"Recent posts
#1
26.7 Series / Thank you Opnsense Team
Last post by marjohn56 - Today at 04:14:27 PMIt'll be 9 years in December since I made the jump from pfSense to OpnSense. At that time OpnSense was a bit rough around the edges, well, let's be honest it was very rough around the edges, but I stuck with it, got involved and helped ( or hindered ) in a few ways. I just want to say that what I am using today works pretty much flawlessly. I have just spent several hours cleaning up firewall rules, getting used to the new firewall layout, adding AbuseIPDDB and more, all working flawlessly.
Well done chaps, you should be very proud.
Well done chaps, you should be very proud.
#2
General Discussion / Re: ntopng: Latest version fro...
Last post by inventor7777 - Today at 04:11:52 PMQuote from: Jwidess on January 10, 2026, 02:16:31 AMJust thought I'd share my experience, I am running OPNsense v25.7.10 with ntopng Community v.6.7.260105 rev.27191 (FreeBSD 14.0), and disabling "Active Network Discovery" was all that was needed for the crashes to stop. Since I disabled this, the service has been up and running nonstop for ~3 days now. Before, it wouldn't last longer than 4-12 hours before crashing/stopping with no logs.
I was also experiencing this issue, and turning "Active Network Discovery" off fixed the issue for me as well, thanks!
My setup at time os posting is:
OPNsense 26.1.11_10-amd64
FreeBSD 14.3-RELEASE-p16
ntopng plugin v1.3, ntopng version Community v.6.6.260630
#3
26.7 Series / Re: Did SLAAC change address g...
Last post by drosophila - Today at 04:01:59 PMThanks for confirming! It seems that I had set net.inet6.ip6.use_stableaddr=1 in the tunables from some previous tests, forgot about it, and with the update it started to work. =) Now I can see if I can get that to play nicely with dynamic DNS, but ATM the updates seem to nor propagate at all. Probably I'll have to disable it on the Sensebox because I'm relying on the "dynamic IPv6 host" option already, and that won't auto-update on prefix changes (which it would need to do), but I'll need to wait and see how it actually fares. :)
#4
General Discussion / Re: Crash Reporter on syslog ?
Last post by nono - Today at 03:34:38 PMI've been told that maybe watching
Would it be more accurate to create a cronjob starting at boot (or hourly) to check the presence of "something" on that folder or this is completely the wrong approach ?
Quote/var/crash/could be a solution. As I want to get notified via syslog, could this be emplemented and would it be accurate ?
Code Select
logger -p daemon.crit -t opnsense-crash \
"Previous boot appears to have generated a crash dump; check /var/crash"Would it be more accurate to create a cronjob starting at boot (or hourly) to check the presence of "something" on that folder or this is completely the wrong approach ?
#5
26.7 Series / Re: Did SLAAC change address g...
Last post by Patrick M. Hausen - Today at 03:34:21 PMIt is. Stable privacy addresses are a new feature in FreeBSD 15.
#6
26.7 Series / Re: Upgrade 26.1 -> 26.7 boot ...
Last post by Patrick M. Hausen - Today at 03:31:50 PMIt's not hanging at the point at which systems impacted by the microcode issue generally do. But it might be worth a try.
#7
Announcements / OPNsense 26.7.2 released
Last post by franco - Today at 03:28:23 PMHello world!
This update addresses the WireGuard MAC authentication issue people have
been talking about, 4 core security advisories and the usual volume of
quality of life improvements and bug fixes.
We are currently improving the compatibility with the legacy pages in
full privilege separation, working on feature parity between Outbound
NAT and Source NAT and will also provide a road map in the next weeks
for 27.1. Stay tuned.
