Recent posts

#1

26.7 Series / Re: OPNsense 26.7.4 - VLAN tra...

Last post by merrins63 - September 29, 2026, 11:06:34 PM

I have got a question that really bugs me :

Why would you do this =>

I also have an Intel i226 2.5 GbE trunk, with corresponding VLAN interfaces bridged to the X550/LAGG VLAN interfaces.

Aren't you effectively Bridging 2x 2,5 Gbps with 2 x 10 Gbps ?!

What is the purpose of such a setup ??

The issue I'm trying to solve with this design is mainly about making the best use of the different network speeds available in my home.

I have a traditional 1 GbE wired network, which is perfectly adequate for many of my wired IoT devices. However, my wireless access points and newer switches are capable of 2.5 GbE.

I need my wired and wireless IoT devices to remain on the same VLANs and subnets, while allowing the 2.5 GbE side of the network to make use of the faster interfaces rather than forcing everything through the existing 1 GbE switching infrastructure.

I'm also planning to upgrade my Internet connection to 2000/200 in the next few months, and I already have several multi-gigabit devices that will be able to take advantage of that bandwidth.

Previously, I used the more traditional approach of a single 24-port Gigabit Ethernet switch. However, with affordable 2.5 GbE switches now readily available, I wanted to take advantage of the Cat6A cabling already installed throughout my house.

The important point is that this design isn't intended for redundancy. The objective is to utilise the available 1 GbE and 2.5 GbE links efficiently while keeping devices within their existing VLANs.

Using bridged VLAN interfaces on OPNsense allows me to achieve that design.

Hopefully that explains the reasoning behind my setup a little better.

[any]

#2

26.7 Series / Re: OPNsense 26.7.4 - VLAN tra...

Last post by merrins63 - September 29, 2026, 11:05:40 PM

These definitions match the interface configuration. I am out of ideas ... er ... one moment ...

Did you check this option?



If you did not that would perfectly explain your observed symptoms.

ISC creates the necessary firewall rules for DHCP to work by default, if I remember correctly. For Kea that's optional, because some users complained that OPNsense should not create any rules automatically giving full control to the admin.

These definitions match the interface configuration. I am out of ideas ... er ... one moment ...

Did you check this option?



If you did not that would perfectly explain your observed symptoms.

ISC creates the necessary firewall rules for DHCP to work by default, if I remember correctly. For Kea that's optional, because some users complained that OPNsense should not create any rules automatically giving full control to the admin.

Yes this setting was already enabled by default. I turned it off, applied the settings then re enabled it

It made no difference and behaviour using Kea DHCP still persists

Cheers

#3

26.7 Series / Re: Android IPv6 issues: In my...

Last post by astronaut - September 29, 2026, 10:11:14 PM

Some of those things can run alternative software like :
- UBPorts Ubuntu Touch
- Jolla SailFish
- PostmarketOS

Maybe IPv6 works a lot better in one of those ?! :)

My tinkering time budget is already allocated to other things, therefore I am currently not considering switching to any of these.

Beyond that, I expect that when I use one of those alternative OSs, I might end up with a perfectly running IPv6 network, but with not much to use it for (except a browser, perhaps.) I do make use of more or less well designed apps on my smartphone, and I assume that the majority of apps is not available on these OSs. Or is my assumption wrong?

Anyway, thanks for the advice. :-)

[Network setup]

#4

26.7 Series / Re: Connections suddenly block...

Last post by BoerBart - September 29, 2026, 08:33:36 PM

Post your network setup and all the Firewall Rules for the LAN Interface.

Is the Mini PC a Single NIC model or Dual/Quad NIC ?


And in general : The more info you provide, the less guessing we all have to do! ;)

Sure - I'll do my best in providing what's needed; I don't have much experience networking-wise, so it's a bit of guessing what is needed.

Network setup
Modem of provider --> TP-Link archer AX50 (bridge mode) --> TP-Link TL-SG108E switch --> single NIC Mini PC.

