Recent posts

#1

26.1, 26,4 Series / Can't delete user certificate

Last post by tessus - Today at 06:39:22 AM

I have created a new cert for the UI and I switched to it. I can see that it is used when I connect to the UI.

Yet the UI tell me that cert is still in use (which it certainly isn't) and gives me the following error: Item in use by step9 - {wizardtemp.step9}=

So.... How do I delete the cert? And why is it telling me it is in use by some wizard step?

#2

26.7 Series / Re: Monit RootFS broken for ZF...

Last post by patient0 - Today at 06:15:48 AM

Run the script manually from shell and see what the output of it is.
I copied the script from your referenced thread to a test system here and it works fine.

And run some zfs pool command by hand, e.g 'zpool status' and see what that shows.

#3

Zenarmor (Sensei) / Re: How to block Firefox VPN

Last post by nutty_net - Today at 04:54:47 AM

@Seimus - Hi, I was curious, has there been any recent news about an fix being implemented for custom apps?

#4

Zenarmor (Sensei) / Re: App Control Definition Upd...

Last post by nutty_net - Today at 04:34:24 AM

Also, for those that are curious, these are the categories I noticed that changed:

• A.I. Tools = 132 -> 136
• Ad Tracker = 260 -> 264
• Network Management = 42 -> 43
• Online Utility = 240 -> 242
• Remote Access = 25 -> 28
• Social Network = 148 -> 157
• VOIP = 9 -> 8

#5

Zenarmor (Sensei) / Re: App Control Definition Upd...

Last post by nutty_net - Today at 03:59:03 AM

Hello!

I wanted to post a follow-up on this.  Looking recently at the application counts for each category, I found some categories increased and one category decreased (by one).  Unfortunately, I don't know exactly when this happened, or what apps were added/removed, but I'm glad to see improvements to the application definitions are being made over time.  I don't know if it would be possible or not, but if the additions and removals could be added to the release notes, that would be appreciated.  That way, particularly when new applications are added, one can adjust the filtering as needed.

Thank you :-)

#6

26.7 Series / Re: Gradual Internet Performan...

Last post by tonys - Today at 02:50:58 AM

Maybe try for a time without any Quad9 DNS ? I saw some weirdness in OPNsense, put ControlD/Cloudflare instead of Quad9 servers and it's been fine since

Also, what are your CPU temps ?

It's not Quad9 DNS. I let the network continue running on Quad9 for the past 21 hours and DNS resolves are fast. The CPU temps (in those rare times when I get lucky enough to get the web GUI to actually open), settle in around 38-42C during normal network activity. I don't know what's wrong with the GUI but since upgrading to 26.7.7 two days ago, it's become almost totally unusable.

#7

26.7 Series / Re: Gradual Internet Performan...

Last post by tonys - Today at 02:46:20 AM

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

More like out of sockets ?!

I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net.

Maybe the webGUI simply did not load the settings properly because of all the issues ?!

Did you have a look at the Unbound things I suggested ?


To be honest I am running out of suggestions so here are two last ones :
- Test the RAM.
- Check the adapter/power supply.

That's all I got for now...

Good luck! :)

I think it was the web GUI not loading properly. I don't know how to change the Unbound logging level other than selecting the status level from the pull down menu.

Interesting experiment today. Last night, the GUI was completely useless and it was late so I did two things:
First, I went back to a config file from a few days ago and rebooted the router from the CLI.

Second, I didn't open the GUI following reboot and went to bed.

Tonight, after 21 hours uptime, the network seems to be holding up fairly well with the older config file. I opened the GUI to have a look at things and it's still slow as molasses but it did open after letting it sit for this long time. However, when I went to look at the Unbound settings, the GUI completely stalled again and threw a page-loading timeout error. A while back, I noted that slow/unreliable network performance seemed to be related to the Web GUI stalls/timeouts but I can't really prove this out yet. Once the GUI stalled, I gave up and closed the browser window. At this point, I can't really use the GUI at all so I guess I'll have to learn all the CLI commands to do maintenance and make changes moving forward.

I attached a difference file between the current (older) config.xml file (<), and the newer config file I was using up until late last night (>). I'm not versed in XML language so maybe you can look at these differences and spot something.

#8

26.7 Series / Re: Gradual Internet Performan...

Last post by tonys - Today at 02:42:57 AM

<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9

Out of memory?

