"Recent posts
#1
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - Today at 11:52:19 AMHi babagoo, thank you, this information helps a lot.
Again, this is my best guess and not a sure answer, because I have not tested your setup.
What you describe looks like a problem on the Wi-Fi link, not a problem of CARP and not of the router. Your host reaches IPv6, and the router gives IPv6 to other devices, so the router seems fine. Only the firewall in the virtual machine gets an address but cannot go out.
This is typical when a virtual machine is bridged over a Wi-Fi card. A Wi-Fi connection normally accepts only one hardware address, the one of the host. IPv4 often still works because VMware translates it, but IPv6 often fails, because devices cannot find each other on the local link. The firewall can receive an address from the router, but the answers do not come back to the virtual machine. Your update worked over IPv4, and this fits the same picture.
Things to try, in this order:
1. If you can, connect the host with a cable, or use a USB Ethernet adapter, and bridge the virtual machine to that. This is the cleanest test. If IPv6 then works, the cause is the Wi-Fi bridge.
2. To confirm before changing anything: from the firewall, ping the local address of the router, the one that starts with fe80. If it does not answer, the problem is at link level. If it answers but a public IPv6 address does not, then check that the firewall has an IPv6 default gateway and look at the firewall rules.
3. If you must stay on Wi-Fi, for a lab it is fine to use only IPv4 on the WAN of the firewall, and to use IPv4 DNS servers in the system settings.
I do not know the ZTE U50 well, so I cannot say if it has a setting that blocks this. If the cable test does not solve it, tell me what you see and we can think about it again.
Sergio
Again, this is my best guess and not a sure answer, because I have not tested your setup.
What you describe looks like a problem on the Wi-Fi link, not a problem of CARP and not of the router. Your host reaches IPv6, and the router gives IPv6 to other devices, so the router seems fine. Only the firewall in the virtual machine gets an address but cannot go out.
This is typical when a virtual machine is bridged over a Wi-Fi card. A Wi-Fi connection normally accepts only one hardware address, the one of the host. IPv4 often still works because VMware translates it, but IPv6 often fails, because devices cannot find each other on the local link. The firewall can receive an address from the router, but the answers do not come back to the virtual machine. Your update worked over IPv4, and this fits the same picture.
Things to try, in this order:
1. If you can, connect the host with a cable, or use a USB Ethernet adapter, and bridge the virtual machine to that. This is the cleanest test. If IPv6 then works, the cause is the Wi-Fi bridge.
2. To confirm before changing anything: from the firewall, ping the local address of the router, the one that starts with fe80. If it does not answer, the problem is at link level. If it answers but a public IPv6 address does not, then check that the firewall has an IPv6 default gateway and look at the firewall rules.
3. If you must stay on Wi-Fi, for a lab it is fine to use only IPv4 on the WAN of the firewall, and to use IPv4 DNS servers in the system settings.
I do not know the ZTE U50 well, so I cannot say if it has a setting that blocks this. If the cable test does not solve it, tell me what you see and we can think about it again.
Sergio
#2
High availability / Re: CARP update of backup fire...
Last post by babagoo - Today at 11:06:02 AMHi Sergio. Here is the infomation i have:
1. Yes
2. It gets an ipv6 address but no access to public DNS server
3. Gives ipv6 to other devices
It is a zte u50 wifi router. The host uses WiFi
babagoo
1. Yes
2. It gets an ipv6 address but no access to public DNS server
3. Gives ipv6 to other devices
It is a zte u50 wifi router. The host uses WiFi
babagoo
#3
26.7, 26.10 Series / Re: ixv virtual function inter...
Last post by sternchen45 - Today at 09:03:42 AMmy take and forgive me to be brutally honest:
i read your first and although it is very long and probably thanks to AI it contains a lot of info - the main problem is not that its long but rather that you construct loss of basic functionality but dont prove it. Instead, you want your complex serup troubleshooted.
This is a forum. Its aim is to give help to people so they can act themselves. Its not a system integrator for free.
Install OPNsense from scratch in a test environment and test the basic functionality, then increase complexity.
i read your first and although it is very long and probably thanks to AI it contains a lot of info - the main problem is not that its long but rather that you construct loss of basic functionality but dont prove it. Instead, you want your complex serup troubleshooted.
This is a forum. Its aim is to give help to people so they can act themselves. Its not a system integrator for free.
Install OPNsense from scratch in a test environment and test the basic functionality, then increase complexity.
#4
Zenarmor (Sensei) / Re: Newest version zenarmor ca...
Last post by mimugmail - Today at 08:46:11 AMyou need to check the console output. Maybe you are connecting on the monitored if and it got stale for some reason.
#5
Virtual private networks / Re: Creating VLANs with Dnsmas...
Last post by BoNetTech - Today at 08:18:48 AMHi malebron, glad the VLANs are up now.
When a device gets an address in the right range but has no internet, it helps to find out where it stops. I have not seen your setup, so these are things to check and not a sure answer.
First test from a device on the IOT network: can it reach a public address by number, for example one of the well known public DNS servers, and can it reach a website by name? Please tell us which of the two works.
If the number works but the name does not, the problem is DNS. Check what DNS server the device received. It is usually the firewall address on that VLAN. Then check that the DNS service on the firewall really listens on that VLAN and allows requests from it. If you run another DNS service next to Dnsmasq, check that one as well.
If neither works, look at the outbound NAT. In automatic mode new networks are added by themselves, but in hybrid or manual mode the IOT network may be missing and needs its own rule. Also check the device received the firewall address on that VLAN as gateway, and that no floating rule or alias blocks the traffic before your open rule.