Switch port layout
Port 1 is TP-Link archer AX50
Port 2 is Single NIC Mini PC #1
Port 2 is Single NIC Mini PC #2

Switch VLAN (802.1Q) configuration

Code Select Expand

VLAN ID     VLAN Name     Member Ports     Tagged Ports     Untagged Ports
1     Default     1-8    1-8   
5     Redacted    2-3    2-3       
10    Redacted    2-3    2-3       
15    Redacted    2-3    2-3       
20    Redacted    2-3    2-3       
25    Redacted    2-3    2-3       
30    Redacted    2-3    2-3       
50    Redacted    2-3    2-3       
80    Redacted    2-3    2-3       
101   Redacted    2-3    2-3       
110   Redacted    2-3    2-3       
111   Redacted    2-3    2-3       
All firewall rules that are either directly on the LAN interface, or the rule itself contains multiple interfaces, including LAN, are exported to a csv file that can be downloaded here:
https://filebin.net/aer3hx75u8wj72il

If more information is needed - happy to deliver more. I've restarted all devices/networking equipment earlier today without luck.

#5

26.7 Series / Re: Connections suddenly block...

Last post by nero355 - September 29, 2026, 07:08:11 PM

Post your network setup and all the Firewall Rules for the LAN Interface.

Is the Mini PC a Single NIC model or Dual/Quad NIC ?


And in general : The more info you provide, the less guessing we all have to do! ;)

#6

26.7 Series / Re: Android IPv6 issues: In my...

Last post by nero355 - September 29, 2026, 07:00:02 PM

My Android device is a Fairphone 6.

Some of those things can run alternative software like :
- UBPorts Ubuntu Touch
- Jolla SailFish
- PostmarketOS

Maybe IPv6 works a lot better in one of those ?! :)

#7

Dutch - Nederlands / Re: Chromebook van school op t...

Last post by nero355 - September 29, 2026, 06:56:30 PM

Tja, DoT/DoH is altijd ellende...

Ik ken die dingen niet echt, maar ik weet wel dat op het moment dat je zegt dat ze van een School/Bedrijf zijn dat je kans hebt dat ze aan een of andere "Beheerserver" vast zitten en je dus 'User vs. Admin/Root rechten' problemen kan verwachten.

Heeft dat ding iets van een Console/Terminal waarmee je wat dingen kan checken ?!
- Ping op IP
- Ping of Domeinnaam
- Hetzelfde met Traceroute
- En eventueel nog wat nslookup/dig/drill dingetjes...

[no_proxy=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.unseredomain.de]

#8

German - Deutsch / Re: OPNcentral hält sich nicht...

Last post by Stephan M. - September 29, 2026, 06:17:47 PM

Nach Tagen der Fehlersuche lag es dann schlicht und ergreifend an den Anführungszeichen.
Also hier für Alle, die zukünftig auf das Problem stoßen!


Korrekt funktioniert folgendes: no_proxy=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.unseredomain.de


Im OPNcentral muss es wie folgt konfiguriert werden:

# /usr/local/opnsense/service/conf/configd.conf.d/proxy.conf

Code Select Expand

[environment]
HTTP_PROXY=http://10.19.241.33:3128
HTTPS_PROXY=http://10.19.241.33:3128
http_proxy=http://10.19.241.33:3128
https_proxy=http://10.19.241.33:3128
FTP_PROXY=http://10.19.241.33:3128
ftp_proxy=http://10.19.241.33:3128
NO_PROXY=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.unseredomain.de
no_proxy=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.unseredomain.de


Beste Grüße und viel Erfolg!

#9

26.7 Series / Connections suddenly blocked o...

Last post by BoerBart - September 29, 2026, 06:09:25 PM

I've been using OPNsense for about two years now, never had any issue, until a few days back. I've set up a few VLANs in OPNsense that are all functioning properly, but I'm having issues on the LAN interface since recently. My idea is that the issue started either because of:

- An OPNsense update;
- Using the rule migration tool.

