"Recent posts
#1
German - Deutsch / Re: Upgrade 26.7.5 > 26.7.6 od...
Last post by Hellgirl - Today at 10:41:07 AMVielen Dank für Deine Hinweise. Diese haben mich schon ein Stück weiter gebracht ;-)
Installiert ist die OPNsense frisch mit 26.7.0 Image inkl. Config load während der Installation und anschließendem Versuch auf 26.7.7 zu upgraden. Vor Upgrade ist das ganze Netzwerk inkl. aller VLANs erreichbar. Danach die besagten Einschränkungen.
Ich befinde mich jetzt mit 10.10.2.9 im VLAN 02:
Erreichbar:
Alles Teilnehmer im VLAN02 mit unten stehenden Ausnahmen.
Nicht erreichbar:
10.10.2.1 (Gateway Adresse VLAN 02 / WebIF Opnsense somit nicht erreichbar)
10.10.2.2 (Hardware Adresse LAN Adapter)
Alle anderen Teilnehmer aus anderen VLANs und kein Internet
Ich befinde mich dann mit 10.10.1.100 im VLAN 01:
Erreichbar:
Alles im VLAN 02 mit Ausnahme siehe unten
Nicht erreichbar:
10.10.2.1 (Gateway Adresse VLAN 02 / WebIF Opnsense erreichbar)
10.10.2.2 (Hardware Adresse LAN Adapter)
Keinerlei anderen VLANs, was mir logisch erscheint, wenn das Gateway nicht erreichbar ist.
Ich bin mir daher nun ziemlich sicher, dass ich irgendwo schon lange einen groben Konfigurationsfehler habe, welche in den Versionen bis inkl. 26.7.5 keine Rolle spielte und ab 26.7.6 dann drastische Auswirkungen hat.
Hast Du eine Idee, wie ich nun weiter den Fehler analysieren kann? Zur Info: Ein vollständiges Disablen der Firewall brachte keinerlei Änderungen hervor. Ebenso sehe ich bei den Anfragen im Firewall Log auch, dass diese nicht geblockt werden. Also am Ruleset selbst scheint es nicht zu liegen.
Ist es generell richtig, dass ich dem LAN Adapter die 10.10.2.2 Adresse gebe? Ich habe ja für das VLAN 02 das Netzwerk 10.10.2.0/24 vergeben und als Gateway für VLAN 02 somit die 10.10.2.1?
Installiert ist die OPNsense frisch mit 26.7.0 Image inkl. Config load während der Installation und anschließendem Versuch auf 26.7.7 zu upgraden. Vor Upgrade ist das ganze Netzwerk inkl. aller VLANs erreichbar. Danach die besagten Einschränkungen.
Ich befinde mich jetzt mit 10.10.2.9 im VLAN 02:
Erreichbar:
Alles Teilnehmer im VLAN02 mit unten stehenden Ausnahmen.
Nicht erreichbar:
10.10.2.1 (Gateway Adresse VLAN 02 / WebIF Opnsense somit nicht erreichbar)
10.10.2.2 (Hardware Adresse LAN Adapter)
Alle anderen Teilnehmer aus anderen VLANs und kein Internet
Ich befinde mich dann mit 10.10.1.100 im VLAN 01:
Erreichbar:
Alles im VLAN 02 mit Ausnahme siehe unten
Nicht erreichbar:
10.10.2.1 (Gateway Adresse VLAN 02 / WebIF Opnsense erreichbar)
10.10.2.2 (Hardware Adresse LAN Adapter)
Keinerlei anderen VLANs, was mir logisch erscheint, wenn das Gateway nicht erreichbar ist.
Ich bin mir daher nun ziemlich sicher, dass ich irgendwo schon lange einen groben Konfigurationsfehler habe, welche in den Versionen bis inkl. 26.7.5 keine Rolle spielte und ab 26.7.6 dann drastische Auswirkungen hat.
Hast Du eine Idee, wie ich nun weiter den Fehler analysieren kann? Zur Info: Ein vollständiges Disablen der Firewall brachte keinerlei Änderungen hervor. Ebenso sehe ich bei den Anfragen im Firewall Log auch, dass diese nicht geblockt werden. Also am Ruleset selbst scheint es nicht zu liegen.
