Recent posts

#1
High availability / Re: Some direction for HA conf...
Last post by Machito - Today at 08:50:56 AM
Quote from: Lipaz on September 21, 2026, 06:51:53 PMHello,

before i start, i would love to have links with information on how to, here are some questions i didnt found written documentation on the process.

my goal is two setup 2 VM with OPNSense and i have few question:
* if i want to add another happymod interface, what will be the process?
* is there an option to have 2 interfaces without VIP and use them as management port?
* what is the best recommendation to monitor HA status with remote monitor platform? are the alerts send via SNMP?

thanks


Are you using a virtual switch or dedicated VLANs for those extra interfaces?
#2
General Discussion / Re: Beta testers and reviewers...
Last post by Kornelius777 - Today at 08:47:23 AM
BUMMER!
Easy to install, works like a charm!

THANK YOU!
#3
Hardware and Performance / Re: 10G but reaching only 5-5....
Last post by ou1 - Today at 07:53:57 AM
Quote from: stanps on Today at 03:04:55 AMI don't see that anyone has recommended this, and it may not be feasible but....you could plug a machine directly in to you ISP's endpoint and do a speed test from there. And then plug directly in to your OPNSense fw and check from there.

You might not have full bandwidth on the public side of your fw.  It may not even be an OPNSense issue.

It's definitely not an ISP issue, i get full speed with different machine, same opnsense config and sfp+ modules. CPU on DEC 750 is too slow for 10G, unless there are some config options that we've missed.
#4
26.7 Series / Re: Default Deny / State Viola...
Last post by peterwkc - Today at 04:39:02 AM
After 1 hour of running the fw, it get back to normal. Thread closed.
#5
26.7 Series / Default Deny / State Violation...
Last post by peterwkc - Today at 04:33:31 AM
Dear all hacker, I did not touch my firewall for quite some time but after i woke up today. My whole internet is not working. Therfore, I try look out the firewall log then found out that all valid connection is drop by the firewall.

Please help me on this as i having no internet now.

#6
26.7 Series / Some observations that may be ...
Last post by erwinvanlonden - Today at 04:07:41 AM
I observed some issues with 26.7.4 which caused Unbound to fail and therefore basically killed off my internet access.
This is a home setup so it would not likely to hit businesses that have dedicated hardware.

I run OpnSense in a Proxmox VM with 2 WAN interfaces directly bridged from the hardware into OpnSense as well as 1 LAN interface with around 8 VLAN's stacked on top of that.

By default when you instantiate a VM in a somewhat older Proxmox version, it will attach a x86_64 processor (depending on the underlying hardware). This will become incompatible with some of the later Python libraries such as NumPy which seem to require some fancy processor features that are exposed with newer processor architectures. Therefore when I changed the underlying virtual cpu to x86-64-v2 in Proxmox and rebooted the VM, that problem went away.

Another issue that I encountered was also related to Unbound.
Apparently one of the local network systems had registered with an unsupported hostname "xxxxx." (mind the . at the end)  via DHCP. I didn't see this at first and just assigned a static IP address for this system in Kea without modifying the hostname. This causes that hostname to show up in the Unbound static list as well when you have Opnsense configured to do so via the "Register DHCP Static Mappings" setting.

As the "." will cause a concatenation of hostname and domainname resulting in something like "xxxx..example.com". That will cause Unbound to fail as it cannot load an empty zone "..example.com". You'll run into errors like:

```
2026-09-24T22:49:17 Critical unbound [79215:0] fatal error: Could not set up local zones
2026-09-24T22:49:17 Error unbound [79215:0] error: Bad local-data RR xxxxx..example.com IN A 10.10.10.10
2026-09-24T22:49:17 Error unbound [79215:0] error: error parsing local-data at 12 'xxxxx..example.com IN A 10.10.10.10': Empty label
```

After I corrected the hostname and registration in Kea, unbound could start normally.

Not sure if anyone has run into the same issue(s) but it may come in handy to have it posted here for future reference.

Cheers
Erwin
#7
New firmware has been published for

DEC800, DEC3800 & DEC4000 series
  09-2026 Version 05.22.01.0029.0020


DEC700 and DEC2700 series
  09-2026 Version 05.3A.17.0031-A10.37
#8
Hardware and Performance / Re: 10G but reaching only 5-5....
Last post by stanps - Today at 03:04:55 AM
I don't see that anyone has recommended this, and it may not be feasible but....you could plug a machine directly in to you ISP's endpoint and do a speed test from there. And then plug directly in to your OPNSense fw and check from there.

You might not have full bandwidth on the public side of your fw.  It may not even be an OPNSense issue.
#9
26.7 Series / ACME cron renewal fails but ma...
Last post by arrowd - Today at 01:38:44 AM
I set up the ACME service on my OPNsense (v26.7.4_1 on a Protectli V1410) in the spring. The problem I describe happened at the first cert renewal, but I decided to wait for the next run to see if it repeated. The certificate was due for replacement yesterday but the cron job failed. I then ran it manually and it succeeded without my changing any setting. I have my domain DNS at Cloudflare. My TrueNAS is set up similarly and the ACME runs correctly there. This is apparently a commmon problem on OPNsense as I found at least two separate forum posts saying essentially the same thing. Neither had a solution with people just saying they would renew manually when needed. Do you think this is a permission problem? A Cloudflare problem? Thanks for reading.

Below is the log in debug format. I replaced my domain name with 'mydomainname' and my unique numbers with equal length strings of 'a','b','c','x', or 'y'. The two sets of long log lines between cron/manual runs are identical.

2026-09-24T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net

2026-09-23T13:44:08-04:00configAcmeClient: running automation (configd): Restart Web GUI
2026-09-23T13:44:08-04:00configAcmeClient: running automations for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: updated ACME X.509 certificate: opnsense.mydomainname.net (ccccccccccccccc)
2026-09-23T13:44:08-04:00opnsenseAcmeClient: successfully issued/renewed certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T13:43:38-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T13:43:38-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T13:43:38-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net

2026-09-23T00:00:01-04:00opnsenseAcmeClient: validation for certificate failed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: domain validation failed (dns01)
2026-09-23T00:00:01-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '2': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T00:00:00-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T00:00:00-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T00:00:00-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net

2026-09-22T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net
#10
Need to look deeper.

Quote from: bot0x1458 is indeed the AMD EPYC integrated 10-GbE controller used by FreeBSD's axp driver. The important detail is that FreeBSD's driver was added as an iflib-based driver, and the hardware exposes separate RX DMA queues and management counters. If traffic works but RX counters remain at zero, this is likely a driver/statistics-path problem rather than PCI identification.

EPYC's do have various implementations of the PHY, but I see most (the newer stuff) use the axp driver. The pciconf shows a device ID that supposedly uses the newer AXP code, but technically still from the amd-xgbe module.

I suspect an iflib issue.

What AMD EPYC is it exactly?


https://cgit.freebsd.org/src/commit/?id=7113afc84c0