Recent posts

#1

26.7 Series / ACME cron renewal fails but ma...

Last post by arrowd - Today at 01:38:44 AM

I set up the ACME service on my OPNsense (v26.7.4_1 on a Protectli V1410) in the spring. The problem I describe happened at the first cert renewal, but I decided to wait for the next run to see if it repeated. The certificate was due for replacement yesterday but the cron job failed. I then ran it manually and it succeeded without my changing any setting. I have my domain DNS at Cloudflare. My TrueNAS is set up similarly and the ACME runs correctly there. This is apparently a commmon problem on OPNsense as I found at least two separate forum posts saying essentially the same thing. Neither had a solution with people just saying they would renew manually when needed. Do you think this is a permission problem? A Cloudflare problem? Thanks for reading.

Below is the log in debug format. I replaced my domain name with 'mydomainname' and my unique numbers with equal length strings of 'a','b','c','x', or 'y'. The two sets of long log lines between cron/manual runs are identical.

2026-09-24T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net

2026-09-23T13:44:08-04:00configAcmeClient: running automation (configd): Restart Web GUI
2026-09-23T13:44:08-04:00configAcmeClient: running automations for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: updated ACME X.509 certificate: opnsense.mydomainname.net (ccccccccccccccc)
2026-09-23T13:44:08-04:00opnsenseAcmeClient: successfully issued/renewed certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T13:43:38-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T13:43:38-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T13:43:38-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net

2026-09-23T00:00:01-04:00opnsenseAcmeClient: validation for certificate failed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: domain validation failed (dns01)
2026-09-23T00:00:01-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '2': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T00:00:00-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T00:00:00-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T00:00:00-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net

2026-09-22T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net

#2

Hardware and Performance / Re: amd-xgbe ("ax"): interface...

Last post by BrandyWine - Today at 01:12:45 AM

Need to look deeper.

0x1458 is indeed the AMD EPYC integrated 10-GbE controller used by FreeBSD's axp driver. The important detail is that FreeBSD's driver was added as an iflib-based driver, and the hardware exposes separate RX DMA queues and management counters. If traffic works but RX counters remain at zero, this is likely a driver/statistics-path problem rather than PCI identification.

EPYC's do have various implementations of the PHY, but I see most (the newer stuff) use the axp driver. The pciconf shows a device ID that supposedly uses the newer AXP code, but technically still from the amd-xgbe module.

I suspect an iflib issue.

What AMD EPYC is it exactly?


https://cgit.freebsd.org/src/commit/?id=7113afc84c0

#3

26.1, 26,4 Series / Re: Unstable internet connecti...

Last post by pseudonym3k - September 24, 2026, 10:38:40 PM

Changing Data Length from the default 1 to 56 has already made a dramatic difference for me, so thanks for that. But I think the larger problem is still relying on a single monitor IP as the authority for whether a gateway is usable.

I'm glad it helped, having found that was a game changer for me as well.
That said, I have never found a monitor IP that was 100% reachable when my internet connection was fine, so I ended up turning it off as I had more false positives than it helped. Fine in my case since I'm just one house with one connection. What we both have mentioned - multiple monitor IPs and if all are unreachable then assume the connection is down - seems the only practical use of the function, yet it doesn't exist. Unless I'm missing something...

#4

Hardware and Performance / Re: Upgrade from J6413 Questio...

Last post by Nullman - September 24, 2026, 09:05:40 PM

The thing is, such N1x0 units were like 300€ complete with 16 GByte RAM and 256 GByte SSD a year ago.

I hear ya. Unfortunately, there is nothing we can do about this. And its only going to get worse.

Now they are more like 600€ (both assuming good brands, not el cheapo no-name SSDs that fail after one year of heavy ZFS use).

I was always an advocate for expensive high quality stuff. And considering how bad things are today, that was a smart move on my end. I hope you have high quality hardware on your end as well.

#5

General Discussion / Re: Regular Summary Report via...

Last post by ratta-tat - September 24, 2026, 08:38:45 PM

Hey again,

8 years are gone since I posted here. In 2024 I finally moved away from Sophos/UTM to OPNsense.

That Topic about Executive Reporting never let me go. Stock OPNsense never provided an reporting feature like that.
And If you are using this since Astaro days you'll miss that.

So I decided to create an external software that does exactly this Executive Reporting!
Most data is provided by the OPNsense and can get via the API, but some data you need to to sample/collect external.

Now I have my first version of this Executive Reporting ready and running.

The whole thing is Python based and runs as service with a small WebUI. A Raspi is suitable for this.
It can create reports inspired by the classic look and runs manually triggered or on a daily/weekly/monthly scheduled base.
 
I will test this tool now for a while now and will then upload a version on Github.

#6

26.7 Series / Re: [26.7.4_1]Intermittent con...

Last post by dragao-azul - September 24, 2026, 07:50:47 PM

I haven't yet tried your suggestions - I had to get reliable internet for the day so I've switched to my ISP router. Interesting things happened though.

I switched my opnsense WAN from PPPoE to DHCP and connected it to my ISP router. And it's been working again since then (the opnsense connection that is - I kept everything running). I'll give it one day or so (same time as before) to see if it breaks again or if PPPoE is a factor.

The changes I did was change the WAN interface, reduce the MTU from 1508 to 1500 and I had a physical (I called it WANETH) interface for the physical (well, later virtualised) interface to also just set the MTU to 1508 which I removed for now. Unrelated but since it may not be very orthodox I did test this MTU and it was working without breaking packets.

I'll try what you suggest either when this fails with DHCP or I'll simply go back to PPPoE to try tomorrow or on the weekend worst case.

Thanks again!

#7

Hardware and Performance / Re: Upgrade from J6413 Questio...

Last post by meyergru - September 24, 2026, 06:34:27 PM

The thing is, such N1x0 units were like 300€ complete with 16 GByte RAM and 256 GByte SSD a year ago. Now they are more like 600€ (both assuming good brands, not el cheapo no-name SSDs that fail after one year of heavy ZFS use).

#8

Zenarmor (Sensei) / Re: Cannot allocate memory

Last post by oldRaven - September 24, 2026, 05:05:48 PM

I had to do the same as of September 2026
(OPNsense 26.7.4_1-amd64)

System Tunables to -
dev.netmap.buf_num: 1000000
dev.netmap.admode: 0   
dev.netmap.ring_num: 256   
dev.netmap.buf_size: 4096

and reboot.

Many thanks!

#9

Virtual private networks / Re: Validating the WireGuard V...

Last post by marsk - September 24, 2026, 04:26:32 PM

Not only understanding the flow is important for me.

I have worked as an infrastructure architect for many years on servers, virtualization, and storage,
not networks, and I am dyslexic.

Having a diagram gives me a grip of a system within three seconds, and the same goes for my colleagues and customers.
All documentation I write for systems I deploy always starts with a diagram.

So I really want to thank you for helping me.

I also think the documentation for OPNsense really could benefit from some diagrams for easier understanding.

//marsk

#10

Development and Code Review / Re: Notify plugin: send push n...

Last post by yeraycito - September 24, 2026, 04:19:01 PM

Notification services with multiple options and various events for which notifications can be received.

Plugin changelog: https://pkg.greelan.net/changelog/os-notify-greelan.html