"Recent posts
#1
Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...
Last post by mlenje - Today at 04:08:14 AMUpdate: the "heavy" runs stopped after a reboot, and here's why
Correction first: the scheduler isn't a fixed 5-hour timer. ipdrstreamer checks every hour and collects only if 4 hours have passed since the last heartbeat:
After rebooting (for the OPNsense 26.7.8 update), ipdrstreamer and zenarmor-agent both started at 16:16:12. At the next two coincidences the collectors started ~6 seconds apart and finished at the same millisecond:
Before the reboot, the 2.7.1 upgrade had started ipdrstreamer and the agent 30 seconds apart (22:14:38 vs 22:15:08), and each overlap ran two separate 30-day aggregations (~4m48s each, 90%+ CPU).
Workaround: a reboot that starts both processes together seems to eliminate the heavy runs. The light 5-hourly collection remains (~3.5 min vs ~0.4 s before 2.7.1), which I've reported to Zenarmor support.
Correction first: the scheduler isn't a fixed 5-hour timer. ipdrstreamer checks every hour and collects only if 4 hours have passed since the last heartbeat:
Code Select
19:16:12 heartbeat: not due last_sent=15:18:06 next_in=1m53s
20:16:12 -> collected (took 3m29s)
Because each collection finishes ~3.5 minutes after its check starts, the 4-hour mark always falls just after an hourly check, so it runs every 5th hour. The agent does the same thing with checks every 4 hours, so the two coincide every 20 hours.After rebooting (for the OPNsense 26.7.8 update), ipdrstreamer and zenarmor-agent both started at 16:16:12. At the next two coincidences the collectors started ~6 seconds apart and finished at the same millisecond:
Code Select
16:19:53.214 heartbeat: collected took=3m40.688s
16:19:53.214 heartbeat: collected triggered_by=agent took=3m35.185s
So the agent's request appears to join the collection already in progress. Only one 30-day aggregation runs, CPU stays around 55-60%, and there were no alerts.Before the reboot, the 2.7.1 upgrade had started ipdrstreamer and the agent 30 seconds apart (22:14:38 vs 22:15:08), and each overlap ran two separate 30-day aggregations (~4m48s each, 90%+ CPU).
Workaround: a reboot that starts both processes together seems to eliminate the heavy runs. The light 5-hourly collection remains (~3.5 min vs ~0.4 s before 2.7.1), which I've reported to Zenarmor support.
#2
26.7, 26.10 Series / Re: [26.7] UPnP/NAT-PMP leaks ...
Last post by Mann-IT - Today at 01:19:42 AMHi Franco,
quick follow-up: FreeBSD ports got net/miniupnpd 2.3.11 on Oct 16 (rcmcdonald91), which includes the delete_nat_rule() fix (463ec13). opnsense/ports and 26.7.8 are still on 2.3.9_3.
Any chance to get it into 26.7.9? Happy to test right away - NAT-PMP is still off here as a workaround.
Thanks!
quick follow-up: FreeBSD ports got net/miniupnpd 2.3.11 on Oct 16 (rcmcdonald91), which includes the delete_nat_rule() fix (463ec13). opnsense/ports and 26.7.8 are still on 2.3.9_3.
Any chance to get it into 26.7.9? Happy to test right away - NAT-PMP is still off here as a workaround.
Thanks!
#3
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by ab - October 31, 2026, 11:46:29 PMLikely a regression in https://github.com/opnsense/core/commit/b64be86839271b108e0c140fb53349303ddb6d5c
#4
26.7, 26.10 Series / Re: Unable to import Trust Aut...
Last post by ab - October 31, 2026, 11:38:48 PMI think I've hit the same issue. I'm trying to migrate from using os-acme-client to injecting certs from outside using the API. I can import a new leaf cert, but I cannot add any of the Let's Encrypt intermediate CAs. As a result, the web server serves only the leaf cert without any intermediates, and non-browser clients (e.g. curl) can't validate it.