More like out of sockets ?!

I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net.

Maybe the webGUI simply did not load the settings properly because of all the issues ?!

Did you have a look at the Unbound things I suggested ?


To be honest I am running out of suggestions so here are two last ones :
- Test the RAM.
- Check the adapter/power supply.

That's all I got for now...

Good luck! :)

I think it was the web GUI not loading properly. I don't know how to change the Unbound logging level other than selecting the status level from the pull down menu.

Interesting experiment today. Last night, the GUI was completely useless and it was late so I did two things:

First, I went back to a config file from a few days ago and rebooted the router from the CLI.
Second, I didn't open the GUI following reboot and went to bed.

Tonight, after 21 hours uptime, the network seems to be holding up fairly well with the older config file. I opened the GUI to have a look at things and it's still slow as molasses but it did open after letting it sit for this long time. However, when I went to look at the Unbound settings, the GUI completely stalled again and threw a page-loading timeout error. A while back, I noted that slow/unreliable network performance seemed to be related to the Web GUI stalls/timeouts but I can't really prove this out yet. Once the GUI stalled, I gave up and closed the browser window. At this point, I can't really use the GUI at all so I guess I'll have to learn all the CLI commands to do maintenance and make changes moving forward.

I attached a difference file between the current (older) config.xml file (<), and the newer config file I was using up until late last night (>). I'm not versed in XML language so maybe you can look at these differences and spot something.

#9

26.7 Series / OPNsense 26.7.7 – Intermittent...

Last post by Alan - Today at 12:18:45 AM

**Title: OPNsense 26.7.7 – Intermittent mpd5 L2TP sequencing failure (FreeBSD ng_l2tp)**

I'm investigating an intermittent L2TP client issue with OPNsense 26.7.7 (amd64), using mpd5 to connect to a Cisco LNS.

The L2TP tunnel establishes successfully, CHAP authenticates, and IPv6CP completes. However, some sessions fail to pass IPv6 traffic, including DHCPv6-PD.

**Findings**

Using the same default OPNsense-generated mpd5 configuration, I've captured both working and failing sessions.

Working session:
- `enable_dseq=0`
- IPv6 ping succeeds (5/5, ~19.5 ms)
- No receive data drops reported

Failing session:
- `enable_dseq=1`
- IPv6 ping fails (0/10)
- `recvDataDrops` increases during testing
- Failure reproduced after a clean reboot

**Packet capture findings**

In the failing session:

- Packets 21–27: Normal SCCRQ/SCCRP/SCCCN and ICRQ/ICRP/ICCN negotiation.
- Packet 28: mpd5 initially sends an LCP packet with `S=1, Ns=0`.
- Subsequent Cisco LCP packets use increasing sequence numbers.
- IPv6 Echo Replies (packets 108, 110, 112, 114, 116) arrive with `S=1, Ns=0`.
- These replies reach the physical interface but are dropped by FreeBSD netgraph.

No Sequencing Required AVP was identified in the decoded session establishment.

**Confirmed workaround**

Disabling data sequencing directly on the active netgraph session immediately restores IPv6 connectivity:

```
ngctl msg '[NODE_ID]:' setsessconfig '{ session_id=0xXXXX peer_id=0xYYYY control_dseq=1 enable_dseq=0 include_length=0 }'
```

This workaround is lost after reconnecting or rebooting.

The generated `/var/etc/mpd_opt5.conf` contains no explicit `dataseq` configuration, and I cannot find an OPNsense GUI option for `set l2tp disable dataseq`.

**Questions**

1. Does anyone know why mpd5 sometimes establishes sessions with `enable_dseq=1` and other times with `enable_dseq=0`, using identical configurations?
2. Is there a supported way to persist `set l2tp disable dataseq` through OPNsense's configuration system?
3. Could mpd5's initial sequenced LCP packet influence the LNS behavior even without a Sequencing Required AVP?
4. Would an OPNsense configuration option to disable L2TP data sequencing be appropriate?

I have full PCAPs of both the working and failing session establishments and can provide sanitized captures.

The LNS operator is also investigating the inconsistent sequence numbers on the Cisco side.

#10

26.7 Series / Re: Monit RootFS broken for ZF...

Last post by tracerrx - October 14, 2026, 11:18:33 PM

I actually followed the directions on This Post to create a ZFS specific script.