Recent posts

[DNS over TLS]

#1

General Discussion / Re: DNS over tls when running...

Last post by lmoore - Today at 05:42:59 AM

I am only wanting a backup DNS method in case dns over TLS Fails

Refer to the note in OPNsense documentation found here: https://docs.opnsense.org/manual/unbound.html#dns-over-tls

It's possible that if DNS over TLS fails to Quad9 due to a problem at their end or somewhere in between, its quite probable queries using the traditional port 53 will also fail.

As a contingency in my configuration I have include the two Cloudflare DNS servers, which also provide threat-blocking over DNSSEC, but they are disabled. I've not experienced problems with Quad9 where I've had to use them.

In the event Quad9 becomes unusable, I would add Cloudflare DNS servers to my list of external trusted DNS servers and then enable them in Unbound's DNS over TLS settings, as well as disabling the Quad9 entries.

#2

26.7 Series / Re: SSD drive died - I disable...

Last post by harshw - Today at 05:40:03 AM

Another solution is to get a Micron MX300 (and specifically that model) drive - even a 512GB one will do. Then use Micron's Executive software to over-provision the drive by 50% i.e. it's a 256GB drive for all intents and purposes. The drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM. You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?

Thank you - that one is indeed more reasonably priced.

"drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM" - does that mean that it can take 3-4 times its provisioned capacity (3-4x256GB)? Or am I misunderstanding?

"You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?" - I use ZFS (for snapshotting), and have enabled trim in cron:

Is that what you meant? Thanks :)

My apologies for the last post, I meant the Crucial MX500 and not the MX300 

You have TRIM enabled so unless you had a drive that didn't support TRIM, maybe it died because it was crappy?

Good discussion here: https://forums.servethehome.com/index.php?threads/can-a-1-dwpd-ssd-become-a-3-dwpd-just-with-overprovisioning.45641/

You can calculate Write Amplification Factor (WAF) from the MX500 SMART data. I would encourage you to get one of these, over-provision by 33% ~ 50% and watch the calculated WAF with your specific workload. As noted in the discussion linked to above, I run either Micron 5200/5300MAX or Crucial MX500 OP'ed by at least 33% for all my OPNsense, Ubiquiti, ESXi system drives etc. Even when the underlying OS didn't support TRIM (ubiquiti crap for example) I've seen these drives keep the WAF super low. You can usually get HPE branded Micron 5300 MAX drives for cheap. I use them for my OPNsense although it is tough to update HPE SSDs or even obtain firmware for them

#3

26.7 Series / Re: SSD drive died - I disable...

Last post by oc - Today at 05:03:46 AM

Another solution is to get a Micron MX300 (and specifically that model) drive - even a 512GB one will do. Then use Micron's Executive software to over-provision the drive by 50% i.e. it's a 256GB drive for all intents and purposes. The drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM. You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?

Thank you - that one is indeed more reasonably priced.

"drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM" - does that mean that it can take 3-4 times its provisioned capacity (3-4x256GB)? Or am I misunderstanding?

"You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?" - I use ZFS (for snapshotting), and have enabled trim in cron:

Is that what you meant? Thanks :)

#4

26.7 Series / Re: SSD drive died - I disable...

Last post by harshw - Today at 04:38:19 AM

Apologies for answering in German. I got confused, somehow.

One possible "solution" would be to simply buy a large (1T or so) high write endurance SSD. Yeah, easier said then done in the current state of the market. Back when those used to cost a hundred or so, I personally would have thrown money at the problem. Maybe try to get one used. Samsung 970, WD Black, ... that kind of devices.

Another solution is to get a Micron MX300 Crucial MX500 (and specifically that model) drive - even a 512GB one will do. Then use Micron's Executive software to over-provision the drive by 50% i.e. it's a 256GB drive for all intents and purposes. The drive will now be able to take 3-4 DWPD (drive writes per day) even without TRIM. You should check if TRIM is enabled for your filesystem - are you using ZFS or UFS?

