Recent posts

#1

26.7 Series / Re: add blocking working over ...

Last post by krissilon - Today at 08:50:41 AM

Thank you and will try this as well!  Great support on this forum for a newbie, appreciate!

#2

German - Deutsch / Re: 'Migration Assistant ' der...

Last post by OPNjk - Today at 08:19:41 AM

Ich habe die XMLs beider Firewalls verglichen: die aktive hat die alten Firewall-Rules (<filter>) und die alten Outbound-NAT (<nat><outbound>) Tags komplett leer, während die inaktive Firewall die Teile noch komplett hat. Der Migrations-Assistent auf der inaktiven Firewall exportiert auch genau diese Teile in das CSV.

Ich werde in der GUI den letzten Schritt des Migration-Assistant testen, um die Rules/Outbound-NAT zu löschen. Wenn das nicht geht, dann editiere ich das XML ;-) Mich wundert irgendwie, dass bis auf den unkommentierten GitHub-Bug hier im Forum nichts dazu steht (bzw. habe ich nichts gefunden).

#3

26.1, 26,4 Series / Re: File truncated, kernel/bas...

Last post by drosophila - Today at 03:22:10 AM

You may be having an MTU / MSS issue. IPv6 doesn't have working PMTU discovery yet, but it's header is longer than the IPv4 one, which needs to be accounted for. IPv6 also cannot fragment packets mid-flight, which further complicates things. Intermediate routers may have arbitrarily low MTUs, down to 1200 IIRC, which is much less than the usual 1400+ of IPv4. Add to this the tunnel and you are going down a lot. You can try hard-setting some low MTU size like, say, 800, on the WAN interface and see if things start working then. If so, you can gradually increase it until you hit "your" personal MTU max. This, however, is best tested with leaving the MTU on WAN at default values and instead using, on the command line, "ping6 -s 800 www.google.com" (where the 800 is the packet size to be tested; you'll likely arrive at something around 1180, so you can choose your increments accordingly). Note the "6" in "ping6" since without it, you use IPv4 and thus invalidate the result.

#4

26.1, 26,4 Series / Re: File truncated, kernel/bas...

Last post by newsense - Today at 01:58:21 AM

First disable IPv6 on wan and try to complete the upgrade

Everything else's secondary

#5

German - Deutsch / Re: 'Migration Assistant ' der...

Last post by drosophila - September 21, 2026, 11:57:06 PM

Du könntest mal schauen, was im exportierten .csv ankommt. Möglicherweise braucht wirklich nur der letzte Punkt "alte Regeln löschen" ausgeführt zu werden, vielleicht sogar nur, um der GUI zu sagen, daß das erledigt ist.

#6

Development and Code Review / Re: netflector available as pl...

Last post by UnicronHD - September 21, 2026, 11:54:28 PM

Great, The plugin 0.1.6 with netflector 0.16.0 is installed and working perfectly here.

Thanks again for all the work and support!

Happy to help, thanks for the idea and all the testing.

#7

26.7 Series / Re: Firewall rules [new] missi...

Last post by drosophila - September 21, 2026, 11:47:59 PM

Maybe whatever piece of how-to you got these information from should be updated to include that [new] only appears between 26.1 and 27.x, and that the steps work wothout installing the plugin (as they seem to do, as I gather from your report). There seem to be a bunch of "appliance users" around who will eventually stumble across this issue during the coming ages. ;)

#8

26.7 Series / Re: Need to set "far gateway" ...

Last post by drosophila - September 21, 2026, 11:37:28 PM

No idea what causes this to break now; I kept "Far gateway" checked and it hasn't failed ever since. Maybe the code that makes it work in my case is the path that actually sets the address if both "fargw" is set and ipprotocol is ipv6 (in line 780)? It unconditionally deletes it in line 774 but the syntax explicitly used in 782 differs from what I expect will appear in 794?

#9

26.7 Series / Re: Ddclient - no global IP ad...

Last post by drosophila - September 21, 2026, 11:07:10 PM

As stupid as it sounds: wait until it fixes itself. I had the same issue during the last weeks with dynv6.com: first, the addresses kept resolving to the old one, then after a few days the entire hostname resolution failed. Luckily, the IPv4 fallback had come back from a similar failure a month ago, so I postponed the troubleshooting, and just today, the hostname came back online. My experience is that these dynamic DNS providers tend to have such issues every couple years, and unless you have some sort of priority access, you can only wait them out.

The only thing you could try on your end is to change the way your ddns client figures out its address, so, change the interface to monitor between "WAN" and the interface name (idk if you actually can enter this there), and also the "Check IP method". Maybe the provider you chose for that is down.

#10

26.1, 26,4 Series / Re: Zenarmor 2.6.2: worker0 ha...

Last post by nero355 - September 21, 2026, 10:30:43 PM

during that time the kernel logs netmap_transmit igc1 full and traffic through the interface stalls

- Intel Celeron N5100 (4 cores), 7.8 GB RAM, Intel I226-V (igc), XGS-PON ~900/900 Mbit

20:12:46–20:13:04  kernel: netmap_transmit igc1 full ...   (2 lines/s, ~19 s)

20:13:04–20:13:19  kernel: generic_netmap_unregister/dtor/attach ... "Emulated adapter for igc1" deactivated → created → activated

- Earlier I also had bursts of UDPConnectionFlow::connect ... UDP flow connect failed: Address already in use / EastpectInstance::onAcceptUDP New UDP flow connect failed (98% in minute :09–:12) from one server VM; excluding that host removed those errors, but the worker hangs remain.

All of that sounds to me like you need to take a look at this topic : https://forum.opnsense.org/index.php?topic=48695.0

But I could be horribly wrong because I don't use ZenArmor so please read the complete topic and then decide what to do !! ;)