Ist es generell richtig, dass ich dem LAN Adapter die 10.10.2.2 Adresse gebe? Ich habe ja für das VLAN 02 das Netzwerk 10.10.2.0/24 vergeben und als Gateway für VLAN 02 somit die 10.10.2.1?
#2
26.7 Series / Re: PPPoE over an unassigned V...
Last post by GOJ - Today at 02:17:34 AMI thought that was the problem and I did verify my credentials with the provider. However, the gentleman I spoke with wouldn't pass me onto level 2 or 3 for further investigation. I have reset my modem to the defaults but still no dice. I have changed providers; I'm sure they'll find the issue when the technician comes to activate my new service. We had a power glitch before my internet connection went belly up. It's almost like my port at the providers POP lost it's configuration when the power went out.
#3
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - October 25, 2026, 10:55:08 PMHi babagoo,
Good news first: your health audit shows that the kernel and the base system are fine, with no missing or altered files. The version mismatch lines only appear because the update stopped halfway. Nothing seems broken.
The real problem is that the download stops. The first packages arrive, then one fails, and the security audit also cannot fetch its file. The small catalogue check works, so the connection exists but larger transfers break. Since it is the same on both firewalls and with different mirrors, I would look at the network of your virtual machines first.
Some things to try, one at a time:
1. Under System, Settings, General, tick the option to prefer IPv4 over IPv6, save, and try the update again.
2. Check that DNS answers quickly from the firewall, using Interfaces, Diagnostics, DNS Lookup.
3. Try the update again later, in case the mirror had a short problem.
4. Check that the virtual machine has enough free disk space.
5. As a test, try a smaller or different network adapter type for the NAT interface in VMware.
If the update stops again at the same package, please tell us which one. That helps to see if it is always the same file.
Sergio
Good news first: your health audit shows that the kernel and the base system are fine, with no missing or altered files. The version mismatch lines only appear because the update stopped halfway. Nothing seems broken.
The real problem is that the download stops. The first packages arrive, then one fails, and the security audit also cannot fetch its file. The small catalogue check works, so the connection exists but larger transfers break. Since it is the same on both firewalls and with different mirrors, I would look at the network of your virtual machines first.
Some things to try, one at a time:
1. Under System, Settings, General, tick the option to prefer IPv4 over IPv6, save, and try the update again.
2. Check that DNS answers quickly from the firewall, using Interfaces, Diagnostics, DNS Lookup.
3. Try the update again later, in case the mirror had a short problem.
4. Check that the virtual machine has enough free disk space.
5. As a test, try a smaller or different network adapter type for the NAT interface in VMware.
If the update stops again at the same package, please tell us which one. That helps to see if it is always the same file.
Sergio
#4
High availability / Re: HA: Enter CARP Maintenance...
Last post by patient0 - October 25, 2026, 10:31:00 PMQuote from: mossi2000 on October 25, 2026, 09:53:41 PMwould have sworn that it I had seen under HAIt's always been under 'Virtual IPs' and the naming was never logical to me. But it is how it is and keeps your brain active :)
#5
High availability / Re: HA: Enter CARP Maintenance...
Last post by mossi2000 - October 25, 2026, 09:53:41 PMHi BonetTech,
this was it. See screenshot. Thanks.
Then I can continue to test if everything works.
I would have sworn that it I had seen under HA....where it definitely would make sense...
this was it. See screenshot. Thanks.
Then I can continue to test if everything works.
I would have sworn that it I had seen under HA....where it definitely would make sense...
#6
High availability / CARP update of backup firewall...
Last post by babagoo - October 25, 2026, 09:48:46 PMI have a CARP setup in VMware workstation (NAT and Host-only networks) with both firewalls on opnsense version 26.7.6. I am trying to update to version 26.7.7. I get this error when I try to update the backup firewall:
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:37:48 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: ...
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
Health audit output:
***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:40:49 GMT 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.7.6 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.7.6 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-vmware 1.5_1
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.7.6 has 69 dependencies to check.
