Recent posts

#1

26.1, 26,4 Series / Re: samplicate pegging cpu

Last post by ubu - Today at 11:13:28 AM

So that means it's set to capture. Not sure how else I can help you.

This will definitely kill the configuration if you confirm deletion... you can recheck with -g

# pluginctl -f OPNsense.Netflow


Cheers,
Franco

running that command and then killing samplicate results in the same reboot loop. is there any log files I can provide that would show why it goes into a reboot loop once that command is run?

#2

26.7 Series / Re: Reject Rules on 26.7

Last post by feelx - Today at 11:04:18 AM

So a "Reject" is translated to "Block Return@:
       This  causes  a  TCP  RST to be returned for tcp(4) packets, an
       SCTP ABORT for SCTP and an ICMP UNREACHABLE for UDP  and  other
       packets.

Thanks for the info, But for me ( and I may have done it wrong),  a tcpdump did not reveal any ICMP Unreachable ( in case of my icmp Ping) but as mentioned, that could be an upstream issue.

Thanks all

#3

German - Deutsch / Re: 'Migration Assistant ' der...

Last post by stulpinger - Today at 10:38:13 AM

Alles klar
Migration hab ich schon beim Ersten Auftauchen des Assistenten gemacht

LG

C

#4

Announcements / Re: OPNsense 26.4.2 business e...

Last post by franco - Today at 09:37:14 AM

Here are the full patch notes for patch release 2:

o system: make compare operator in authTOTP() more strict
o interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
o ipsec: add some hybrid post-quantum variants as additional key exchange
o acl: fix API patters for GIF/GRE device settings
o acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
o rc: add watchdog to shutdown, reboot and reload_all cases
o ports: strongswan 6.1.0[34]
o ports: suricata 8.0.7[35]
o ports: unbound 1.26.1[36]

--
[34] https://github.com/strongswan/strongswan/releases/tag/6.1.0
[35] https://suricata.io/2026/09/15/suricata-8-0-7-released/
[36] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-1

#5

26.7 Series / Re: Reject Rules on 26.7

Last post by franco - Today at 09:25:52 AM

Quoting the man page here for further reference:

Code Select Expand

     block
   The packet is blocked.  There are a number of ways in which a block
   rule can behave when blocking a packet.  The default behaviour is  to
   drop  packets  silently,  however  this can be overridden or made ex-
   plicit either globally, by setting the block-policy option, or  on  a
   per-rule basis with one of the following options:

   drop  The packet is silently dropped.
   return-rst
This applies only to tcp(4) packets, and issues a TCP RST which
closes the connection.
   return-icmp
   return-icmp6
This  causes  ICMP  messages  to  be returned for packets which
match the rule.  By default this is an  ICMP  UNREACHABLE  mes-
sage, however this can be overridden by specifying a message as
a code or number.
   return
This  causes  a  TCP  RST to be returned for tcp(4) packets, an
SCTP ABORT for SCTP and an ICMP UNREACHABLE for UDP  and  other
packets.

   Options  returning ICMP packets currently have no effect if pf(4) op-
   erates on a if_bridge(4), as the code to support this feature has not
   yet been implemented.
Currently we only do "block return" in the sense that it is documented, with the caveat that if it's not working as documented it would be a FreeBSD issue.

One could try the other options if they work more reliably (e.g. return-icmp) here:

https://github.com/opnsense/core/blob/dc5fdc67f08ab2247bb1936014972def2f7a8a33/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php#L85


Cheers,
Franco

#6

German - Deutsch / Re: 'Migration Assistant ' der...

Last post by Patrick M. Hausen - Today at 09:05:46 AM

In 26.1 waren beide Menüs vorhanden, um bei der Migration zu helfen. In 26.7 gibt es nur noch das neue Menü. Schließlich hättest du die Migration vor dem Update auf 26.7 vollziehen sollen.

Wenn du in 26.7 und später unbedingt das alte Menü weiter benutzen willst, musst du selbst das Plugin installieren.

Jetzt klar?

#7

26.7 Series / Re: Reject Rules on 26.7

Last post by feelx - Today at 08:56:00 AM

ok, thanks for digging into this so deeply.

so to summarise
* Upstream issue with PF for icmp-reply
* "BLOCK" instead of Reject is also a know upstream issue

Thanks for the explanation. I just need to live with this I Guess.

#8

26.7 Series / Re: Post 26.7.4 Wireless Issue

Last post by franco - Today at 08:12:42 AM

Hi there,

This sounds like a buggy card at first glance and the underlying code didn't really change... so just to make sure:

Did you hit apply when changing between BSS/AP each time? Because only then the reconfiguration kicks in.


Cheers,
Franco

#9

26.7 Series / Re: Unbound DNSSec Validator v...

Last post by franco - Today at 08:10:50 AM

Yeah, it was hotfixed yesterday in 26.7.4. Business 26.4.2p2 is coming out later today, too.


Cheers,
Franco

#10

German - Deutsch / Re: 'Migration Assistant ' der...

Last post by stulpinger - Today at 07:54:18 AM

mein OPNsense ist auf 26.7.4_1
nur noch Rules im Menü 😎

Der "Rules [legacy]" Menüeintrag erscheint nur, wenn du das os-firewall-legacy Plugin installiert hast. Die Migration der alten Regeln ist aber auch ohne dieses Plugin möglich.

Aha, habe aber das Plugin nicht wissentlich entfernt, hatte bis jetzt beide Menü-Einträge bzgl. Rules