"Recent posts
#1
Tutorials and FAQs / Re: OPNsense on Older Lenovo T...
Last post by yourfriendarmando - September 22, 2026, 11:05:21 PMI have not seen ONE installer that cares about disk partition alignment, and they all tend to default to 8 byte alignment.
This part is complicated, and probably the huge reason I avoid installing from ISO unless a lot has changed across releases.
In a VM environment:
Install normally like I described above.
- Prepare a normal OPNsense installation as I described above, installed in a VM, to a VDisk of 14GB
- Confirm in /etc/fstab, that the only mountpoint is correctly using the GPT label, instead of block device:
NO: /dev/vt...p1 OR /dev/ada0p1 ... ...
YES: /dev/gpt/efiboot0 /boot/efi msdosfs rw 2 2
- prepare another Vdisk, partition with gdisk. I usually use a Linux-based distro, the utilities on them tend to not get in my way when partitioning.
- Start the first partition, EFI type, at 1MB into the disk, with size 255MB.
- Create a 2nd partition, FreeBSD-pZFS type (a504 on gdisk), size of about 15GB.
- @nero355 It will start Aligned at 256MB.
- Still in Gdisk, Copy the names of the original partitions, efiboot0 and zfs0, respectively.
- I don't think FreeBSD cares about the File system labels as much as a Linux-based distro might.
- Format the EFI partition, mount both original and new EFI partitions, copy the contents of the original, over to the new one.
- I even add a separate installation of Memtest86+ with grub, attached with various menu options and serial output for headless firewalls.
- dd the original ZFS partition, over to the new one.
- Disconnect both Vdisks, and start the VM with the Newly created Vdisk.
- Use zpool -e zOPN /dev/vtblk0p2 to expand the ZFS pool to use the remaining space above the original 14GB.
Customize your VM Firewall as much as you need, to avoid repeat work for multiple deployments
compress the image, and now you have an aligned image, ready for deployment of course in the config, replace references to vtblkX to ataX/nvmeX, and vtnetX... to igbX etc, that way the newly deployed hardware starts up with the correct interfaces ready to go. You can use the same EFI partition to store some configs from a more familiar OS to you, log into the console, copy the config.xml to /conf and reboot immediately.
This part is complicated, and probably the huge reason I avoid installing from ISO unless a lot has changed across releases.
In a VM environment:
Install normally like I described above.
- Prepare a normal OPNsense installation as I described above, installed in a VM, to a VDisk of 14GB
- Confirm in /etc/fstab, that the only mountpoint is correctly using the GPT label, instead of block device:
NO: /dev/vt...p1 OR /dev/ada0p1 ... ...
YES: /dev/gpt/efiboot0 /boot/efi msdosfs rw 2 2
- prepare another Vdisk, partition with gdisk. I usually use a Linux-based distro, the utilities on them tend to not get in my way when partitioning.
- Start the first partition, EFI type, at 1MB into the disk, with size 255MB.
- Create a 2nd partition, FreeBSD-pZFS type (a504 on gdisk), size of about 15GB.
- @nero355 It will start Aligned at 256MB.
- Still in Gdisk, Copy the names of the original partitions, efiboot0 and zfs0, respectively.
- I don't think FreeBSD cares about the File system labels as much as a Linux-based distro might.
- Format the EFI partition, mount both original and new EFI partitions, copy the contents of the original, over to the new one.
- I even add a separate installation of Memtest86+ with grub, attached with various menu options and serial output for headless firewalls.
- dd the original ZFS partition, over to the new one.
- Disconnect both Vdisks, and start the VM with the Newly created Vdisk.
- Use zpool -e zOPN /dev/vtblk0p2 to expand the ZFS pool to use the remaining space above the original 14GB.
Customize your VM Firewall as much as you need, to avoid repeat work for multiple deployments
compress the image, and now you have an aligned image, ready for deployment of course in the config, replace references to vtblkX to ataX/nvmeX, and vtnetX... to igbX etc, that way the newly deployed hardware starts up with the correct interfaces ready to go. You can use the same EFI partition to store some configs from a more familiar OS to you, log into the console, copy the config.xml to /conf and reboot immediately.