Here are the full patch notes:
o system: use /var/lib/php/tmp in static pages for proper privilege separation
o system: improve "user-config-readonly" in static pages where write_config() was denied
o system: service widget changes based on further community feedback
o system: support 7680 bit RSA type for certificates and authorities
o system: add redirection capability to SSO provider
o reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
o reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
o reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
o reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
o reporting: stop NetFlow service before reloading configuration
o interfaces: fix assignment of wireless devices
o interfaces: strict description fields in new assignments page[1] (reported by call-AX)
o interfaces: fix typos in GIF reconfiguration script
o interfaces: add "noclamp" flag for GIF
o interfaces: add separate link types for IPv4 and IPv6 in overview
o interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
o interfaces: improve VIP page save when no subnet was posted
o firewall: use htmlSafe() on action search value in live log[1] (reported by call-AX)
o firewall: group invalid rules to the end of the ruleset
o firewall: enable virtualDOM and refactor commands on alias page
o firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
o firewall: fix missing well-known ports in local-port in destination NAT
o firewall: add "max-pkt-rate" rate limiting option to firewall rules
o firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
o firewall: scope get action to general settings in source NAT
o kea: improve prefix watcher accuracy via both interface and MAC address key
o kea: store subnet IDs inside the model so they cannot shift during config regeneration
o kea: change dynamic pool range from prefix to range 1000-2000
o kea: switch custom DHCP option config generation to libdhcp_flex_option library
o openvpn: add some input validation for control characters in connection status[2] (reported by lujiefsi)
o backend: sanitize template filename replacements
o backend: further restrict actions to root and wwwonly for more sensitive actions
o backend: ensure strict templates are not reloaded via "*" wildcard
o mvc: add some missing htmlSafe() calls for generated HTML[3] (reported by lujiefsi)
o mvc: create runInterfaceRegistation() and use it for immediate device registration
o mvc: add some exception types and handle them in the base template
o mvc: clean up a number of stale imports
o mvc: translate backend system status messages
o mvc: translate grid view labels
o ui: add some more legacy_html_escape_form_data() safeguards[4] (reported by Arpit Jain)
o ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
o ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
o ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
o ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
o ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
o ui: do not freeze commands column on touchscreen devices
o ui: further fixes for base templates
o ui: fix empty legacy firewall menu container glitch
o plugins: os-caddy 2.2.0[5]
o plugins: os-frr 1.54[6]
o plugins: os-intrusion-detection-content-at-antiphishing 1.0[7] (contributed by Julio Lira)
o plugins: os-ndp-proxy-go 1.4[8]
o plugins: os-nrpe 1.2[9]
o plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
o src: pf: add missing PF_TS_CNT netlink attribute
o src: pf: expose first rule label for states since rule number is insufficient
o src: usb: bpfattach() before if_attach()
o src: igc: disable PCIe ASPM to improve stability
o src: ena: update driver version to v2.8.4
o src: assorted minor commits from stable/15
o src: coredump: do not assume that the number of ELF segments is consistent[10]
o src: sysvsem: fix a TOCTOU race in semctl()[11]
o src: jail: restore ktrace privileges for jailed root[12]
o src: ktimer: check for errors from realtimer_gettime()[13]
o src: kqueue: avoid enqueuing an already-enqueued knote[14]
o src: zfs: multiple fixes[15]
o src: tzdata: import 2026c[16]
o src: wg: check for crypto operation errors[17]
o src: revert "daemon: replace memchr with memrchr"
o ports: dpinger 3.6
o ports: hostapd / wpa_supplicant 2.12
o ports: nss 3.126[18]
o ports: openldap 2.6.14[19]
o ports: openssh 10.4p1[20]
o ports: openvpn 2.7.6[21]
o ports: phalcon 5.18.2[22]
o ports: py-duckdb 1.5.5[23]
o ports: python 3.13.15[24]
o ports: unbound 1.26.0[25]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[2] https://github.com/opnsense/core/security/advisories/GHSA-fqmm-g6xw-qhm4
[3] https://github.com/opnsense/core/security/advisories/GHSA-75fw-j788-j4hj
[4] https://github.com/opnsense/core/security/advisories/GHSA-6vv6-fpw9-8r2g
[5] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[7] https://julioliraup.github.io/AT/
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/ndp-proxy-go/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/nrpe/pkg-descr
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:55.elf.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:54.sysvsem.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:53.ktrace.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:51.ktimer.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:50.kqueue.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:19.zfs.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc
[18] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_126.html
[19] https://www.openldap.org/software/release/changes_lts.html
[20] https://www.openssh.com/txt/release-10.4
[21] https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst
[22] https://github.com/phalcon/cphalcon/releases/tag/v5.18.2
[23] https://github.com/duckdb/duckdb/releases/tag/v1.5.5
[24] https://docs.python.org/release/3.13.15/whatsnew/changelog.html
[25] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-0
This update addresses the WireGuard MAC authentication issue people have
been talking about, 4 core security advisories and the usual volume of
quality of life improvements and bug fixes.