#5

26.7 Series / Re: SSD drive died - I disable...

Last post by oc - Today at 04:17:35 AM

Thank you ALL for your answers, especially on a Sunday. This is a wonderful community, which is commendable!

1. the almost-dead drive is a Samsung 256GB. I unfortunately didn't do a S.M.A.R.T on it prior to deploying it in my "first" opnsense attempt, but I think it came from a desktop or laptop (a friend gave it to me years ago, he used to work in a company that scrapped all hardware after 3 years, and I had the disk in storage for a few years). So conceivably it might have been "tired" when I deployed it, but I highly doubt that it was written onto at high volumes - those companies lock down workstations and all files are hosted on servers (or the cloud, nowadays). However it's likely that I broke it by letting it getting constantly hammered by opnsense and it's add-ons :)

2. I have an 128GB Intel 520 Series, which appears to have enjoyed Industry-leading 5-year warranty and historically low failure/return rates when released (in 2012, so it's also not a spring chicken). But I did run a S.M.A.R.T on it, and it reports 96% health and ~10,000 hours of uptime (which is a lot, but perhaps no big deal). I did install opnsense on it temporarily, but decided to go with a bigger drive (512GB, brandnew, but a crappy brand - I am monitoring it, and have all backups to date). But I am considering deploying that one, if I see that the "crappy 512GB" starts going downhill fast. I will also keep my eyes open for an enterprise-grade SSD...it's getting harder now, with everyone going to the cloud...in the past I literally had access to mountains of untouched never-to-be-deployed enterprise-grade equipment headed for the bin.

3. at work we log about 25TB/day (not a typo), which we're now in the process of consolidating to elastic - so I'm quite aware of the challenges when ingesting such high log volumes - and which was also one of the reasons I might have gone a bit overboard when enabling too much logging on my opnsense - it was regularly logging over 1mil entries/day. I have now redone the ZA configuration, and am now protecting/logging individual VLANs(about 8, for segmentation)/NICs(I have 5 of them, a quad and the onboard one) instead of latching ZA onto the trunk port. This allowed me to avoid assessing&logging entries from the most verbose host on my network - which due to the very high volume would have been very hard to qualitatively analyze anyway. I can however re-enable it with one click if necessary.

4. getting back to the elastic architecture, IMO it would have been great if I could have assigned some GBs as a ram disk, and for elastic to log to its heart's content, entries to be pruned when they exceed the assigned RAM quantity. I could have lived (privately, unlike at work where it's highly regulated) with potentially missing out on older entries - but it would have been great for the longevity of my OS drive. Or another decent option (perhaps that is possible) would be if I could add another drive, and to redirect all elastic logs to it - it's much less bad if I lose my logs, but the FW continues with all its tasks (again, at home that would be acceptable, at work we have everything set to stop forwarding if it can be logged). I know I can log to an external host, but I would like to keep the "firewall service" to one host if possible. I used to rely on one of the major enterprise firewalls (licensed, promotionally) prior to deploying opnsense, so I am mindful of the form factor. But I really love opnsense so I want to carry on <3

5. is disabling hostwatch still a thing? I noticed it was a considered an issue in the past, but Frank suggested it's been fixed in Jan'26 - I am using the most recent version. I have about 30-40 devices altogether, and aside from the mobile devices which tend to use random MACs, all else is supposed to be very stable over time. How can I check how much hostwatch has been logging so far?

6. in conclusion, I consider this experience a great learning opportunity. I encountered a couple of challenges when restoring opnsense (external to opnsense itself), which I have found solutions for - so right now it would take me under 1h to restore, so no big deal. But I am concerned about the FW dying suddenly because I'm sometimes away from home for longer (e.g., during holidays), and I am using it for many reasons, including as a VPN gateway to keep all my travel traffic curated - and I offer friends the same services, so there are several people relying on this 'safe perimeter security', and I don't want them to be disappointed. Also, it is my way to monitor a lot of things at home. It feels like a very no-enterprise way to introduce such a frail SPOF into the equation...my2c

#6

26.1, 26,4 Series / Re: ISC to DNSMASQ - Broadcast...

