"Recent posts
#1
Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...
Last post by mlenje - Today at 03:51:07 AMUpdate: I exported CPU history from Reporting > Health > System > Processor, and the spikes follow a fixed schedule:
Every 5 hours at :15, counted from when Zenarmor restarted during the upgrade (for me, 22:15 on Oct 26). Today's runs were 03:15, 08:15, 13:15 and 18:15.
Every 4th run is heavier, about once every 20 hours, with CPU at 90%+ for about 4 minutes. The lighter runs peak around 55–60% and didn't trigger my alerts.
Before the upgrade: no such pattern in 11 weeks of history.
The load is application CPU, not network or disk. During one heavy run, Elasticsearch was the top process in Diagnostics > Activity. I going to try to capture Elasticsearch's active tasks during the next predicted runs to identify the job itself and will post the results.
If you check your own Processor graph (5-minute resolution), do you see the same 5-hour rhythm starting from your upgrade time?
Every 5 hours at :15, counted from when Zenarmor restarted during the upgrade (for me, 22:15 on Oct 26). Today's runs were 03:15, 08:15, 13:15 and 18:15.
Every 4th run is heavier, about once every 20 hours, with CPU at 90%+ for about 4 minutes. The lighter runs peak around 55–60% and didn't trigger my alerts.
Before the upgrade: no such pattern in 11 weeks of history.
The load is application CPU, not network or disk. During one heavy run, Elasticsearch was the top process in Diagnostics > Activity. I going to try to capture Elasticsearch's active tasks during the next predicted runs to identify the job itself and will post the results.
If you check your own Processor graph (5-minute resolution), do you see the same 5-hour rhythm starting from your upgrade time?
#2
Zenarmor (Sensei) / Re: Newest version zenarmor ca...
Last post by xpking - Today at 01:03:28 AMQuote from: mimugmail on October 28, 2026, 06:03:53 AMDoes it reboot or crash? What happens on the console during restart button pushIt shows me restarting, then opnsense unresponsive.
I believe it crashed and rebooted.
#3
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - October 28, 2026, 10:57:57 PMHi, glad the update worked after the bridged network.
I have not tested your exact setup, so please take this as ideas and not as a sure answer.
Mobile routers from an ISP are often weak on IPv6. Many give only one address block to the router itself, without delegating a prefix to the devices behind it. Some also limit how many devices or hardware addresses they accept. CARP uses a virtual hardware address, so a router that filters addresses can drop it.
Another point: if the bridge in VMware uses the Wi-Fi card of the host, bridging with more than one hardware address often does not work well. A cable connection is better.
To find where it stops, I would check in this order:
1. Does the host computer itself reach public IPv6 addresses?
2. Does one firewall alone, with CARP switched off, get an IPv6 address on the WAN and reach a public IPv6 DNS server?
3. Does the router really give IPv6 to other devices, or only to itself?
If you tell me the router model and whether the host uses cable or Wi-Fi, I can think about it with you.
Sergio
I have not tested your exact setup, so please take this as ideas and not as a sure answer.
Mobile routers from an ISP are often weak on IPv6. Many give only one address block to the router itself, without delegating a prefix to the devices behind it. Some also limit how many devices or hardware addresses they accept. CARP uses a virtual hardware address, so a router that filters addresses can drop it.
Another point: if the bridge in VMware uses the Wi-Fi card of the host, bridging with more than one hardware address often does not work well. A cable connection is better.
To find where it stops, I would check in this order:
1. Does the host computer itself reach public IPv6 addresses?
2. Does one firewall alone, with CARP switched off, get an IPv6 address on the WAN and reach a public IPv6 DNS server?
3. Does the router really give IPv6 to other devices, or only to itself?
If you tell me the router model and whether the host uses cable or Wi-Fi, I can think about it with you.
Sergio
#4
Virtual private networks / Re: Creating VLANs with Dnsmas...
Last post by malebron - October 28, 2026, 10:46:38 PMUrgh. I should watch more episodes of the IT Crowd ("Turn it off and on again")!
I simply rebooted OPNsense (suggestion from AI) and my VLANs now show up on the dashboard and I can connect to my IOT network via WiFi (although without internet). I can see that it assigned an IP address in the correct range.
I configured the firewall rules to be wide open for testing, so I don't understand why it can't see the internet. More troubleshooting...
Thanks for taking the time to help.
I simply rebooted OPNsense (suggestion from AI) and my VLANs now show up on the dashboard and I can connect to my IOT network via WiFi (although without internet). I can see that it assigned an IP address in the correct range.
I configured the firewall rules to be wide open for testing, so I don't understand why it can't see the internet. More troubleshooting...
Thanks for taking the time to help.
#5
Virtual private networks / Re: Creating VLANs with Dnsmas...
Last post by nero355 - October 28, 2026, 10:06:37 PMQuote from: malebron on October 28, 2026, 09:58:27 PMVLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.- Is the Port on the Switch configured as TAGGED ?
- How did you configure the Port where the Accesspoint is connected ?
- How did you configure the Accesspoint ?