Please also tell us which outbound NAT mode you use and what address, gateway and DNS the device got. That will make it easy to see where it stops.
Sergio
When a device gets an address in the right range but has no internet, it helps to find out where it stops. I have not seen your setup, so these are things to check and not a sure answer.
First test from a device on the IOT network: can it reach a public address by number, for example one of the well known public DNS servers, and can it reach a website by name? Please tell us which of the two works.
If the number works but the name does not, the problem is DNS. Check what DNS server the device received. It is usually the firewall address on that VLAN. Then check that the DNS service on the firewall really listens on that VLAN and allows requests from it. If you run another DNS service next to Dnsmasq, check that one as well.
If neither works, look at the outbound NAT. In automatic mode new networks are added by themselves, but in hybrid or manual mode the IOT network may be missing and needs its own rule. Also check the device received the firewall address on that VLAN as gateway, and that no floating rule or alias blocks the traffic before your open rule.
Please also tell us which outbound NAT mode you use and what address, gateway and DNS the device got. That will make it easy to see where it stops.
Sergio
#6
26.7, 26.10 Series / Re: OPNsense as mail gateway, ...
Last post by franco - Today at 07:51:19 AMQuote from: nero355 on October 28, 2026, 09:19:38 PMQuote from: franco on October 28, 2026, 04:14:26 PMThe user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.What are you saying exactly ?
Is Postfix becoming deprecated ?
Or is there just less and less support for it when the OS it runs on is FreeBSD ?
If people are happy campers using postfix/rspamd plugins as is it will likely not become a more serious option for use inside OPNsense itself, because nobody will help improving it. That's a different topic from postfix/rspamd not being center stage in FreeBSD ports when it comes to security and ports updates.
Cheers,
Franco
#7
26.7, 26.10 Series / Re: ixv virtual function inter...
Last post by Hendre - Today at 07:27:07 AM@franco please
#8
Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...
Last post by mlenje - Today at 03:51:07 AMUpdate: I exported CPU history from Reporting > Health > System > Processor, and the spikes follow a fixed schedule:
Every 5 hours at :15, counted from when Zenarmor restarted during the upgrade (for me, 22:15 on Oct 26). Today's runs were 03:15, 08:15, 13:15 and 18:15.
Every 4th run is heavier, about once every 20 hours, with CPU at 90%+ for about 4 minutes. The lighter runs peak around 55–60% and didn't trigger my alerts.
Before the upgrade: no such pattern in 11 weeks of history.
The load is application CPU, not network or disk. During one heavy run, Elasticsearch was the top process in Diagnostics > Activity. I going to try to capture Elasticsearch's active tasks during the next predicted runs to identify the job itself and will post the results.
If you check your own Processor graph (5-minute resolution), do you see the same 5-hour rhythm starting from your upgrade time?
Every 5 hours at :15, counted from when Zenarmor restarted during the upgrade (for me, 22:15 on Oct 26). Today's runs were 03:15, 08:15, 13:15 and 18:15.
Every 4th run is heavier, about once every 20 hours, with CPU at 90%+ for about 4 minutes. The lighter runs peak around 55–60% and didn't trigger my alerts.
Before the upgrade: no such pattern in 11 weeks of history.
The load is application CPU, not network or disk. During one heavy run, Elasticsearch was the top process in Diagnostics > Activity. I going to try to capture Elasticsearch's active tasks during the next predicted runs to identify the job itself and will post the results.
If you check your own Processor graph (5-minute resolution), do you see the same 5-hour rhythm starting from your upgrade time?
#9
Zenarmor (Sensei) / Re: Newest version zenarmor ca...
Last post by xpking - Today at 01:03:28 AMQuote from: mimugmail on October 28, 2026, 06:03:53 AMDoes it reboot or crash? What happens on the console during restart button pushIt shows me restarting, then opnsense unresponsive.
I believe it crashed and rebooted.
#10
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - October 28, 2026, 10:57:57 PMHi, glad the update worked after the bridged network.
I have not tested your exact setup, so please take this as ideas and not as a sure answer.
Mobile routers from an ISP are often weak on IPv6. Many give only one address block to the router itself, without delegating a prefix to the devices behind it. Some also limit how many devices or hardware addresses they accept. CARP uses a virtual hardware address, so a router that filters addresses can drop it.
Another point: if the bridge in VMware uses the Wi-Fi card of the host, bridging with more than one hardware address often does not work well. A cable connection is better.
To find where it stops, I would check in this order:
1. Does the host computer itself reach public IPv6 addresses?
2. Does one firewall alone, with CARP switched off, get an IPv6 address on the WAN and reach a public IPv6 DNS server?
3. Does the router really give IPv6 to other devices, or only to itself?
If you tell me the router model and whether the host uses cable or Wi-Fi, I can think about it with you.
Sergio
I have not tested your exact setup, so please take this as ideas and not as a sure answer.
Mobile routers from an ISP are often weak on IPv6. Many give only one address block to the router itself, without delegating a prefix to the devices behind it. Some also limit how many devices or hardware addresses they accept. CARP uses a virtual hardware address, so a router that filters addresses can drop it.
Another point: if the bridge in VMware uses the Wi-Fi card of the host, bridging with more than one hardware address often does not work well. A cable connection is better.
To find where it stops, I would check in this order:
1. Does the host computer itself reach public IPv6 addresses?
2. Does one firewall alone, with CARP switched off, get an IPv6 address on the WAN and reach a public IPv6 DNS server?
3. Does the router really give IPv6 to other devices, or only to itself?
If you tell me the router model and whether the host uses cable or Wi-Fi, I can think about it with you.
Sergio