We are currently improving the compatibility with the legacy pages in
full privilege separation, working on feature parity between Outbound
NAT and Source NAT and will also provide a road map in the next weeks
for 27.1. Stay tuned.
Here are the full patch notes:
o system: use /var/lib/php/tmp in static pages for proper privilege separation
o system: improve "user-config-readonly" in static pages where write_config() was denied
o system: service widget changes based on further community feedback
o system: support 7680 bit RSA type for certificates and authorities
o system: add redirection capability to SSO provider
o reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
o reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
o reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
o reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
o reporting: stop NetFlow service before reloading configuration
o interfaces: fix assignment of wireless devices
o interfaces: strict description fields in new assignments page[1] (reported by call-AX)
o interfaces: fix typos in GIF reconfiguration script
o interfaces: add "noclamp" flag for GIF
o interfaces: add separate link types for IPv4 and IPv6 in overview
o interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
o interfaces: improve VIP page save when no subnet was posted
o firewall: use htmlSafe() on action search value in live log[1] (reported by call-AX)
o firewall: group invalid rules to the end of the ruleset
o firewall: enable virtualDOM and refactor commands on alias page
o firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
o firewall: fix missing well-known ports in local-port in destination NAT
o firewall: add "max-pkt-rate" rate limiting option to firewall rules
o firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
o firewall: scope get action to general settings in source NAT
o kea: improve prefix watcher accuracy via both interface and MAC address key
o kea: store subnet IDs inside the model so they cannot shift during config regeneration
o kea: change dynamic pool range from prefix to range 1000-2000
o kea: switch custom DHCP option config generation to libdhcp_flex_option library
o openvpn: add some input validation for control characters in connection status[2] (reported by lujiefsi)
o backend: sanitize template filename replacements
o backend: further restrict actions to root and wwwonly for more sensitive actions
o backend: ensure strict templates are not reloaded via "*" wildcard
o mvc: add some missing htmlSafe() calls for generated HTML[3] (reported by lujiefsi)
o mvc: create runInterfaceRegistation() and use it for immediate device registration
o mvc: add some exception types and handle them in the base template
o mvc: clean up a number of stale imports
o mvc: translate backend system status messages
o mvc: translate grid view labels
o ui: add some more legacy_html_escape_form_data() safeguards[4] (reported by Arpit Jain)
o ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
o ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
o ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
o ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
o ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
o ui: do not freeze commands column on touchscreen devices
o ui: further fixes for base templates
o ui: fix empty legacy firewall menu container glitch
o plugins: os-caddy 2.2.0[5]
o plugins: os-frr 1.54[6]
o plugins: os-intrusion-detection-content-at-antiphishing 1.0[7] (contributed by Julio Lira)
o plugins: os-ndp-proxy-go 1.4[8]
o plugins: os-nrpe 1.2[9]
o plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
o src: pf: add missing PF_TS_CNT netlink attribute
o src: pf: expose first rule label for states since rule number is insufficient
o src: usb: bpfattach() before if_attach()
o src: igc: disable PCIe ASPM to improve stability
o src: ena: update driver version to v2.8.4
o src: assorted minor commits from stable/15
o src: coredump: do not assume that the number of ELF segments is consistent[10]
o src: sysvsem: fix a TOCTOU race in semctl()[11]
o src: jail: restore ktrace privileges for jailed root[12]
o src: ktimer: check for errors from realtimer_gettime()[13]
o src: kqueue: avoid enqueuing an already-enqueued knote[14]
o src: zfs: multiple fixes[15]
