Quote from: BigFreddy on September 03, 2026, 06:15:09 PMIs it possible to run the latest version of OPNsense purely from a USB stick as a hard disk? I heard that many people did it but is it still supported and what do I need to look out for or change within settings to make it run properly?
ifconfig wgX
wg show wgX
netstat -rn -f inet
tcpdump -ni wgX port 53
and then try a DNS lookup from the client.Quote from: meyergru on September 04, 2026, 10:17:56 AMWell, now I got you. I suspect this might be one of two cases:I have confirmed that both DNSmask and Unbound are listening to all interfaces, and that Unbound has the Default action: Allow. Nevertheless, there's an ACL entry, but that one should be rendered moot by the "default allow", supposedly. I have also tried disabling that ACL, confirmed that Unbound was still resolving (which makes sense, given the 'Allow' default action) - but even with the ACL disabled, "Configuring Wireguard" took minutes when rebooting, and resulted in WG clients unable to resolved until the WG instance was restarted.
1. You have bound your DNSmasq or Unbound to specific interfaces. In that case, when Unbound starts up, the WG interface does not yet exist and cannot be bound. You can test if this is the case by "sockstat -4 -6 -l | grep :53" and looking at which interfaces WG listens on when your error condition exists. If that is the case, you can avoid it by using "ALL" (nor no) interfaces to have the DNS service bind to 0.0.0.0. This is explained often throughout the forum: do not bind any services to specific interfaces. Besides, this is here: https://forum.opnsense.org/index.php?topic=42985.0, point 32.
Quote from: meyergru on September 04, 2026, 10:17:56 AM2. If you are using Unbound, there is another known possibility: the automatically generated ACL for the WireGuard network may be missing after boot because the WG interface does not yet exist when the Unbound configuration is generated.Would all this section apply, since I do NOT have to restart Unbound to make it all work? As mentioned above, I have even tried restarting Unbound, but this did NOT fix the resolution issues for WG clients - the only thing that does is restarting that WG inbound instance.
This has been reported before:
https://github.com/opnsense/core/issues/4142
Check /var/unbound/access_lists.conf while the problem exists and see whether your WG subnet is present. If it only appears after restarting Unbound, that is the cause.
Unlike the interface binding problem, the simple workaround here is to add an explicit ACL for the WireGuard client network under Services -> Unbound DNS -> Access Lists instead of relying on the automatically generated interface ACL.
This second case should only matter if your Unbound ACL default action is set to Deny or Refuse. With the default action set to Allow, the automatically generated interface ACL should be irrelevant (see: https://forum.opnsense.org/index.php?topic=42985.0, point 0). The old ticket was created when there where specific interface rules created (namely, in 2020).