Last post by Slingky - Today at 01:49:53 AM

Hi,

I have the exact same issue as you.

I'm on OPNsense 26.7.7.

I tried what you suggested and created this file :
/usr/local/etc/dnsmasq.conf.d/dhcp-broadcast.conf

with this content :
dhcp-broadcast

Then, even after service restart or reboot, the device is still not able to renew ip.

Here is the log :
2026-10-18T19:46:39-04:00Informationaldnsmasq-dhcpDHCPOFFER(vtnet2) 10.7.66.25 00:1e:c0:XX:XX:XX
2026-10-18T19:46:39-04:00Informationaldnsmasq-dhcpDHCPDISCOVER(vtnet2) 00:1e:c0:XX:XX:XX

In my case, the device is an old IoT Sinope GT125 Gateway.
(I know it's working because it was getting ip when using old ISC DHCP server and I also tried it on and old router)

Thanks,
Maxime

#7

26.7 Series / Need an option - if it isn't t...

Last post by BenKenobi - Today at 01:07:42 AM

Really need an option to force firewall rules before NAT - I need to keep scumbags and scammers out but OpnSense lets them through - as I have found here NAT is applied before Firewall rules - I want an option not to - if I block a country I expect it blocked even from NAT traversal or I need to put a firewall on every internal box - this isn't efficient.

If I have missed something and there is a setting could somebody expose it please.

#8

26.7 Series / Re: DNS over TLS

Last post by (MARLOO) - October 18, 2026, 11:13:07 PM

Just had my first victim of blocking DoT via Port 853 UDP/TCP the other day : I was very proud of my OPNsense that day! ^_^

The pure joy of watching my toy firewall reject a packet on 853. Truly the highlight of my day.

#9

General Discussion / Re: Free GeoIP Database to use...

Last post by Tonton Jo - October 18, 2026, 09:26:44 PM

Hi!

Not sure if it's the right place, but i wanted to share this:

I've vibecoded a script that generate a geoIP database from scratch that matches the requirements in terms of format for Opnsense.

• It was fully open sources
• Based on the internet registries database
• Automatically updated everyday using a workflow
• PS and Bash scripts to self host / build yourselves available.

The database can be downloaded here and will be automatically updated:
link deleted

Find the scripts for both bash and Powershell usage if you need to self-host here:
link deleted

Regards

Jo

This looks like a useful contribution to the OPNsense community! Having an open-source GeoIP database that updates automatically could make maintenance much easier for self-hosters. I'd be particularly interested in how you validate the registry data, handle IPv4 and IPv6 ranges, and ensure the generated database stays compatible with OPNsense updates. Documentation on data accuracy and a few reproducible tests would also help build confidence for people who want to use it in production.

Hello sir,

Thanks for your interest, i do think this is usefull.

It's back online thanks to IPLocate.io who share an usable and updated database.
It's now even more accurate than RIR databases.

#10

26.7 Series / Re: SSD drive died - I disable...

Last post by Patrick M. Hausen - October 18, 2026, 09:14:06 PM

Just the OS or something else?

VM and jail storage in a mirror vdev/pool. Constantly written. One of the VMs is Elastiflow on Ubuntu.

Monitoring health with Scrutiny and Grafana. No issues with 50% of "Percentage used" in SMART output. Replaced with new ones shortly after going over 50%

For an OPNsense installation even with Elastic 1 TB is plenty. And at the end of the day you need to store the data *somewhere*. So even if you could use an external Elastic instance with Zenarmor in the free or home tier, that one would probably run on an SSD, too - as does my Elastiflow.

I'd categorise the two mentioned products as "prosumer". I have dozens of the Samsung 970 at home, friends' homes, at work, ... never lost one so far.