Checking packages: .........................
opnsense-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
opnsense-update-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
php85-ctype-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-curl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-dom-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-filter-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-gettext-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-ldap-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pcntl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pdo-8.5.11 version mismatch, expected 8.5.12
Checking packages: .....
php85-session-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-simplexml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sockets-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sqlite3-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-xml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-zlib-8.5.11 version mismatch, expected 8.5.12
Checking packages: ...................... done
***DONE***
Security audit output:
***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:39:14 GMT 2026
Fetching vuln.xml.xz: ..
pkg: An error occurred while fetching package
pkg: cannot fetch vulnxml file
***DONE***
I have tried different mirrors (same on both firewalls first) for updates with the same error. I only started using opnsense 4 months ago and I am getting more familiar with the product. Can anyone help please?
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:37:48 GMT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (154 candidates): .......... done
Processing candidates (154 candidates): .. done
The following 21 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cyrus-sasl-gssapi: 2.1.28 [OPNsense]
krb5: 1.22.2_3 [OPNsense]
Installed packages to be UPGRADED:
opnsense: 26.7.6 -> 26.7.7 [OPNsense]
opnsense-update: 26.7.6 -> 26.7.7 [OPNsense]
php85: 8.5.11 -> 8.5.12 [OPNsense]
php85-ctype: 8.5.11 -> 8.5.12 [OPNsense]
php85-curl: 8.5.11 -> 8.5.12 [OPNsense]
php85-dom: 8.5.11 -> 8.5.12 [OPNsense]
php85-filter: 8.5.11 -> 8.5.12 [OPNsense]
php85-gettext: 8.5.11 -> 8.5.12 [OPNsense]
php85-ldap: 8.5.11 -> 8.5.12 [OPNsense]
php85-mbstring: 8.5.11 -> 8.5.12 [OPNsense]
php85-pcntl: 8.5.11 -> 8.5.12 [OPNsense]
php85-pdo: 8.5.11 -> 8.5.12 [OPNsense]
php85-session: 8.5.11 -> 8.5.12 [OPNsense]
php85-simplexml: 8.5.11 -> 8.5.12 [OPNsense]
php85-sockets: 8.5.11 -> 8.5.12 [OPNsense]
php85-sqlite3: 8.5.11 -> 8.5.12 [OPNsense]
php85-xml: 8.5.11 -> 8.5.12 [OPNsense]
php85-zlib: 8.5.11 -> 8.5.12 [OPNsense]
Installed packages to be REINSTALLED:
openldap26-client-2.6.15_1 [OPNsense] (option changed: GSSAPI (off -> on))
Number of packages to be installed: 2
Number of packages to be upgraded: 18
Number of packages to be reinstalled: 1
The process will require 4 MiB more space.
22 MiB to be downloaded.
[ 1/21] Fetching php85-xml-8.5.12: .... done
[ 2/21] Fetching opnsense-update-26.7.7: ..... done
[ 3/21] Fetching php85-curl-8.5.12: ....... done
[ 4/21] Fetching php85-dom-8.5.12: ...
pkg-static: An error occurred while fetching package
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***
Health audit output:
***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:40:49 GMT 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.7.6 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.7.6 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
os-vmware 1.5_1
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.7.6 has 69 dependencies to check.
Checking packages: .........................
opnsense-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
opnsense-update-26.7.6 version mismatch, expected 26.7.7
Checking packages: ...
php85-ctype-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-curl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-dom-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-filter-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-gettext-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-ldap-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pcntl-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-pdo-8.5.11 version mismatch, expected 8.5.12
Checking packages: .....
php85-session-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-simplexml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sockets-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-sqlite3-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-xml-8.5.11 version mismatch, expected 8.5.12
Checking packages: .
php85-zlib-8.5.11 version mismatch, expected 8.5.12
Checking packages: ...................... done
***DONE***
Security audit output:
***GOT REQUEST TO AUDIT SECURITY***
Currently running OPNsense 26.7.6 (amd64) at Sun Oct 25 20:39:14 GMT 2026
Fetching vuln.xml.xz: ..
pkg: An error occurred while fetching package
pkg: cannot fetch vulnxml file
***DONE***
I have tried different mirrors (same on both firewalls first) for updates with the same error. I only started using opnsense 4 months ago and I am getting more familiar with the product. Can anyone help please?
#7
26.7 Series / Re: Crowdsec not starting (fou...
Last post by tangofan - October 25, 2026, 09:18:17 PMAccording to the docs at https://docs.opnsense.org/manual/aliases.html you can indeed use fully-qualified domain names in aliases, though I haven't tried that myself.
