"Recent posts
#1
26.7, 26.10 Series / Re: No link with Intel E810 on...
Last post by redge - Today at 01:18:11 AMEssentially the same experience as @mehrmann in #36 on a DEC3960 after upgrading from BE 26.4 -> 26.10.
Link partner is a Juniper EX4400-24X with the EX4400-EM-4Y expansion module installed, connected via SFP28 DAC. The DACs are coded for Intel on one end, Juniper on the other, and worked until the update.
As with the other cases mentioned here, disabling DDP brought the links back up. Requesting RS-FEC wasn't successful, but FC-FEC/BASE-R works with DDP enabled.
Code Select
dev.ice.0.fw_version: fw 7.3.4 api 1.7 nvm 4.30 etid 8001af27 netlist 4.2.5000-1.12.0.87fd3c77 oem 1.3429.0
dev.ice.0.ddp_version: ICE OS Default Package version 1.3.41.0, track id 0xc0000001
Link partner is a Juniper EX4400-24X with the EX4400-EM-4Y expansion module installed, connected via SFP28 DAC. The DACs are coded for Intel on one end, Juniper on the other, and worked until the update.
As with the other cases mentioned here, disabling DDP brought the links back up. Requesting RS-FEC wasn't successful, but FC-FEC/BASE-R works with DDP enabled.
#2
Russian - Русский / Re: os-amneziawg — плагин Amne...
Last post by crash88 - Today at 12:42:54 AMПри установке на голую opnsense получаю следующее:
sh install.sh
============================================================
opnsense-awg v2.3.1 / AWG latest compatible 3.x
============================================================
==> Resolving latest compatible AWG 3.x packages...
[OK] Latest kmod: 3.1.20260906
[OK] Latest tools: 3.1.20260812
==> Downloading resolved AWG release packages and checksums...
[OK] Release assets, checksum files and package manifests verified
==> Stopping plugin-managed tunnels...
pkg-static: Missing dependency 'bash'
ERROR: Failed to install opnsense-awg-tools-3.1.20260812.pkg
WARNING: Installation failed; rolling back the previous AWG stack and plugin.
WARNING: Rollback completed. Recovery directory retained: /tmp/opnsense-awg-v2.7DwPG9
В чем пробема?
sh install.sh
============================================================
opnsense-awg v2.3.1 / AWG latest compatible 3.x
============================================================
==> Resolving latest compatible AWG 3.x packages...
[OK] Latest kmod: 3.1.20260906
[OK] Latest tools: 3.1.20260812
==> Downloading resolved AWG release packages and checksums...
[OK] Release assets, checksum files and package manifests verified
==> Stopping plugin-managed tunnels...
pkg-static: Missing dependency 'bash'
ERROR: Failed to install opnsense-awg-tools-3.1.20260812.pkg
WARNING: Installation failed; rolling back the previous AWG stack and plugin.
WARNING: Rollback completed. Recovery directory retained: /tmp/opnsense-awg-v2.7DwPG9
В чем пробема?
#3
26.7, 26.10 Series / Re: Unable to upgrade to base-...
Last post by OPNenthu - November 08, 2026, 11:27:20 PMLooks like my modem needed a reboot. IPv6 gateway is back. Closing.
#4
26.7, 26.10 Series / Re: Unable to upgrade to base-...
Last post by OPNenthu - November 08, 2026, 11:13:14 PMOk, I just noticed the IPv6 gateway is down. Switched on "Settings->General->Prefer IPv4 over IPv6" and the updates completed successfully.
Is there a known issue with DHCPv6? I've been away for a few weeks.
Is there a known issue with DHCPv6? I've been away for a few weeks.
#5
26.7, 26.10 Series / [solved] Unable to upgrade to ...
Last post by OPNenthu - November 08, 2026, 11:02:15 PMHi all,
I'm trying to upgrade 26.7.7 to 26.7.8_2 and the base package is failing with:
I tried with two mirrors so far, official and LeaseWeb US in Washington, DC. The other packages updated fine and the running OPNsense version is already bumped to 26.7.8_2, but the base and kernel package updates are outstanding.
I'm trying to upgrade 26.7.7 to 26.7.8_2 and the base package is failing with:
Code Select
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.8_2 (amd64) at Sun Nov 8 16:47:57 EST 2026
Updating OPNsense repository catalogue...
Waiting for another process to update repository OPNsense
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (177 candidates): .......... done
Processing candidates (177 candidates): . done
Checking integrity... done (0 conflicting)
Your packages are up to date.
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
Nothing to do.
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
Fetching base-26.7.8-amd64.txz: ................................[fetch: transfer timed out
fetch: /var/cache/opnsense-update/51236/base-26.7.8-amd64.txz.sig appears to be truncated: 0/1332 bytes] failed, no signature found
***DONE***
I tried with two mirrors so far, official and LeaseWeb US in Washington, DC. The other packages updated fine and the running OPNsense version is already bumped to 26.7.8_2, but the base and kernel package updates are outstanding.
#6
26.7, 26.10 Series / Re: Is sloppy state tracking a...
Last post by nero355 - November 08, 2026, 10:59:11 PMQuote from: muchacha_grande on November 08, 2026, 09:48:02 PMThank you for pointing this out.It seems like it's time to apply Policy Base Routing on your Server then :)
This is how it looks in my case :
Code Select
# ip rule show
0: from all lookup local
1: from 192.168.1.2 lookup 100 proto static
32766: from all lookup main
32767: from all lookup default&Code Select
# ip route show table 100
10.0.0.0/24 via 192.168.1.1 dev eth0 proto static scope siteThis is to avoid the SSH session to time-out when connecting from a host in 10.0.0.0/24 to a SSH Server in 192.168.1.0/24 that has Interfaces in both subnets as shown in my previous reply :)I have read a lot about this, but in the end all that I needed turned out to be the above! LOL!
#7
26.7, 26.10 Series / Re: Is sloppy state tracking a...
Last post by muchacha_grande - November 08, 2026, 09:48:02 PMQuote from: nero355 on November 08, 2026, 06:27:49 PMSounds like A-Symmetric Routing issues and the "Default DENY / State violation Rule" is always right in my experience :)
Hi nero355. As the proxmox I'm talking about has 2 interfaces, it could be possible that packets returns from a different interface than the one packets arrived, so it could be possible that it's a case of asymmetric routing.
Thank you for pointing this out.
EDIT:
I've found this, based on nero355s statement: https://forum.proxmox.com/threads/tcp-streams-drop-between-proxmox-vlans-routed-via-virtual-pfsense.134496
#8
Portuguese - Português / Re: [RESOLVIDO] Estações não n...
Last post by taapuri - November 08, 2026, 08:42:37 PMComo o problema volta de vez em quando e só resolve reiniciando, eu tentaria verificar se há alguma falha no gateway ou no monitoramento da WAN, além das regras de firewall. Quando a navegação parar, vale testar o ping pelo próprio OPNsense e pelas estações, tanto para um IP externo quanto para um domínio. Assim dá para identificar se é perda de conectividade, DNS ou algum problema no gateway. Se possível, compartilhe também os prints das configurações de WAN e dos gateways para facilitar a análise.
#9
Intrusion Detection and Prevention / Re: Switch from IDS to IPS
Last post by BoNetTech - November 08, 2026, 08:18:13 PMYes, there is a way to change them all at once, and the recommended way is a policy, not per-rule changes.
1. Policy (Services > Intrusion Detection > Administration > Policy tab)
– Add a policy, select the rulesets you want to act on (e.g. the ET ones you use), and set Action = Drop (and "New action" = Drop if your version asks for it).
– Policies are applied on top of the rules and survive ruleset updates, so you don't have to touch every rule.
– You can narrow it down by rule metadata (e.g. only "emerging-malware"), which is a good way to start with a small group of rules instead of everything.
2. Rules tab (alternative)
– In the Rules tab you can filter the list, select all the filtered rows with the checkbox in the header and use the buttons for the selected rules (Alert/Drop, if your version has them). This works for one-off changes, but a policy is easier to maintain.
3. Before enabling IPS mode
– IPS mode needs a network card driver that supports netmap. Disable hardware offloading (CRC, TSO, LRO) in Interfaces > Settings.
– Set IPS mode on the physical interface, not on a VLAN (check the docs: docs.opnsense.org/manual/ips.html).
– Don't switch all rules to Drop on day one: a dropped legitimate connection is hard to diagnose. Start with a few rule categories, watch the Alerts tab for a few days and widen later. Keep a config backup so you can go back.
Sergio
1. Policy (Services > Intrusion Detection > Administration > Policy tab)
– Add a policy, select the rulesets you want to act on (e.g. the ET ones you use), and set Action = Drop (and "New action" = Drop if your version asks for it).
– Policies are applied on top of the rules and survive ruleset updates, so you don't have to touch every rule.
– You can narrow it down by rule metadata (e.g. only "emerging-malware"), which is a good way to start with a small group of rules instead of everything.
2. Rules tab (alternative)
– In the Rules tab you can filter the list, select all the filtered rows with the checkbox in the header and use the buttons for the selected rules (Alert/Drop, if your version has them). This works for one-off changes, but a policy is easier to maintain.
3. Before enabling IPS mode
– IPS mode needs a network card driver that supports netmap. Disable hardware offloading (CRC, TSO, LRO) in Interfaces > Settings.
– Set IPS mode on the physical interface, not on a VLAN (check the docs: docs.opnsense.org/manual/ips.html).
– Don't switch all rules to Drop on day one: a dropped legitimate connection is hard to diagnose. Start with a few rule categories, watch the Alerts tab for a few days and widen later. Keep a config backup so you can go back.
Sergio
#10
Tutorials and FAQs / Re: OPNsense aarch64 firmware ...
Last post by Maurice - November 08, 2026, 06:36:01 PMThe build process is the same as on amd64, which is documented in the opnsense/tools readme.
My customizations of the core package are in this single commit:
https://github.com/maurice-w/opnsense-core/commit/d49ef76
If you only build it for yourself, you don't even have to patch core. You can add the fingerprints manually instead.
But the initial setup is the (relatively) easy part. Frequently updating, building, testing and publishing everything is quite a bit of work and can't be fully automated. Having to troubleshoot build issues is not uncommon. The core team only builds it for amd64, so issues specific to aarch64 typically go unnoticed by them (understandably). And each build takes about half a day on a beefy aarch64 machine.
Everyone doing this for themselves for every single upgrade, update and hotfix would be unreasonable. The point of having a public package repo is to centralize these efforts.
There are other public OPNsense aarch64 repos, like yrzr's - my repo wouldn't exist without their pioneering work. But as far as I'm aware, mine is the only one which gets updated frequently. And I understand why, it is a real commitment.
Cheers
Maurice
My customizations of the core package are in this single commit:
https://github.com/maurice-w/opnsense-core/commit/d49ef76
If you only build it for yourself, you don't even have to patch core. You can add the fingerprints manually instead.
But the initial setup is the (relatively) easy part. Frequently updating, building, testing and publishing everything is quite a bit of work and can't be fully automated. Having to troubleshoot build issues is not uncommon. The core team only builds it for amd64, so issues specific to aarch64 typically go unnoticed by them (understandably). And each build takes about half a day on a beefy aarch64 machine.
Everyone doing this for themselves for every single upgrade, update and hotfix would be unreasonable. The point of having a public package repo is to centralize these efforts.
There are other public OPNsense aarch64 repos, like yrzr's - my repo wouldn't exist without their pioneering work. But as far as I'm aware, mine is the only one which gets updated frequently. And I understand why, it is a real commitment.
Cheers
Maurice
