Recent posts

#1

German - Deutsch / Routing über falsches gateway,...

Last post by rthoene - Today at 04:22:05 AM

Hi, ich habe weder hier im Forum noch weiter im Internet eine Hilfe finden können, auch nicht bei einem Freund, der beruflich OPNsense installiert.

Mein OPNsense läuft auf einer eigenen Mini-PC Hardware.
LAN1 (eht0/igc0) = lokales Netzwerk 192.168.99.1, also DHCP und DNS hier auf/in der OPNsense.
LAN2 (eth1/igc1) = PLDT, ein Glasfaseranbieter hier auf den Philippinen, vergleichbar der Telekom (leider auch was Zuverlässigkeit angeht...)
LAN3 (eth2/igc2) = Starlink.

Derzeit eingestellt: Starlink mit Prio 20, PLDT mit Prio 25 (vorher umgekehrt).

Verhalten: Mein Rechner wird immer wieder über PLDT geroutet, welches derzeit aber nicht sehr zuverlässig ist. Standard sollte derzeit Starlink sein.
-Sticky Connection: Off.
Einzige bisher gefundene Möglichkeit, wirklich stabil über Starlink zu gehen: PLDT ganz abschalten, UND OPNsense neu booten. Einfach nur abschalten hilft auch nicht.
Starlink wurde schon vor längerem mit z.B. Latency Low Threshold zu meinem Liebling gekürt... aber OPNSense kümmert sich nicht darum!
Auch wenn ich mit ausgeschaltetem PLDT die Kiste neu boote, schaltet Sie irgendwann einfach wieder auf PLDT. Ohne das anzuzeigen! Mit Sticky Connection bleibt mein Rechner dann noch etwas länger auf dem alten Interface, ohne Sticky Connection folgt auch das Routing meines Rechners schnell dieser unsichtbaren Umschaltung.
Hat jemand einen Tipp für mich, was ich ändern muss, damit OPNsense wirklich den Parametern entsprechend auf das schnellere/besser Gateway umschaltet?

Versions
OPNsense 26.7.3_11-amd64
FreeBSD 15.1-RELEASE-p3
OpenSSL 3.5.8

#2

26.7 Series / A WireGuard DNS error occurred...

Last post by Lucid1010 - Today at 02:53:06 AM

Code Select Expand

/usr/local/opnsense/scripts/wireguard/wg-service-control.php: The command </usr/bin/wg syncconf 'wg0' '/usr/local/etc/wireguard/wg0.conf'> returned exit code 1 and the output was "Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.00 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.20 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.44 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 1.73 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.07 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.49 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 2.99 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 3.58 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 4.30 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 5.16 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 6.19 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 7.43 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 8.92 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 10.70 seconds...
Name could not be resolved at this time: `my-domain.com:51820'.
Trying again in 12.84 seconds...
Name could not be resolved at this time: `my-domain.com:51820' Configuration parsing error"
After upgrading to 26.7.4, I encountered the WireGuard log error shown above.
I'm using AdGuard Home, and I suspect this issue occurs because the AdGuard Home service fails to start on reboot.

#3

General Discussion / Re: Block Local Network Connec...

Last post by lmoore - Today at 01:29:21 AM

As long as your device has internet access, it can spy on you even when it cannot reach its neighbors one way or another. As the video shows, the webcams and microphones are accessible from outside.

I don't have a Smart TV for privacy reasons. However, any device used to stream content from the Internet can send telemetry.

Reading this article, NTP is also utilised for gathering information.

I've included a Destination NAT rule to redirect NTP connections to OPNsense.

If you really want to get away from it all you need to be a lot more radical and go for something like https://plasma-bigscreen.org/

This could be an alternative.

#4

26.7 Series / Re: [SOLVED] 26.7.4 Update - S...

Last post by (MARLOO) - Today at 01:17:43 AM

Quick feedback after updating to 26.7.4 on my test box (config restored from production, non‑existent interfaces disabled before the upgrade):

Unbound + dnscrypt‑proxy: both services stayed up, no config changes needed.

DNS tests (localhost, LAN IP, and via dnscrypt ) all return NOERROR as expected.

Applied the UI patch for the firewall rules scrolling issue (opnsense-patch 050f3c8277) – scrolling is now smooth again in Firefox/Edge.

From my side, the update is solid. Thanks to all the developers and contributors for another great release.

#5

Hardware and Performance / Re: proper way to limit SFP mo...

Last post by BrandyWine - Today at 01:12:16 AM

maybe
ifconfig <interface> media 1000baseSX

#6

Hardware and Performance / Re: amd-xgbe ("ax"): interface...

Last post by BrandyWine - Today at 01:05:34 AM

Is the cpu being fully offloaded to the NIC now?

You can try disabling this feature for individual NIC functions using sysctl.
Or use ifconfig ax1 -tso4 -tso6

So 1st try that.

To me it just sounds like a driver issue.

#7

26.7 Series / Re: 26.7.4 Update - Scrolling ...

Last post by lmoore - Today at 12:37:31 AM

# opnsense-patch https://github.com/opnsense/core/commit/050f3c8277

Thanks Franco.

Now working in both browsers.

Cheers,

Larry.

#8

26.7 Series / Re: Crashes, and Kea DHCP Serv...

Last post by computer_freak_8 - Today at 12:34:11 AM

And maybe run memtest86+ from your favorite Linux Live ISO Boot Image on a USB Stick for at least 24 hours ?
If you see errors very shortly after starting it you can stop ofcourse!

I downloaded MemTest86+ directly and ran that via Ventoy - sure enough, bad stick of RAM. I wouldn't have thought of that on my own because from my past experience, I've not seen RAM failure cause these symptoms, so thank you for pointing me in the right direction there.

I've got it running - will let it go 24 hours, or until it stops/is "complete", whichever comes first, and then try to check S.M.A.R.T. status.

#9

Portuguese - Português / Re: Failover dual-WAN automáti...

Last post by jovangdg34 - September 15, 2026, 11:29:39 PM

Eu começaria verificando o DNS e as regras de saída, já que os pings por IP funcionam, mas os domínios não resolvem. Também vale confirmar se o DNS está sendo encaminhado pela WAN ativa e se não há alguma regra de firewall ou NAT impedindo essa comunicação.

#10

Hardware and Performance / Re: 10G but reaching only 5-5....

Last post by pfry - September 15, 2026, 11:09:35 PM

[...]Could it depend on the SFP+ module I chose?[...]

So long as the interface clocks are sync'd there should not be a silent condition that would affect speed (and async clocking seems unlikely, particularly at 10Gb). You could fall down a component testing rabbit hole... which might be enlightening, but would certainly be expensive.

The "1.9W" spec (for the UACC-CM-RJ45-MG) looks decent. I wonder what chippie they use (guessing RealTek). I don't think "ifconfig -v" would give anything more than the product ID.

Speaking of "silent", how does netstat look? Anything untoward?