Recent posts

#1

General Discussion / Re: nfSensei ( fork pfsense )

Last post by Nullman - Today at 09:37:46 PM

Still now source code, it's almost November.. Its a joke. Hard pass / red flag.

Stop being so toxic.

#2

German - Deutsch / Re: Frage zu Zertifikaten und ...

Last post by viragomann - Today at 08:25:55 PM

Hallo,

Auf meiner opnsense ist der ACME-Client und der caddy proxy eingerichtet, als lokalen DNS nutze ich unbound.
Caddy verteilt das Let's Encrypt Wildcard Zertifikat an die Dienste die in meinem Netz laufen,

d.h., du hast ein Wildcard-Zertifikate für *.mydomain.de, das der ACME-Client besorgt, und das auch in jedem Frontend in Caddy angegeben?
Und vielleicht auch in den General Settings "Auto HTTPS" deaktiviert?

Bei switch1 kommt eine https Verbindung zustande bei switch2 nicht

Wie genau äußert sich das?

Die Webbrowser geben heute speziell bei SSL-Problemen aber meist keine vernünftige Fehlermeldung aus. Wenn du cURL oder OpenSSL verfügbar hast, untersuche die Serverantwort damit.

Mit cURL

Code Select Expand

curl -v https://switch2.mydomain.deDas zeigt, auf welche Domain das gelieferte Zertifikat ausgestellt ist.
Mache dasselbe mit switch1 zum Vergleich.

#3

General Discussion / Re: nfSensei ( fork pfsense )

Last post by patient0 - Today at 07:28:53 PM

I don't understand all the rage here, are you guys 12? Let's see how it turns outt before you judge. Have you not learned anything from the pfSense - OPNsense beef?

I'm a tester of nfSensei and it got a lot going for it but as with all software, it will take time to mature. Scott will publish the code when the time is right. With all the hate and rage and his own history with the otherSense, who can blame him to be cautious?

Btw: if you want to try it out yourself, write an email to Scott.

#4

26.7, 26.10 Series / Re: Kernel panic during reboot...

Last post by (MARLOO) - Today at 06:59:18 PM

from your log the fault isn't in Zenarmor, pf or the driver: it's in netmap's mbuf destructor, hit after the emulated adapter for igc1 was already destroyed.

003.908331 generic_netmap_dtor Emulated netmap adapter for igc1 destroyed → 003.986713 generic_mbuf_dtor Error: no netmap adapter on device 0xfffff800019f1800

Check
 
 https://github.com/opnsense/src/issues/314

 this looks like the same defect and the issue is still open..

Attach panic_during_update.txt: that file is the textdump 

#5

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by Patrick M. Hausen - Today at 05:13:15 PM

`service unbound start`

returns a message indicating that unbound_enable is not set to YES in /etc/rc.conf.

OPNsense does not use the FreeBSD rc system. So you should not manually force it by using "onestart", either. The way to start/stop/restart/... a service is e.g.

Code Select Expand

configctl unbound start

HTH,
Patrick

#6

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by raft - Today at 04:46:03 PM

# Problem Report: OPNsense services fail to start after reboot

**Subject:** Unbound and WebGUI (lighttpd) fail to start automatically after reboot. Reload all services (console option 11) restores functionality.

## 1. Environment

- OPNsense version: 26.7.7
- FreeBSD: 15.1
- Virtualization: QEMU/KVM with libvirt
- Host operating system: Lubuntu
- Network adapters: VirtIO
- WAN: libvirt NAT network
- LAN: isolated libvirt network

## 2. Network configuration

OPNsense WAN:
- IP address: 192.168.122.23
- Gateway: 192.168.122.1

OPNsense LAN:
- IP address: 192.168.100.1

Debian 13 client:
- IP address: 192.168.100.184
- Default gateway: 192.168.100.1

Both OPNsense interfaces receive their expected IP addresses.

## 3. Problem description

After a normal OPNsense reboot:

- The WAN and LAN interfaces appear to be configured.
- The routing table contains the expected routes.
- configd is running.
- Unbound is not running.
- lighttpd is not running.
- The WebGUI is unavailable.
- The Debian client cannot access the Internet.

The OPNsense console boot log displays:

"Starting web GUI......done."

However, lighttpd is subsequently found not running.

## 4. Reproduction and recovery

The problem occurs after rebooting the OPNsense virtual machine.

Using console option 11, "Reload all services", restores functionality.

After this operation:
- The WebGUI becomes accessible.
- Unbound starts working.
- Debian regains Internet connectivity.

This behaviour is reproducible after reboot.

## 5. Additional observations

Attempting to start Unbound manually with:

`service unbound start`

returns a message indicating that unbound_enable is not set to YES in /etc/rc.conf.

Using:

`service unbound onestart`

produces a socket-buffer warning:

`SO_SNDBUF was not granted: No buffer space available`

Attempting to start lighttpd manually with onestart fails.

The exact lighttpd error still needs to be collected.

The Listen Interfaces setting is already set to "All (recommended)".

Available OPNsense updates have been installed, but the problem remains.

No manual changes have been made to /etc/rc.conf or kernel network-buffer settings.

## 6. Questions for the OPNsense developers

1. Is this a known issue with OPNsense 26.7.7 running under QEMU/KVM?
2. Could this be related to the boot sequence or service dependencies?
3. Why do Unbound and lighttpd fail to remain running after boot?
4. Is the SO_SNDBUF warning relevant to the Unbound startup failure?
5. Is there a recommended diagnostic procedure for this situation?
6. Is there a supported way to execute a service reload after the network initialization phase?
7. Could this be a regression in the current release?

## 7. Requested assistance

We would appreciate guidance on identifying the underlying cause.

We would prefer a permanent correction in the normal startup process rather than relying on a manual reload of all services after every reboot.

Thank you for your assistance.

#7

Hardware and Performance / mlx4en still not loading by de...

Last post by kevindd992002 - Today at 04:38:23 PM

I just installed 26.7 on a bare metal that has a mellanox cx3 card and the module still did not load. I still had to put it in the tunables. I read in this forum that this is no longer necessary with the newer opnsense versions but why is this still not the case in my experience?

#8

General Discussion / Re: nfSensei ( fork pfsense )

Last post by Melroy vd Berg - Today at 03:43:00 PM

Still now source code, it's almost November.. Its a joke. Hard pass / red flag.

#9

26.7, 26.10 Series / Re: Kernel panic during reboot...

Last post by OneTimePad - Today at 01:38:23 PM

Thanks for documenting this, it is useful for anyone running Zenarmor in netmap mode on igc interfaces. Booting the previous snapshot from the console is exactly why ZFS boot environments are worth having on a firewall. Disabling Zenarmor before an update and re-enabling it after the reboot seems a sensible habit until the cause is clear. It might also be worth attaching the crash log to a report with the Zenarmor team so they can check the netmap teardown path.

#10

26.7, 26.10 Series / Re: Unable to import Trust Aut...

Last post by Monviech (Cedrik) - Today at 01:25:32 PM

You have to import the root and the intermediate sepatately now.

one cert per import.