OPNsense version: 26.7.4_1
Architecture: amd64
Updated on: Sun Sep 20 15:14:10 UTC 2026

I'm running two Peladn N95 nodes in Proxmox, both are fully up-to-date as well.
Firmware version of the Peladn network devices: rtl8168h-2_0.0.2 02/26/15

The two peladn nodes, my PC, phone and such are all on the same LAN interface. OPNsense is running on a VM in the Proxmox cluster, i've got quite a few other containers/VMs running, each in several VLANs. Two days ago (after running the migration tool), I noticed that the internet on my phone got spotty, and today i've noticed it on my PC. When looking at the firewall logs, I noticed that (randomly to me) connections are being dropped, though not all. A page or Whatsapp message sometimes loads/gets delivered, and the next time it keeps loading/sending. Here are the output details for one of them of the Live View:
 

Code Select Expand

__timestamp__ 2026-09-29T15:48:11
ack 3901492930
action [block]
anchorname
datalen 39
dir [in]
dst 34.54.185.247
dsthostname
dstport 443
ecn
id 13033
interface vtnet0
ipflags DF
ipversion 4
label Default deny / state violation rule
length 91
offset 0
protoname tcp
protonum 6
reason match
rid 02f4bab031b57d1e30553ce08e0ec131
rulenr 13
seq 3881579953:3881579992
src 192.168.1.225
srchostname
srcport 40708
status 2
subrulenr
tcpflags PA
tcpopts
tos 0x0
ttl 64
urp 63

When looking at Firewall -> Diagnostics -> Statistics -> Rules, my assumption that this is rule 13:

Code Select Expand

@13 block drop in log inet all label "02f4bab031b57d1e30553ce08e0ec131"

    15
    :
     
    59
    :
     25 2026
    evaluations
    :
     11538
    packets
    :
     1700
    bytes
    :
     171359
    states
    :
     0
    nodes
    :
     0
    limit
    :
     0
    nat/rdr
    :
     0
    route
    :
     0
    inserted
    :
     uid 0 pid 0
    state_creations
    :
     0
    time
    :
     tue sep 29
This issue only happens on the LAN interface, all other interfaces are running just fine. I can't seem to figure out what I can do to solve this. I do not have any other rules that block traffic on the LAN interface.

#10

26.7 Series / Android IPv6 issues: In my cas...

Last post by astronaut - September 29, 2026, 05:49:25 PM

Hi,

there are numerous posts on Android IPv6 issues (lost access, lost gateway, timeout issues etc.) in the OPNsense forum:

https://forum.opnsense.org/index.php?topic=51298.msg262792#msg262792

https://forum.opnsense.org/index.php?topic=43034.msg213764#msg213764

https://forum.opnsense.org/index.php?topic=53043.0

There is an extensive how-to from meyerguru on IPv6 topics in general:

https://forum.opnsense.org/index.php?topic=45822.0

I myself was plagued from annoying IPv6 issues on my Android smartphone (the only Android device in my network) for some time: My device lost its IPv6 connection after some time, and some apps didn't work or timed out. A new connection (e. g. by turning WiFi off/on) solved this issue temporarily. All other operating systems (iOS, Linux, Windows, FreeBSD) are working normally. After having read the above posts, I blamed OPNsense and/or FreeBSD for these issues. I tried a lot of different things to solve this on the OPNsense side, with no success. Turns out this was wrong, in my case, it was an Android driver issue.

My Android device is a Fairphone 6. I found a thread in the Fairphone forum where a lot of users complained about IPv6 issues:

https://forum.fairphone.com/t/dns-over-tls-ipv6-issues-apps-dont-load-data-over-wifi/130519/542

It's a very long thread, but the issues seem at least similar to what I have read in the OPNsense forum posts. It seems that there is an issue with the Android WiFi driver:

https://github.com/LineageOS/android_device_fairphone_FP6/commit/768592057b3c1a457f7a0134ef157336f01319ee

Today, a firmware update for the Fairphone 6 was released, which seems to solve the IPv6 issues on my device.

Now, I am not saying that all mentioned IPv6 issues in a OPNsense managed IPv6 network stem from faulty Android drivers, but I wanted to point out that this is at least a possibility to consider.

I hope this helps.

Best regards,

Astronaut

P.S. OPNsense rocks!