Repro instructions from the UI:
1. Navigate to System: Trust: Authorities
2. Click Add
3. Choose "Import an existing Certificate Authority"
4. Enter a description, paste the single cert below into the Certificate data field, and leave the private key data blank
5. Click Save
This results in the error: "Only a single private key is allowed (found 0 sections)"
Needless to say, I don't have the key for this cert.
-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
-----END CERTIFICATE-----
Repro instructions from the UI:
1. Navigate to System: Trust: Authorities
2. Click Add
3. Choose "Import an existing Certificate Authority"
4. Enter a description, paste the single cert below into the Certificate data field, and leave the private key data blank
5. Click Save
This results in the error: "Only a single private key is allowed (found 0 sections)"
Needless to say, I don't have the key for this cert.
-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
-----END CERTIFICATE-----
#5
26.7, 26.10 Series / Re: Crash report: PHP unable t...
Last post by (MARLOO) - October 31, 2026, 11:21:20 PMQuote from: nero355 on October 31, 2026, 10:05:47 PMIt's documented here : https://www.zenarmor.com/docs/guides/best-practices-for-zenarmor-deployment#reporting-database
Thanks Nero355 this is exacltly the link
Also Remote Elasticsearch must be between 8.9.x and 8.17.1, so not "any 8.x".
The leftover mongodb.so is normal. Older ZenArmor versions installed MongoDB automatically on firewalls with 2–4 GB of RAM max.
Quote from: mimugmail on October 31, 2026, 10:57:33 PMBuilding still fails...
Is the report new or old?
Try this order
Reboot once and check whether the report timestamp stops
If it keeps coming
----------------------------
pkg info | grep -i mongo
-------------------------------
Then find the leftover line
-----------------------------------------------------------------------------
grep -rn mongodb /usr/local/etc/php.ini /usr/local/etc/php/extensions.ini
-----------------------------------------------------------------------------
Remove it and reload PHP
-----------------------------------------------------------------------------
sed -i '' '/mongodb\.so/d' /usr/local/etc/php.ini /usr/local/etc/php/extensions.ini
configctl webgui restart
-------------------------------------------------------------------------------------
do you have a second backend or a legacy plugin installed — old Sensei, or a community plugin that still pulls php85-pecl-mongodb as a dependency?
#6
26.7, 26.10 Series / cve-2026-98432 (linux behind o...
Last post by paepcke - October 31, 2026, 11:11:20 PMhttps://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets
Is there away to identify and drop all impacted packets? With nft i can do ...
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)
Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )
- does not impact FreeBSD
- does impact every Linux behind your (OPNSense-) Firewall that accepts TCP packets
Is there away to identify and drop all impacted packets? With nft i can do ...
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
From my understanding:
- pf scrub does not care for tcp (options)
- pf is not able to identify tcp options
- ipfw can (but only well known specific, but can not scrub unknown? maybe by tcp header lenght?)
- firewall chaining is not recommended
- firewall chaining is not part of opnsense (but can be done via script manually)
Any other options/ ideas ? (other than chain/migrate to nft based firewall or dump the complete traffic through ids / suricate screen? )
#7
General Discussion / Re: nfSensei ( fork pfsense )
Last post by mimugmail - October 31, 2026, 11:04:45 PMWhats the problem if its open or not?
If just one more competitor which is good for business :)
If just one more competitor which is good for business :)
#8
26.7, 26.10 Series / Re: Crash report: PHP unable t...
Last post by mimugmail - October 31, 2026, 10:57:33 PMGlad it wasnt community repo :)
Building still fails...
Building still fails...
#9
Hardware and Performance / Re: Semi parts bin new build
Last post by opnsenseguy - October 31, 2026, 10:32:57 PMAny recommended CPU or motherboard recommendations? I realize there is a million options but wondering if there are some great options that offer a good value for money spent and energy efficient.
#10
26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...
Last post by nero355 - October 31, 2026, 10:11:50 PMQuote from: danmac on October 31, 2026, 06:01:04 AMGetRightI understood this reference without looking it up!
LOL! ^_^
/AlsoDamnOld
