"Recent posts
#1
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by chemlud - November 04, 2026, 10:28:27 PMSo basically we have here a critical parameter which can be set from the GUI, but not be reversed?
What ist the fall-back, if I can't reach the opnsense anymore after switiching to Kea?
What commands do I have enter in the console to make static ARP go away on the infterface level?
What ist the fall-back, if I can't reach the opnsense anymore after switiching to Kea?
What commands do I have enter in the console to make static ARP go away on the infterface level?
#2
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by Monviech (Cedrik) - November 04, 2026, 09:03:56 PMI think there were some fixes that remove the staticarp flag after a reboot if ISC plugin is not installed. But better plan having administrative access anyway. I wouldnt do this remotely to be honest.
#3
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by chemlud - November 04, 2026, 08:59:30 PMOk, thanks. So what is correct way to avoid loosing access to interfaces while moving from ISC to KEA, when static ARP was enabled in ISC?
If I read the above thread correct it is not sufficient to disable static ARP in ISC to "reset" the interface ot non-static ARP.
If I read the above thread correct it is not sufficient to disable static ARP in ISC to "reset" the interface ot non-static ARP.
#4
Russian - Русский / Re: os-xray — плагин Xray-core...
Last post by cxmorgan - November 04, 2026, 08:48:20 PMДобрый день! Поставил форк от SpyLive, но у меня со старта не работает proxytun2socks
curl --socks5 127.0.0.1:10808 -s -o /dev/null -w "%{http_code}" https://1.1.1.1 --max-time 10
301
можете подсказать что сделать?
ps. разобрался, но почему то интерфейс нерабочий
curl --socks5 127.0.0.1:10808 -s -o /dev/null -w "%{http_code}" https://1.1.1.1 --max-time 10
301
можете подсказать что сделать?
ps. разобрался, но почему то интерфейс нерабочий
#5
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by Monviech (Cedrik) - November 04, 2026, 08:26:13 PMSince the pull request is open its not yet in any version, not even in development.
This will take some more time.
This will take some more time.
#6
26.7, 26.10 Series / Re: WAN_DHCP6 learns OPNsense ...
Last post by Patrick M. Hausen - November 04, 2026, 08:10:32 PMYou almost certainly have the two networks not quite as separated as you think they are.
#7
26.7, 26.10 Series / Re: WAN_DHCP6 learns OPNsense ...
Last post by noclue68 - November 04, 2026, 07:51:23 PMThe more interesting observation is that the LAN link-local address (fe80::be24:11ff:fe89:923c) appears in the NDP cache of the WAN interface (vtnet1) with the LAN MAC address (bc:24:11:89:92:3c).
If WAN and LAN are completely separated, how can the WAN interface learn the LAN link-local address via NDP at all?
Could this indicate an issue in Proxmox bridge handling, VirtIO networking or Neighbor Discovery processing rather than DHCPv6-PD itself?
Additional findings:
The Fritz!Box sees both OPNsense interfaces separately:
WAN:
MAC BC:24:11:E3:15:CE
IPv4 192.168.121.200
LAN:
MAC BC:24:11:89:92:3C
IPv4 192.168.1.1
However, the Fritz!Box also associates IPv6 addresses derived from both MAC addresses with both entries.
Packet captures on WAN repeatedly show NDP traffic between:
fe80::be24:11ff:fee3:15ce (WAN)
and
fe80::be24:11ff:fe89:923c (LAN)
The LAN link-local address appears in the WAN NDP table and is reachable.
At this point the issue seems less related to DHCPv6-PD itself and more related to how link-local addresses and neighbor discovery are handled between interfaces.
The correct Fritz!Box link-local address (fe80::b6fc:7dff:fe50:16a5) remains visible and reachable at all times.
Netgear GS308E works as regular switch - current factory settings
If WAN and LAN are completely separated, how can the WAN interface learn the LAN link-local address via NDP at all?
Could this indicate an issue in Proxmox bridge handling, VirtIO networking or Neighbor Discovery processing rather than DHCPv6-PD itself?
Additional findings:
The Fritz!Box sees both OPNsense interfaces separately:
WAN:
MAC BC:24:11:E3:15:CE
IPv4 192.168.121.200
LAN:
MAC BC:24:11:89:92:3C
IPv4 192.168.1.1
However, the Fritz!Box also associates IPv6 addresses derived from both MAC addresses with both entries.
Packet captures on WAN repeatedly show NDP traffic between:
fe80::be24:11ff:fee3:15ce (WAN)
and
fe80::be24:11ff:fe89:923c (LAN)
The LAN link-local address appears in the WAN NDP table and is reachable.
At this point the issue seems less related to DHCPv6-PD itself and more related to how link-local addresses and neighbor discovery are handled between interfaces.
The correct Fritz!Box link-local address (fe80::b6fc:7dff:fe50:16a5) remains visible and reachable at all times.
Netgear GS308E works as regular switch - current factory settings
#8
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by chemlud - November 04, 2026, 07:43:23 PMHave to spent time selecting an option, DNSmasq, or Kea, then ....
Would be interesting to know, if this new feature in the pull request is in the current version and if yes: Where to find it? Individual interface?
Would be interesting to know, if this new feature in the pull request is in the current version and if yes: Where to find it? Individual interface?
#9
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - November 04, 2026, 06:58:07 PMThanks for the details, that helps. I'd fix one thing at a time, and the first one is getting stable access to the web UI again. I suspect it is a firewall/interface issue and not dnsmasq: if it works after "pfctl -d", then "pfctl -e", and stops later, existing connections survive but new ones are blocked.
Please, before changing anything else:
1. Save a backup of config.xml if you can reach the GUI (System > Configuration > Backups).
2. From the PC on switch port 1, tell me which IP the web UI answers on, and screenshot Interfaces > Assignments (IPs of LAN and of each VLAN).
3. Screenshot Firewall > Rules > LAN (and the rule list of the VLAN you use for management).
4. Tell me exactly what you changed when you "removed 127.0.0.1" (which page, which field).
The WireGuard kill switch, the DNS over the tunnel and the four VLANs come later, one at a time. The kill switch should be the very last step.
Sergio
Please, before changing anything else:
1. Save a backup of config.xml if you can reach the GUI (System > Configuration > Backups).
2. From the PC on switch port 1, tell me which IP the web UI answers on, and screenshot Interfaces > Assignments (IPs of LAN and of each VLAN).
3. Screenshot Firewall > Rules > LAN (and the rule list of the VLAN you use for management).
4. Tell me exactly what you changed when you "removed 127.0.0.1" (which page, which field).
The WireGuard kill switch, the DNS over the tunnel and the four VLANs come later, one at a time. The kill switch should be the very last step.
Sergio
#10
26.7, 26.10 Series / Re: ISC➞Kea migration
Last post by Monviech (Cedrik) - November 04, 2026, 06:24:44 PMstaticarp
https://github.com/opnsense/core/pull/11026
Its not a feature of KEA, its just an interface flag.
Dont know why you loose lifetime. Reservations are export from isc and import to kea via csv, both available in the gui.
https://github.com/opnsense/core/pull/11026
Its not a feature of KEA, its just an interface flag.
Dont know why you loose lifetime. Reservations are export from isc and import to kea via csv, both available in the gui.