- Do you have more than 1 Switch ?
- Did you copy the Default Allow Any to Any Firewall Rule from the Default LAN network to the VLAN Interface network ?
QuoteFor a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1 ?That is one of the correct options and in this case the most used one :)
But I assume you don't do it on the Switch and configure on your OPNsense instead ?!
#6
26.7, 26.10 Series / Re: Changing to Business editi...
Last post by DEC740airp414user - October 28, 2026, 10:01:27 PMUpgrade successful
🙌🏻
🙌🏻
#7
Virtual private networks / Re: Creating VLANs with Dnsmas...
Last post by malebron - October 28, 2026, 09:58:27 PMThanks nero355
VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.
They show listed under the interfaces tab and under Interfaces: Devices: VLAN
Correct DHCP ranges are shown on interfaces: Assignments
Under Services: Dndmasq DNS and DHCP: General the VLANS are listed under Devices ("All" is selected)
QUESTION:
For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1 ?
Thx
VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.
They show listed under the interfaces tab and under Interfaces: Devices: VLAN
Correct DHCP ranges are shown on interfaces: Assignments
Under Services: Dndmasq DNS and DHCP: General the VLANS are listed under Devices ("All" is selected)
QUESTION:
For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1 ?
Thx
#8
Virtual private networks / Re: Creating VLANs with Dnsmas...
Last post by nero355 - October 28, 2026, 09:27:04 PMSounds like you have not created any VLAN Interfaces and assigned them to one of your unused NICs ?
Please post what you have done so far step-by-step and what is working or not exactly ;)
Please post what you have done so far step-by-step and what is working or not exactly ;)
#9
26.7, 26.10 Series / Re: OPNsense as mail gateway, ...
Last post by nero355 - October 28, 2026, 09:19:38 PMQuote from: franco on October 28, 2026, 04:14:26 PMThe user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.What are you saying exactly ?
Is Postfix becoming deprecated ?
Or is there just less and less support for it when the OS it runs on is FreeBSD ?
Quote from: Monviech (Cedrik) on October 28, 2026, 05:50:21 PMI ran Plesk as mail gateway, which also gives you more than postfix.Plesk/cPanel/DirectAdmin were pretty much THE ONES to use when I use to work for a Hosting/Server Rental Company in the past :)
You can configure amavis and spamassassin and more in it.
Of course the convenience of getting all these features easily configured and up to date + modern Webgui costs some subscription money.
But it's a lot of software for just e-mailing to be honest...
QuoteBut I would rather use a dedicated server for mail stuff.+1 here!
My opinion is that a lot of people "overload" their OPNsense with too much stuff that does not belong on it and could also avoid a lot of update/upgrade issues!
Quote from: mimugmail on October 28, 2026, 07:51:12 PMNowadays I'd stick to proxmox Mail gateway.Also a good option IMHO considering the fact that it has been developed for a decent amount of years by now so it should be a solid product! :)
#10
Virtual private networks / Creating VLANs with Dnsmasq DH...
Last post by malebron - October 28, 2026, 09:09:40 PMUsing OPNsense 26.7.7 on bare metal with a Unify managed switch (USW Pro SG8) and several Unify APs. My very basic flat network has worked well for years.
I finally decided to add VLANs for Guest and IOT. Before starting I upgraded everything to the most recent releases, including migrating from ISC DHCP to Dnsmasq DHCP as recommended. Everything went smoothly.
I followed the steps in several videos as carefully as possible, but they were based on older software versions with different UIs.
Everything looks right as far as I can tell, but when I try to connect via WiFi to the IOT SSID connection fails with "cannot get IP address". I assume the problem is in the DHCP setup somewhere, but I can't find it. (Everything else is working as before)
Observations
In the videos using ISC DHCP there is a simple checkbox to activate DHCP for each VLAN. I can't find anything equivalent for Dnsmasq. It seems you just set the range and enable for all interfaces under Dnsmasq-General.
One video showed the VLANs listed under Interfaces on the dashboard. I only see the physical interfaces listed (LAN and WAN).
Any help in troubleshooting this would be appreciated. It's very basic setup so I'm probably missing something obvious.
Thank you!
I finally decided to add VLANs for Guest and IOT. Before starting I upgraded everything to the most recent releases, including migrating from ISC DHCP to Dnsmasq DHCP as recommended. Everything went smoothly.
I followed the steps in several videos as carefully as possible, but they were based on older software versions with different UIs.
Everything looks right as far as I can tell, but when I try to connect via WiFi to the IOT SSID connection fails with "cannot get IP address". I assume the problem is in the DHCP setup somewhere, but I can't find it. (Everything else is working as before)
Observations
In the videos using ISC DHCP there is a simple checkbox to activate DHCP for each VLAN. I can't find anything equivalent for Dnsmasq. It seems you just set the range and enable for all interfaces under Dnsmasq-General.
One video showed the VLANs listed under Interfaces on the dashboard. I only see the physical interfaces listed (LAN and WAN).
Any help in troubleshooting this would be appreciated. It's very basic setup so I'm probably missing something obvious.
Thank you!