#2
Q-Feeds (Threat intelligence) / Re: [Feature Request] DNSBL in...
Last post by Wrigleys - September 22, 2026, 09:31:58 PMHi and thanks for your follow-up. The reason why I'm asking is to make sure to cover relevant alternative subdomain URL combinations like www.baddomain[.]com, www2.baddomain[.]com or just baddomain[.]com
If I was an attacker I would change the subdomain more often to get rid of any static blocklist entries. A wildcard entry would block it in any way possible, but the chances to block false positive is a valid argument.
either way, many thanks for your feedback.
Many thanks and stay safe
Wrigleys
If I was an attacker I would change the subdomain more often to get rid of any static blocklist entries. A wildcard entry would block it in any way possible, but the chances to block false positive is a valid argument.
either way, many thanks for your feedback.
Many thanks and stay safe
Wrigleys
#3
26.7 Series / Re: [Regression] Intel em0 WoL...
Last post by franco - September 22, 2026, 09:12:22 PMIt looks urgent, but not urgent enough to have actually met the 2 week time frame to be added to stable/15. I'm watching the branch closely in the hope that it lands there before 26.7.5 needs to be pushed out.
Cheers,
Franco
Cheers,
Franco
#4
Q-Feeds (Threat intelligence) / Re: [Feature Request] DNSBL in...
Last post by Q-Feeds - September 22, 2026, 08:54:38 PMVery sorry for the late reply... the reason we are not supporting wildcard formats is because it creates too much false positives. while some domains could be 'collapsed' in the feed, the benefit of wildcarding those will be very small. Or are we missing something?
#5
26.7 Series / [Regression] Intel em0 WoL fix...
Last post by Phil - September 22, 2026, 08:47:56 PMHi,
Following up on previous reports regarding the Intel em0 (82567LM-3) Wake-on-LAN breaking after a clean software shutdown on FreeBSD 14+ (previously tracked in closed GitHub issue #278: https://github.com/opnsense/src/issues/278), an upstream fix has just been merged in FreeBSD:
FreeBSD Bug: 295443
Commit: 46cf612d98e9 (e1000: Rework Wake-on-LAN policy and programming by Kevin Bowling, Aug 31, 2026)
URL: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295443
Since this commit fixes the PCH Sx workarounds and keeps the link powered while host wake is armed, is this patch scheduled to be included in an upcoming OPNsense release, and if so, when can we expect it?
Thank you for your amazing work on OPNsense!
Best regards
Following up on previous reports regarding the Intel em0 (82567LM-3) Wake-on-LAN breaking after a clean software shutdown on FreeBSD 14+ (previously tracked in closed GitHub issue #278: https://github.com/opnsense/src/issues/278), an upstream fix has just been merged in FreeBSD:
FreeBSD Bug: 295443
Commit: 46cf612d98e9 (e1000: Rework Wake-on-LAN policy and programming by Kevin Bowling, Aug 31, 2026)
URL: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295443
Since this commit fixes the PCH Sx workarounds and keeps the link powered while host wake is armed, is this patch scheduled to be included in an upcoming OPNsense release, and if so, when can we expect it?
Thank you for your amazing work on OPNsense!
Best regards
#6
Tutorials and FAQs / Re: OPNsense on Older Lenovo T...
Last post by nero355 - September 22, 2026, 07:03:56 PMQuote from: yourfriendarmando on September 22, 2026, 05:50:50 PMAfterward, I use DD to put the the working system to a new disk and resize.Mind your SSD's partition alignment to avoid write amplification :)
#7
26.7 Series / No console access after latest...
Last post by TechM4nCO - September 22, 2026, 07:03:09 PMI am a new user to OPNsense comming from using PFsense for years.
I ran into a few issues using OPSense on my Protectli VAULT v1410.
When installing a fresh build initially I had only one issue with regard to a CAM timeout that apears to be a FreeBSD issue. When I removed the USB stick from the usb ports on boot this resolved the issue.
After upgrading to the latest build : 26.7.4_1
I ran into an issue where physical VGA output and serial console access were both lost after initial boot.
The console would show messages and then just stop.
