"Recent posts
#1
26.7 Series / Re: Audit - security
Last post by chemlud - Today at 04:16:27 PM...see here:
https://docs.opnsense.org/security.html
WARNING BOX
At least not this gem:
https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html
https://docs.opnsense.org/security.html
WARNING BOX
At least not this gem:
https://lists.freebsd.org/archives/freebsd-announce/2026-July/000301.html
#2
26.7 Series / High volume of DNS queries for...
Last post by WiteWulf - Today at 04:01:10 PMHi, I'm running opnsense 26.7.1_1 as guest on proxmox
Since enabling Unbound DNS in Reporting I've noticed that the device is making a large number of A and AAAA DNS queries against itself (ie. the source is localhost) for whatever mirror is configured in System->Firmware->Mirror
At first I notice that www.mirrorservice.org was no. 1 in the top ten passed domains. When I changed this back to the default it was soon replaced with pkg.opnsense.org
Examining the Reporting->Unbound->Details I see that the device is querying whichever source is configured on average 5 times a second, with ~200k queries for the two mirrors I've had configured in the last 24hrs. The behaviour doesn't change if I select a different firmware mirror.
Example logging:
This doesn't seem right to me. Is this expected behaviour? It feels like some script to check for updates is stuck in a loop.
Since enabling Unbound DNS in Reporting I've noticed that the device is making a large number of A and AAAA DNS queries against itself (ie. the source is localhost) for whatever mirror is configured in System->Firmware->Mirror
At first I notice that www.mirrorservice.org was no. 1 in the top ten passed domains. When I changed this back to the default it was soon replaced with pkg.opnsense.org
Examining the Reporting->Unbound->Details I see that the device is querying whichever source is configured on average 5 times a second, with ~200k queries for the two mirrors I've had configured in the last 24hrs. The behaviour doesn't change if I select a different firmware mirror.
Example logging:
Code Select
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. Pass Cache NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489 This doesn't seem right to me. Is this expected behaviour? It feels like some script to check for updates is stuck in a loop.
#3
26.7 Series / Re: ISC DHCPv4 Static Button t...
Last post by Monviech (Cedrik) - Today at 03:34:38 PMNo, its only planned for the business edition (the plugin), the binary itself is freely available though, but of course without the GUI nicities (we really worked hard on making that GUI nice).
For community the focus is on dnsmasq as it can do everything a home network needs in a single package.
I also worked with powerdns clusters before, synchronized over mariadb for ISP purposes. So I knew that tool is great, also it's NL based which is a win for europe in general.
For community the focus is on dnsmasq as it can do everything a home network needs in a single package.
I also worked with powerdns clusters before, synchronized over mariadb for ISP purposes. So I knew that tool is great, also it's NL based which is a win for europe in general.
#4
26.7 Series / Re: ISC DHCPv4 Static Button t...
Last post by tessus - Today at 03:24:32 PMQuote from: Patrick M. Hausen on Today at 02:45:34 PMAfter all that's supposed to run on your Windows domain controllers in your enterprise with a couple of thousand seats.
What is Windows?
Quote from: Patrick M. Hausen on Today at 02:45:34 PMSeriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it?
Yes, I do this as well. All my VMs/LXCs and physical machines who provide a service use either a static IP address (rarely) or a static DHCP mapping (frequently).
Quote from: Patrick M. Hausen on Today at 02:45:34 PMWhy would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records? I fail to see the use case.
Especially in test environments or prod envs with ephemeral VMs/LXCs that need to talk to each other a dynamic mapping is very helpful. Of course one can create scripts to manage static mappings or assign static IPs, but it's a matter of convenience. In most cases I don't care about Paddy's MacBook or Gabi's iPad. Unless I want to transfer data and there is no mDNS available. But I agree... this is not very likely.
My main point was rather that I have a perfectly working env right now. As soon as I migrate to 26.7, my setup will break and I will have to migrate to DNSmasq - whether I want or not. Don't get me wrong, it was clear to me that I would have to migrate at one point in the future. But I hoped it would not be so soon. And I am just disappointed that something that has worked perfectly will stop working.
Quote from: Monviech (Cedrik) on Today at 02:54:30 PMIn the business edition we will soon have a PowerDNS based plugin.
Will this be available for the community edition?
PowerDNS is awesome. I worked for one of the biggest domain resellers and administered a few PowerDNS clusters... However, this seems a bit of an overkill for my home network. Haha.
#5
26.7 Series / Re: ISC DHCPv4 Static Button t...
Last post by Monviech (Cedrik) - Today at 02:54:30 PMIn the business edition we will soon have a PowerDNS based plugin. So if you use that, you will have full KEA RFC2136 support in the same support tier as all other opnsense core products.
This is the only clean way, RFC2136 requires an authoritative nameserver, Unbound is by design just a forwarder and whatever scripts you throw at it is less than optimal to emulate authoritative nameserver behavior.
https://github.com/opnsense/docs/blob/opndns/source/vendor/deciso/opndns.rst
Tools from experts for experts :)
(Also with proper HA support, which would be a challenge with KEA otherwise)
This is the only clean way, RFC2136 requires an authoritative nameserver, Unbound is by design just a forwarder and whatever scripts you throw at it is less than optimal to emulate authoritative nameserver behavior.
https://github.com/opnsense/docs/blob/opndns/source/vendor/deciso/opndns.rst
Tools from experts for experts :)
(Also with proper HA support, which would be a challenge with KEA otherwise)
#6
26.7 Series / Re: ISC DHCPv4 Static Button t...
Last post by Patrick M. Hausen - Today at 02:45:34 PMThere are/were commercially succesful firewalls that did not bring a DHCP server at all. After all that's supposed to run on your Windows domain controllers in your enterprise with a couple of thousand seats.
Seriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it? Why would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records? I fail to see the use case. Plus there is mDNS almost everywhere today.
P.S. Plus for a home setup and if you expect Fritzbox equivalent behaviour, you can always use DNSmasq, if I am not mistaken. I prefer Kea, because for me DNSmasq throws too many functions/roles into a single product.
Seriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it? Why would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records? I fail to see the use case. Plus there is mDNS almost everywhere today.
P.S. Plus for a home setup and if you expect Fritzbox equivalent behaviour, you can always use DNSmasq, if I am not mistaken. I prefer Kea, because for me DNSmasq throws too many functions/roles into a single product.
#7
26.7 Series / Re: "old" rules show up in "Ru...
Last post by tessus - Today at 02:43:53 PMQuote from: nero355 on August 05, 2026, 03:59:09 PMI think a lot of people would be less confused if they would just keep an eye on the Release Notes carefully each time there is an update/upgrade
I always do that and I've also read the Migration Assistant notes, but I do not recall any mentioning of references showing up on the new rules page. It's possible that I missed it though...
#8
26.7 Series / Re: ISC DHCPv4 Static Button t...
Last post by tessus - Today at 02:30:26 PMQuote from: Monviech (Cedrik) on July 30, 2026, 03:34:46 PMThe ISC plugin is legacy since a while now and EOL.
I am sorry. KEA is unusable without registering dynamic leases. Period. There is no other way to say this. If you need that functionality (which is why most people who need it either still use ISC (like myself) or migrate to DNSmasq, KEA is utterly useless. And it will stay that useless, unless there is a workaround (as you mentioned via a community plugin or the powerdns plugin). However without proper documentation (how to transition your perfect ISC setup to KEA + plugin + whatever (w/o losing any features/functionality)) this is also just a theory.
It was mentioned back then that ISC will still work, which I guess should have read "it will still work, until it doesn't, and then you are screwed".
Please forgive my disappointment, but it is still hard to grasp how a project can replace one of the most important subsystems of a router (OPNsense's main purpose is still a firewall/router, is it not?) with something that is useless out of the box.
Having access to your devices via DNS in your home network is one of the most important things. Sorry, but some people use DHCP instead of fixed IP addresses.
But maybe the scorching heat is just ravaging and melting my brain. Right now I can't tell. (In which case I apologize in advance.)
#9
German - Deutsch / Re: Interfaces anpassen: WAN a...
Last post by Monviech (Cedrik) - Today at 02:25:30 PMDer Plan ist es, dass es irgendwann in der GUI möglich ist.
https://github.com/opnsense/core/issues/7522
Ansonsten config.xml backup bearbeiten und halt sehr aufpassen und dann importieren.
https://github.com/opnsense/core/issues/7522
Ansonsten config.xml backup bearbeiten und halt sehr aufpassen und dann importieren.
#10
German - Deutsch / Interfaces anpassen: WAN als w...
Last post by Stephan M. - Today at 02:20:24 PMHallo,
ich vermisse eine Funktion, um die WAN-Schnittstelle auch als Identifier wan statt in unserem Fall opt7 zuzuweisen, da wir eine umfangreiche zentrale Firewallkonfiguration vorhaben und dabei die Adapter (Identifier) identisch sein müssen. Daher ist es erforderlich die Identifier der jeweiligen Interfaces im Assignment entsprechend einheitlich zuwiesen zu können. Jedoch scheint es keine Funktion über die WebGUI zu geben eine Schittstelle als WAN mit dem Identifier wan zu belegen.
Der Versuch über die Konsole ermöglicht dies, hat aber zur Folge, dass alle anderen Adapter aufgelöst werden. Vermutlich wird über die Konsole ein Status-quo erzeugt, also alle bisherigen Adapter, die an dieser Stelle nicht erneut zugewiesen werden, werden entfernt.
Hat jemand einen guten Tipp, welche Möglichkeiten es geben könnte, den aktuellen Adapter opt7 in wan umzubennen, ohne die bisherigen 7 Inferfacezuweisungen (HA, MGMT, VLANs, usw.) aufzulösen.
Danke im Voraus!
Beste Grüße
Stephan M.
ich vermisse eine Funktion, um die WAN-Schnittstelle auch als Identifier wan statt in unserem Fall opt7 zuzuweisen, da wir eine umfangreiche zentrale Firewallkonfiguration vorhaben und dabei die Adapter (Identifier) identisch sein müssen. Daher ist es erforderlich die Identifier der jeweiligen Interfaces im Assignment entsprechend einheitlich zuwiesen zu können. Jedoch scheint es keine Funktion über die WebGUI zu geben eine Schittstelle als WAN mit dem Identifier wan zu belegen.
Der Versuch über die Konsole ermöglicht dies, hat aber zur Folge, dass alle anderen Adapter aufgelöst werden. Vermutlich wird über die Konsole ein Status-quo erzeugt, also alle bisherigen Adapter, die an dieser Stelle nicht erneut zugewiesen werden, werden entfernt.
Hat jemand einen guten Tipp, welche Möglichkeiten es geben könnte, den aktuellen Adapter opt7 in wan umzubennen, ohne die bisherigen 7 Inferfacezuweisungen (HA, MGMT, VLANs, usw.) aufzulösen.
Danke im Voraus!
Beste Grüße
Stephan M.