o src: tzdata: import 2026c[16]
o src: wg: check for crypto operation errors[17]
o src: revert "daemon: replace memchr with memrchr"
o ports: dpinger 3.6
o ports: hostapd / wpa_supplicant 2.12
o ports: nss 3.126[18]
o ports: openldap 2.6.14[19]
o ports: openssh 10.4p1[20]
o ports: openvpn 2.7.6[21]
o ports: phalcon 5.18.2[22]
o ports: py-duckdb 1.5.5[23]
o ports: python 3.13.15[24]
o ports: unbound 1.26.0[25]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[2] https://github.com/opnsense/core/security/advisories/GHSA-fqmm-g6xw-qhm4
[3] https://github.com/opnsense/core/security/advisories/GHSA-75fw-j788-j4hj
[4] https://github.com/opnsense/core/security/advisories/GHSA-6vv6-fpw9-8r2g
[5] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[7] https://julioliraup.github.io/AT/
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/ndp-proxy-go/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.7/net-mgmt/nrpe/pkg-descr
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:55.elf.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:54.sysvsem.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:53.ktrace.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:51.ktimer.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:50.kqueue.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:19.zfs.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc
[18] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_126.html
[19] https://www.openldap.org/software/release/changes_lts.html
[20] https://www.openssh.com/txt/release-10.4
[21] https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst
[22] https://github.com/phalcon/cphalcon/releases/tag/v5.18.2
[23] https://github.com/duckdb/duckdb/releases/tag/v1.5.5
[24] https://docs.python.org/release/3.13.15/whatsnew/changelog.html
[25] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-0
#8
General Discussion / Re: Please Make a Donation to ...
Last post by Monviech (Cedrik) - Today at 03:11:10 PMThank you tangofan and stanps for supporting the project :)
#9
26.7 Series / Did SLAAC change address gener...
Last post by drosophila - Today at 03:00:55 PMAfter finding a window for extended downtime I updated to 26.7.1_. Took several hours but came up just dandy in the end. So far so good. :)
However, now the SLAAC autogenerated address on the WAN IF is not the EUI-64 it used to be. It's still a stable address, but very much different from what the MAC-based version used to be. The latter still is in place on the link-local address of that interface, otherwise I'd have assumed that by some miracle the interface had changed its MAC, but it hasn't. I do have Privacy Extensions active but these generate another address that also changes properly and is listed as temporary just as it should be.
So, was there some change in SLAAC that now generates addresses in a different manner that I missed? I noticed there is the flag "STABLEADDR" in nd6 options=823<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL,STABLEADDR>, but IDK whether this was there before or not. So could this be a "stable privacy address" now? This matters for dynamic DNS, naturally.
However, now the SLAAC autogenerated address on the WAN IF is not the EUI-64 it used to be. It's still a stable address, but very much different from what the MAC-based version used to be. The latter still is in place on the link-local address of that interface, otherwise I'd have assumed that by some miracle the interface had changed its MAC, but it hasn't. I do have Privacy Extensions active but these generate another address that also changes properly and is listed as temporary just as it should be.
So, was there some change in SLAAC that now generates addresses in a different manner that I missed? I noticed there is the flag "STABLEADDR" in nd6 options=823<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL,STABLEADDR>, but IDK whether this was there before or not. So could this be a "stable privacy address" now? This matters for dynamic DNS, naturally.
#10
26.7 Series / Re: Upgrade 26.1 -> 26.7 boot ...
Last post by meyergru - Today at 02:58:59 PMOr you should take a look at the release notes?
Especially where it reads:
And then there is this.
Especially where it reads:
Quoteo The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.
And then there is this.