I managed to resolve the console issue with the following:
Issue workaround:
GO into GUI : System → Settings → Administration → Console
Set following:
Primary Console: VGA Console
Secondary Console: Serial Console
Serial Speed: 115200
USB-based serial: UNCHECKED
Console menu: CHECKED
In my system after a fresh install, Secondary console was set to NONE.
I am going to see if I can figure out a workaround for the CAM delay issue when a KVM device is plugged into the firewall.
Ill post back here with results.
I hope this might help anyone with similar issues on this build.
I ran into a few issues using OPSense on my Protectli VAULT v1410.
When installing a fresh build initially I had only one issue with regard to a CAM timeout that apears to be a FreeBSD issue. When I removed the USB stick from the usb ports on boot this resolved the issue.
After upgrading to the latest build : 26.7.4_1
I ran into an issue where physical VGA output and serial console access were both lost after initial boot.
The console would show messages and then just stop.
I managed to resolve the console issue with the following:
Issue workaround:
GO into GUI : System → Settings → Administration → Console
Set following:
Primary Console: VGA Console
Secondary Console: Serial Console
Serial Speed: 115200
USB-based serial: UNCHECKED
Console menu: CHECKED
In my system after a fresh install, Secondary console was set to NONE.
I am going to see if I can figure out a workaround for the CAM delay issue when a KVM device is plugged into the firewall.
Ill post back here with results.
I hope this might help anyone with similar issues on this build.
#8
Tutorials and FAQs / Re: OPNsense on Older Lenovo T...
Last post by yourfriendarmando - September 22, 2026, 05:50:50 PMIf you booted into the USB through the CSM, it would make sense the installer would format the system meant to start the same way. The UEFI boot method has worked fine for me these past several releases.
I tend to shut off the CSM completely, disable secure boot and format the USB for strictly booting in UEFI mode.
In the installer, I think I chose the option ZFS UEFI Mode, no hybrid. It may be an advanced option. I also opt out of creating a swap partition. I haven't installed from ISO in a while since I setup the system in a VM and upgrade it there. Afterward, I use DD to put the the working system to a new disk and resize.
I tend to shut off the CSM completely, disable secure boot and format the USB for strictly booting in UEFI mode.
In the installer, I think I chose the option ZFS UEFI Mode, no hybrid. It may be an advanced option. I also opt out of creating a swap partition. I haven't installed from ISO in a while since I setup the system in a VM and upgrade it there. Afterward, I use DD to put the the working system to a new disk and resize.
#9
General Discussion / Re: UDP Broadcast Relay
Last post by dw - September 22, 2026, 05:17:52 PMQuote from: space_ranger on December 09, 2024, 04:29:13 PMAnyone know how to debug this not starting?
the error isCode SelectNotice root /usr/local/etc/rc.d/os-udpbroadcastrelay: WARNING: failed to start osudpbroadcastrelay
For reference, OPNsense 2026.7.4_1 / os-udpbroadcastrelay 1.0_6 still logs these messages, but services are actually running and work fine.
In addition, it would be really nice if the plugin would support port ranges. For example; Steam uses UDP ports 27031-27036 for LAN discovery which now results in 6 separate services on the dashboard.
#10
26.7 Series / Re: OPNsense HA + BGP with our...
Last post by pa3weg - September 22, 2026, 05:01:27 PMQuote from: Patrick M. Hausen on September 17, 2026, 07:03:13 PMI'd recommend not to combine the redundant BGP and the redundant firewall functions on the same devices. BGP routers typically each run their own eBGP session(s) to your peers and iBGP among each other. Asymmetric routing is expected and not a problem. Then you place the firewall pair behind the routers. Both firewalls and routers run CARP, HSRP or VRRP depending on the vendor.This is the way!
I have had this running for a few years now without any significant downtime. My ISP is providing the BGP sessions for me and terminates them in to one VRRP IP to use as transport net and I provide them a CARP IP as next hop for the subnet.
Works with IPv6 as well, although in that case it's prefix delegations in stead of a routed subnet.
Since CARP and VRRP are very similar, make sure to use a different VHID group to that of your ISP, or it will be very funky!
