Recent posts

#1

26.7, 26.10 Series / Re: Gradual Internet Performan...

Last post by pfry - Today at 04:26:10 PM

[...]so that's something we will all just have to learn to live with :)[...]

rc.conf:
ip6addrctl_enable = "YES"
ip6addrctl_policy = "ipv4_prefer"

OPNsense: "System: Settings: General" -> "Networking" -> "Prefer IPv4 over IPv6"

I also only use IPv4 only, with no IPv6 address assignments or discovery, and "net.inet6.ip6.auto_linklocal = 0", so I can't comment on effect.

#2

26.7, 26.10 Series / OPNsense downgrades itself in ...

Last post by bitdigger - Today at 03:47:15 PM

Dear all,
I am in the process of upgradeing a little firewall with 2nics. This is a barebone installation. Since I want the latest version, I downloaded it and made a USB stick, booted from there etc. The downloadable image, at least to my knwonleadge available is 26.7, the latest version to which a system can be upgraeded is 26.7.8_2. I manage to do this, cann reboot etc. Dashboard update check tells me I am on the latest version.
Then, while configuring some aliases and NAT entries etc. all of a sudden the Dashboard tells me I am on
OPNsense 25.7.11_9-amd64
FreeBSD 14.3-RELEASE-p7
OpenSSL 3.0.18
and this obviousely can't be upgraded (and hence it never should be there anyways).
What is going on here? I must overlook something obvious or see ghosts or somthing?
Btw. I repeated this already 2 times...

#3

26.7, 26.10 Series / Re: Gradual Internet Performan...

Last post by nero355 - Today at 03:47:03 PM

Which makes this bug even more critical to fix, don't you think?

I am not sure what's going on since I have no IPv6 on my WAN side to test with, but my point was that IPv6 having higher priority over IPv4 is nothing new and almost always has been like that so that's something we will all just have to learn to live with :)

OPNSense 26.7 was announced on 7/15/2026.
Here I am, after 4 months of grief, finally with a workaround but definitely not a proper solution.

I am not sure if things are really like that since you mention a bug/change that has been introduced and very quickly reverted only very recently ?!

There has been some work done to the Interfaces Assignment webGUI also, so maybe something went wrong there too in your case...

My Apple devices are now "pausing" for a short period of time, I assume trying to reach an IPV6 address and finally realizing they can't so they fall back to IPV4 and complete the connection.
SiriusXM takes about 10-15 seconds when I change channels (which is instantaneous when I use the external VPN which CAN reach IPV6) and even attempting to log into this forum paused for about 30 seconds before the login popup appeared.

Are you sure it's not some weird DNS issue ?!

Usually a VPN forces all the DNS traffic through itself and to the VPN Provider's DNS Servers so that could be another reason for such a huge difference between the two.

Sigh... I should have stayed on 26.1.x but the EOL warnings prompted me to upgrade.

It all depends on the setup you have :

As long as you don't have any Port Forwards to the OPNsense OS itself there is very little to worry about IMHO :)

#4

High availability / HA with prefix delegation: Wro...

Last post by ajr - Today at 02:55:18 PM

In this HA setup, there are some VLANS, which are associated to WLANS by
unifi accesspoints. Each of them has a different subnet (by prefix id).
Prefix delegation works correctly and assigns addresses from the right prefix
to the mobile clients (using Track interface).
The setup is the same as described here https://forum.opnsense.org/index.php?topic=50602.msg259211#msg259211
The IP6 gateway announced in the past was that from system->gateways
(WAN_DHCP6), which is the LLA of the DSL-Router (fe80::cece:1eff:feb3:757f) and worked perfectly on failover.
This changed recently to LLAs like fe80::20d:b9ff:fe48:5c1e, which are unusable.

How can I force radvd to announce WAN_DHCP6 ?

Version:  26.7.8_2

#5

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by tuto2 - Today at 02:36:32 PM

I don't have any further insight or experience to contribute at this stage, but what module coding and link partners have been tested? We don't have a non-production DEC appliance, but we do have DACs, AOCs, and SR/LR SFP28 modules on hand that we can recode at will, so if there's a specific combination that hasn't been tested (or needs validation) I might be able to provide another test case.

This seems to be the culprit: https://github.com/opnsense/src/commit/27ffeba0e6b5b8d8ebb8eec9d2566f56421ee946

There's a test kernel available if you want to give it a go:

# opnsense-update -zkr 26.7.8-next

Reboot afterwards, link should come up immediately on boot without the tunable.

#6

Portuguese - Português / Re: Crash - Atualizando do 26....

Last post by Micheale45 - Today at 02:30:20 PM

Pelos relatos, eu começaria por verificar o espelho de atualização antes de remover o AdGuard. O caso do servidor virtualizado indica que a troca do Cloudflare (São Paulo) pelo espelho oficial de Amesterdão resolveu um erro de validação SHA-256. Isso não prova que seja a mesma causa no teu caso, mas é um teste simples e bastante pertinente. Se voltar a falhar, seria útil partilhar o erro completo e os logs de atualização para perceber se é um problema de integridade do pacote, do repositório ou de algum plugin. E, antes de novas tentativas, convém guardar um backup da configuração.

#7

26.7, 26.10 Series / Re: Messages in firewall log w...

Last post by mooh - Today at 02:18:06 PM

I'm the maintainer of the ndp proxy btw, if you find something actionable I can help, but just a logging issue isn't actionable from my side right now.

I didn't mean to push you or anyone. I'm looking for pointers because I'm at a loss how to proceed investigating other than reading the code.

For example, there are a number of automatic rules that would fit the logged messages, but they are "ipv6-icmp from (self) to fe80::/10 icmp6-type neighbrsol", etc. Is there a chance that packets forwarded by the proxy match "(self)" even though the actual source address is not one of the firewall's?

#8

26.7, 26.10 Series / Re: [SOLVED] WAN PPPoE IPv6 de...

Last post by Taomyn - Today at 02:17:30 PM

Ok so far so good.  The -n option for dhcp6c is at "Interfaces: Settings: Prevent Release" which is an advanced setting. Try disabling this to see if it still works as expected.  It needs a reboot to take effect.


Cheers,
Franco

I disabled that as well now, rebooted and so far still working - no idea why that was enabled, maybe left over from the last time I tried to get IPv6 working a few years back.

#9

26.1, 26.4 Legacy Series / Re: os-kea-ubnd-ddns v0.98 — K...

Last post by peneal - Today at 02:06:16 PM

@tkreagan

Have you had the chance to have a look at what @kevindd992002 mentioned?

How is the acceptance into the official community plugins going so far?

#10

26.7, 26.10 Series / Re: No health graphs since 26....

Last post by szty0pa - Today at 01:39:16 PM

@cookiemonster No recent HW-changes, same (bare-metal) OPNsense version as you have. Strange, have to investigate it further then. My hunch is that the data collecting cronjob is not running for some reason.

@tuto2 No, i'm on community release. There is a line in the changelog which made me think that it has been changed: "In other news, ECMP route support has hit the development version along with cloneable widgets for the health graphs and a general improvement with the health graphs while at it." Data collection stopped right after the update on all my OPNsense routers.