----
Repro instructions from the UI:
1. Navigate to System: Trust: Authorities
2. Click Add
3. Choose "Import an existing Certificate Authority"
4. Enter a description, paste the single cert below into the Certificate data field, and leave the private key data blank
5. Click Save
This results in the error: "Only a single private key is allowed (found 0 sections)"
Needless to say, I don't have the key for this cert.
-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
-----END CERTIFICATE-----
#9
26.7, 26.10 Series / Re: Crash report: PHP unable t...
Last post by (MARLOO) - October 31, 2026, 11:21:20 PMQuote from: nero355 on October 31, 2026, 10:05:47 PMIt's documented here : https://www.zenarmor.com/docs/guides/best-practices-for-zenarmor-deployment#reporting-database
Thanks Nero355 this is exacltly the link
Also Remote Elasticsearch must be between 8.9.x and 8.17.1, so not "any 8.x".
The leftover mongodb.so is normal. Older ZenArmor versions installed MongoDB automatically on firewalls with 2–4 GB of RAM max.
Quote from: mimugmail on October 31, 2026, 10:57:33 PMBuilding still fails...
Is the report new or old?
does anything actually use it
--------------------------------
pkg info | grep -i mongo
ps auxww | grep -i [m]ongo
sockstat -4 -6 | grep -i mongo
php -m | grep -i mongo
-----------------------------------
if not
Safe removal
----------------------------------------------------------------------
cp /usr/local/etc/php/extensions.ini /root/extensions.ini.bak
pkg delete php85-pecl-mongodb
pkg autoremove
grep -n mongodb /usr/local/etc/php/extensions.ini
configctl webgui restart
-----------------------------------------------------------------------
#10
26.7, 26.10 Series / cve-2026-98432 (linux behind o...
Last post by paepcke - October 31, 2026, 11:11:20 PMhttps://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets
Is there away to identify and drop all impacted packets? With nft i can do ...
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)
Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )
- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets
Is there away to identify and drop all impacted packets? With nft i can do ...
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)
Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )
