"Recent posts
#1
26.7 Series / Another 26.7 "Upgrade Failed" ...
Last post by Kevin G. - Today at 08:59:07 PMNew to the forums, I did check many other previous posts. Have been searching for over a week. Attempted the upgrade last weekend, trying to revisit this weekend...
From My Reddit Post:
Baremetal, i5/3rd Gen, 16GB Ram. ZFS
I have been sweating the update for weeks. Saw several posts and prepared myself the best I could. Attempted the upgrade tonight and lost all connectivity. Build: ZFS (snapshot before upgrade), never had microcode plugin installed, Legacy ISC, simple rules migrated over, backed up Config. Began the upgrade.
Got stuck in a "rebooting now" and returning to the Lobby/Dashboard loop, assumed the update failed. Started to disconnect to add my ISP/backup router back in to troubleshoot, decided to manually reboot the Opnsense box, patiently waited, and heard the boot chime. Logged in from my daily driver desktop, and saw the new dashboard with 26.7.1. Loaded rules via the migration tool, verified they were there, deleted "Legacy Rules" via the tool. Success! ...Nope, no devices on my network receiving any connection. I cannot find the issue, but the Live logs show no traffic being let in whatsoever (all blocked).
I have no clue how to install the bootloader to the secondary drive. Reading tons on it, but just don't understand any of it.
Switched to my backup/ISP provided router, for now...hope to dive in some more tomorrow.
Any insights would be great.
Feels like this is simply a rules issue, but don't know where to begin.
If I need a fresh install, that isn't a big deal, I just have a few questions.
Will I still be able to migrate my old rules?
Are there "new" default rules with a fresh install?
Will my old 26.1 config files work with a fresh install of 26.7 (Legacy ISC and Legacy Rules)? I hope to migrate to dnsmasq, but would prefer to be running first.
From My Reddit Post:
Baremetal, i5/3rd Gen, 16GB Ram. ZFS
I have been sweating the update for weeks. Saw several posts and prepared myself the best I could. Attempted the upgrade tonight and lost all connectivity. Build: ZFS (snapshot before upgrade), never had microcode plugin installed, Legacy ISC, simple rules migrated over, backed up Config. Began the upgrade.
Got stuck in a "rebooting now" and returning to the Lobby/Dashboard loop, assumed the update failed. Started to disconnect to add my ISP/backup router back in to troubleshoot, decided to manually reboot the Opnsense box, patiently waited, and heard the boot chime. Logged in from my daily driver desktop, and saw the new dashboard with 26.7.1. Loaded rules via the migration tool, verified they were there, deleted "Legacy Rules" via the tool. Success! ...Nope, no devices on my network receiving any connection. I cannot find the issue, but the Live logs show no traffic being let in whatsoever (all blocked).
I have no clue how to install the bootloader to the secondary drive. Reading tons on it, but just don't understand any of it.
Switched to my backup/ISP provided router, for now...hope to dive in some more tomorrow.
Any insights would be great.
Feels like this is simply a rules issue, but don't know where to begin.
If I need a fresh install, that isn't a big deal, I just have a few questions.
Will I still be able to migrate my old rules?
Are there "new" default rules with a fresh install?
Will my old 26.1 config files work with a fresh install of 26.7 (Legacy ISC and Legacy Rules)? I hope to migrate to dnsmasq, but would prefer to be running first.
#2
German - Deutsch / Re: Two Factor Authentication ...
Last post by jd7 - Today at 08:27:55 PM@Monvievh: Sorry, mache das beruflich ;-). Nur statt IT im Bereich Automotive mit Automobilhersteller und -zulieferer.
#3
26.7 Series / update 26.7.1 to 26.7.2 fails,...
Last post by knowHoff - Today at 08:04:40 PMGood evening,
after doing the upgrade today from
26.7.1 to 26.7.2,
my system fails while trying to boot.
The only output I see is the one shown here
You cannot view this attachment.
I am able to access a boot prompt.
The only answer I get after typing "boot" is from gptboot, which is not applicable on a CSM / legacy boot system.
You cannot view this attachment.
Is there any possibility to recover the installation
or do I have to clean install?
Cheers
after doing the upgrade today from
26.7.1 to 26.7.2,
my system fails while trying to boot.
The only output I see is the one shown here
You cannot view this attachment.
I am able to access a boot prompt.
The only answer I get after typing "boot" is from gptboot, which is not applicable on a CSM / legacy boot system.
You cannot view this attachment.
Is there any possibility to recover the installation
or do I have to clean install?
Cheers
#4
26.7 Series / Re: 26.7 upgrade failure - ope...
Last post by vplanida - Today at 07:59:39 PMHello. I'm here to one up the problem.
I have a really old install of a system. 4-5 years old opnsense install updated to a current (previous) release with all the plugins and firewall rules from way back when.
Tried to upgrade my system from 26.1.11_10 to 26.7 or 26.7.2 but nothing came back in 30 minutes after reboot. Went on and did the physical reboot.
Against all odds, the system booted up again and let me in the dashboard. In the dashboard it is said to be version 26.1.11_10.
Checking for updates in the dashboard does nothing. Updater told me that "pkg: Repository OPNsense has a wrong packagesite".
Google told me to "opnsense-update -p -A 26.7", which I did and came to an error brought up by this post.
Deleting the realtek 1.0 plugin moved things forward.
At some point console updater command saw horrors beyond human comprehention.
After repeating the console command I managed to pull through with a dashboard update.
But updater still was unable to do miracles. So I am doing what it said and came here to report on it.
https://pastebin.com/8rm6jLr2
At this point I'm probably going to do a clean reinstall when I get back to it. I just felt that I had to report on possible causes.
I have a really old install of a system. 4-5 years old opnsense install updated to a current (previous) release with all the plugins and firewall rules from way back when.
Tried to upgrade my system from 26.1.11_10 to 26.7 or 26.7.2 but nothing came back in 30 minutes after reboot. Went on and did the physical reboot.
Against all odds, the system booted up again and let me in the dashboard. In the dashboard it is said to be version 26.1.11_10.
Checking for updates in the dashboard does nothing. Updater told me that "pkg: Repository OPNsense has a wrong packagesite".
Google told me to "opnsense-update -p -A 26.7", which I did and came to an error brought up by this post.
Deleting the realtek 1.0 plugin moved things forward.
At some point console updater command saw horrors beyond human comprehention.
Code Select
root@opn:~ # opnsense-update -p -A 26.7
Updating FreeBSD-ports repository catalogue...
FreeBSD-ports repository is up to date.
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating FreeBSD-ports repository catalogue...
FreeBSD-ports repository is up to date.
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date After repeating the console command I managed to pull through with a dashboard update.
But updater still was unable to do miracles. So I am doing what it said and came here to report on it.
https://pastebin.com/8rm6jLr2
At this point I'm probably going to do a clean reinstall when I get back to it. I just felt that I had to report on possible causes.
#5
26.7 Series / Re: No install on my new CWWK
Last post by JosselinFERREIRA - Today at 07:50:21 PMA huge thank you – it's worked a treat; I wouldn't have imagined this sort of setup with just a single hard drive...
I'll be able to make the most of OPNsense as I get to know it.
I'll be able to make the most of OPNsense as I get to know it.
#6
26.7 Series / Re: os-upnp plugin not working...
Last post by XxxBenjixxX - Today at 06:51:39 PMHi,
I wanted to share my experience because I regularly use this plugin, and it worked perfectly before.
The plugin currently appears to be broken, at least on my OPNsense 26.7.2_2 installation with os-upnp 1.9 and miniupnpd 2.3.9_2.
A PlayStation, Xbox, or another device reporting NAT Type 2, Moderate NAT, or Open NAT does not prove that UPnP is working correctly. The reported NAT type can result from normal outbound NAT, static-port outbound NAT, STUN, or relay services.
Adding a separate static-port outbound NAT rule may affect the console's reported NAT type, but it does not fix the broken UPnP redirect. MiniUPnPd is supposed to create the necessary dynamic NAT and redirect rules itself.
You can inspect the rules created by MiniUPnPd with:
In my case, the relevant NAT entries are:
The external interface is configured correctly and has a public IPv4 address:
The important part is `-> ?`. The outbound NAT rule should contain a valid translation address, while the redirect rule should point to the internal client—in this case, `192.168.60.100`.
This shows that:
- The UPnP request is accepted: ✓
- UDP port 9308 is registered as a mapping: ✓
- PF/NAT entries are created: ✓
- Valid translation targets are installed: ✗
- A valid, functioning port forward is created: ✗
This is therefore not an UPnP discovery problem. The client reaches MiniUPnPd and requests the mapping successfully, but the resulting PF rules do not contain valid translation targets.
The console's reported NAT type should not be used to confirm that the plugin is working. It appears that we will have to wait for a fix to the MiniUPnPd/PF integration.
I wanted to share my experience because I regularly use this plugin, and it worked perfectly before.
The plugin currently appears to be broken, at least on my OPNsense 26.7.2_2 installation with os-upnp 1.9 and miniupnpd 2.3.9_2.
A PlayStation, Xbox, or another device reporting NAT Type 2, Moderate NAT, or Open NAT does not prove that UPnP is working correctly. The reported NAT type can result from normal outbound NAT, static-port outbound NAT, STUN, or relay services.
Adding a separate static-port outbound NAT rule may affect the console's reported NAT type, but it does not fix the broken UPnP redirect. MiniUPnPd is supposed to create the necessary dynamic NAT and redirect rules itself.
You can inspect the rules created by MiniUPnPd with:
Code Select
pfctl -P -a miniupnpd -s nat
pfctl -P -a miniupnpd -s rules
In my case, the relevant NAT entries are:
Code Select
nat log quick on igc0 inet proto udp from 192.168.60.100 port = 9308 to any keep state label "192.168.60.100:9308 to 9308 (UDP)" rtable 0 -> ? port 9308
rdr pass log quick on igc0 inet proto udp from any to any port = 9308 keep state label "192.168.60.100:9308 to 9308 (UDP)" rtable 0 -> ? port 9308
The external interface is configured correctly and has a public IPv4 address:
Code Select
ext_ifname=igc0
listening_ip=vlan060
The important part is `-> ?`. The outbound NAT rule should contain a valid translation address, while the redirect rule should point to the internal client—in this case, `192.168.60.100`.
This shows that:
- The UPnP request is accepted: ✓
- UDP port 9308 is registered as a mapping: ✓
- PF/NAT entries are created: ✓
- Valid translation targets are installed: ✗
- A valid, functioning port forward is created: ✗
This is therefore not an UPnP discovery problem. The client reaches MiniUPnPd and requests the mapping successfully, but the resulting PF rules do not contain valid translation targets.
The console's reported NAT type should not be used to confirm that the plugin is working. It appears that we will have to wait for a fix to the MiniUPnPd/PF integration.
#7
26.7 Series / Interfaces: Virtual IPs: Setti...
Last post by MK4L - Today at 06:50:16 PM- I know OPNSense removed this from the UI.
- I know it was announced.
- I know it is still supported if you export config, edit config, re-import config.
- I do not really understand why it was removed?
- OPNSense is missing on a very important use case: Transparent Shaper.
- A Transparent Shaper is possible ONLY using Interfaces: Virtual IPs: Settings > Mode=Other.
More details why:
- Queuing is never efficient; only pipes are.
- Queuing is never efficient, from any vendor, software or hardware, or both (appliance); only pipes are.
- A shaper is best when transparent.
- A Shaper is best when standalone.
- Any additional service is pure noise.
This is more of a feature request: Please bring back Virtual IP Mode = Other to the UI. Adding "Other" interfaces does not mean I have to restart the shaper.
- I know it was announced.
- I know it is still supported if you export config, edit config, re-import config.
- I do not really understand why it was removed?
- OPNSense is missing on a very important use case: Transparent Shaper.
- A Transparent Shaper is possible ONLY using Interfaces: Virtual IPs: Settings > Mode=Other.
More details why:
- Queuing is never efficient; only pipes are.
- Queuing is never efficient, from any vendor, software or hardware, or both (appliance); only pipes are.
- A shaper is best when transparent.
- A Shaper is best when standalone.
- Any additional service is pure noise.
This is more of a feature request: Please bring back Virtual IP Mode = Other to the UI. Adding "Other" interfaces does not mean I have to restart the shaper.
#8
German - Deutsch / Re: Two Factor Authentication ...
Last post by Monviech (Cedrik) - Today at 06:38:50 PMIrgendwie fühlt sich der Thread wie eine LLM Diskussion an. Sorry aber ich bin raus xD
#9
26.7 Series / Re: Firewall rules and aliases...
Last post by notspam - Today at 06:21:15 PMIs there no testbed, no automatic quality check ?
Is it only the user feedback that found such issues of general functionality ?
Is it possible to expand the automatic machine driven testing before release ?
Is it only the user feedback that found such issues of general functionality ?
Is it possible to expand the automatic machine driven testing before release ?
#10
26.1, 26,4 Series / Re: Kea + Unbound + Bind for l...
Last post by Monviech (Cedrik) - Today at 05:49:40 PMThe business edition has a plugin based on PowerDNS now that does not have the same pains as BIND and RFC2136 records on Opnsense:
https://docs.opnsense.org/vendor/deciso/opndns.html
https://docs.opnsense.org/vendor/deciso/opndns.html