I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.
Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at irewall: Diagnostics: States on the action tab. For good measure I usually click both button there.
Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.
I am not what the Crowdsec service has to do with your GeoIP problem and I can't really comment as to what's going on with CrowdSec, so I'll focus on the GeoIP problem.
Re. exceptions lists and changes to firewall rules: The firewall is stateful, so if you change certain rules (or aliases which affect rules) you might need to reset its state at irewall: Diagnostics: States on the action tab. For good measure I usually click both button there.
Also your problem might be solved by setting your GeoIP firewall rule as an inbound rule on the WAN interface only and not on any of the LAN interfaces and VLANs. That way all your own actions, e.g. using a website in a blocked country still should work. (Don't forget to reset the firewall state after making the change.) If that doesn't help, you'll need to explain in greater detail, what scenario are you trying to cover with GeoIP and show your firewall rules.
#8
26.7 Series / Crowdsec not starting (found s...
Last post by Amodin - October 25, 2026, 07:42:39 PMReferencing this post: https://forum.opnsense.org/index.php?topic=47580.0
I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services. When I did that, Crowdsec refused to start, even after rebooting the OPN machine.
Following that post, I found it odd that I had to disable the ruleset to get it started.
1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names? I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group. It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming. It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.
I was trying to get a GeoIP exception list to work, which I can't seem to get to work, and restarted the Crowdsec service to restart from the Dashboard Services. When I did that, Crowdsec refused to start, even after rebooting the OPN machine.
Following that post, I found it odd that I had to disable the ruleset to get it started.
1.Has there been a workaround planned or in place that I am missing, and...
2.Has anyone had any luck with creating an exception list by DNS names? I even asked Grok about solutions, which was to put my alias in a network group alias and replace my rule with that group. It told me that IPs were preferred, but domain names sometimes have multiple providers/IPs and that's going to be more time consuming. It's just easier to disable GeoIP, get what I want, then re-enable it. Not a great solution, and yes my rule is above the GeoIP rule.
#9
26.7 Series / Re: PPPoE over an unassigned V...
Last post by fanski - October 25, 2026, 07:39:22 PMQuoteIt looks like something is broken in LCP/PAP (ppp[72477]: [wan_link0] LCP: auth: peer wants PAP, I want nothing).
Hi GOJ,
not sure if this is really a problem of OPNSense.
I have the same with my 26.7.1 where the connection is working.
The problem is more the "ppp[72477]: [wan_link0] MESG: Access Denied" message I guess where your provider denies your access for whatever reason.
Also it isn't the same issue I have as my PPPoE doesn't even start, yours is working. At least you are connecting to your provider while mine just times out.
Not sure but maybe there is something wrong with the access to your provider?
Regards,
Fanski
#10
High availability / Re: HA: Enter CARP Maintenance...
Last post by BoNetTech - October 25, 2026, 07:36:51 PMHi mossi2000,
Thank you for the screenshot. That page, System, High Availability, Status, shows the firmware versions of the backup unit and the services that can be restarted, and as far as I remember it never had the buttons for CARP. The firmware versions on both units are the same, which is good.
The buttons for disabling CARP and for persistent maintenance mode used to be on a different page: Interfaces, Virtual IPs, Status. Could you open that page on the master and tell us what you see there? Are the buttons missing there too?
If they are missing there, please do a full reload without cache or try a private browser window, and also check the privileges of the user you log in with, if it is not root.
It would also help to know whether the virtual addresses show as master on the first unit and backup on the second, and whether persistent maintenance mode is already active, because then the button text changes.
Sergio
Thank you for the screenshot. That page, System, High Availability, Status, shows the firmware versions of the backup unit and the services that can be restarted, and as far as I remember it never had the buttons for CARP. The firmware versions on both units are the same, which is good.
The buttons for disabling CARP and for persistent maintenance mode used to be on a different page: Interfaces, Virtual IPs, Status. Could you open that page on the master and tell us what you see there? Are the buttons missing there too?
If they are missing there, please do a full reload without cache or try a private browser window, and also check the privileges of the user you log in with, if it is not root.
It would also help to know whether the virtual addresses show as master on the first unit and backup on the second, and whether persistent maintenance mode is already active, because then the button text changes.
Sergio
