"Recent posts
#1
General Discussion / Two WAN trouble
Last post by nwabytes - October 29, 2026, 11:08:08 PMThese are all public ips anyway so i dont care to show them. Ive fought with this over and over end up going to the other freebsd firewall.
Main ip 170.10.188.14/30 the gateway is in the DC for this one 170.10.188.13. now my server network 167.224.195.232/29. I can use the internet with the main ip. but the NET29 network is pretty much dead. ive tried any rules i can think of. Ill post a screenshot of my firewall. Its got to be something pretty simple. 167.224.195.234 should be an active ip with directadmin on it.
Main ip 170.10.188.14/30 the gateway is in the DC for this one 170.10.188.13. now my server network 167.224.195.232/29. I can use the internet with the main ip. but the NET29 network is pretty much dead. ive tried any rules i can think of. Ill post a screenshot of my firewall. Its got to be something pretty simple. 167.224.195.234 should be an active ip with directadmin on it.
#2
26.7, 26.10 Series / Re: 26.7.7 — Security audit re...
Last post by Manfred.Knick - October 29, 2026, 09:44:40 PMAnd OPNsense Business Edition 26.10 is already safe against
e.g. GHSA-p683-f7x2-pm4p: c.f. Release Notes --> [3]
Enjoy
Manfred
e.g. GHSA-p683-f7x2-pm4p: c.f. Release Notes --> [3]
Enjoy
Manfred
#3
Hardware and Performance / Re: routing performance limite...
Last post by sternchen45 - October 29, 2026, 09:40:48 PMHello,
very long time but i managed to work on the topic.
The Windows-PC is now connected and linked with 2.5Gbps on the CRS310. I put one Mac in the local subnet/same switch and test iperf3 from/to Windows host. Result: 2.37Gbps both directions.
I tested Mac->OPNsense->Windows PC: result approx. 1Gbps one process. With -P4 i reach 1.6-1.7Gbps.
Opposite direction (-R): 2.3Gbps.
I tested Mac->OPNsense->Mac (the one from the local test). Similar as Mac->OPNsense->Windows, but -P4 stays at 1Gbps.
I made sure shapers, Suricata, Zenarmor are off. Offloading features are off. CPU measured with top during the tests is at 0.1% user, 0.4% system.
The results very much point to the OPNsense. I just don't know what i should check.
Maybe from your experience you can suggest something?
very long time but i managed to work on the topic.
The Windows-PC is now connected and linked with 2.5Gbps on the CRS310. I put one Mac in the local subnet/same switch and test iperf3 from/to Windows host. Result: 2.37Gbps both directions.
I tested Mac->OPNsense->Windows PC: result approx. 1Gbps one process. With -P4 i reach 1.6-1.7Gbps.
Opposite direction (-R): 2.3Gbps.
I tested Mac->OPNsense->Mac (the one from the local test). Similar as Mac->OPNsense->Windows, but -P4 stays at 1Gbps.
I made sure shapers, Suricata, Zenarmor are off. Offloading features are off. CPU measured with top during the tests is at 0.1% user, 0.4% system.
The results very much point to the OPNsense. I just don't know what i should check.
Maybe from your experience you can suggest something?
#4
High availability / Re: CARP update of backup fire...
Last post by babagoo - October 29, 2026, 08:52:08 PMThanks for the update Sergio. I will have to go a friend's to get a cable connection. It can't ping the default gateway (fe80::) or discovered neighbours. The firewall rule allows icmp to any destination.
I will keep using ipv4 in the mean time.
I will keep using ipv4 in the mean time.
#5
Zenarmor (Sensei) / Re: CPU spikes from Elasticsea...
Last post by mlenje - October 29, 2026, 08:05:52 PMThanks both. xpking's :20 every 5 hours matches my :15 every 5 hours, offset by our different upgrade times.
Periodical.log
On my box this file only ever holds the last minute (about 2 KB). Two samples, Oct 27 07:59 and Oct 29 11:56 (neither at a spike time), look identical:
checking mongodb...
checking mongodb done
dasboard-cache...
CLI dashboard-cache: Caching ...
CLI dashboard-cache: Cached ...
dashboard cache done
elastic-index-check...
elastic-index-check done
done
[2026-10-29T11:56:01][INFO][TEMP] Starting Zenarmor CRON for 2026-10-29 11:56:01
That's followed by Zenarmor's usual 18 internal Cron Check lines, with only scheduled-service-control, userenrich and aliases actually running (all OK). The mongodb / dashboard-cache / elastic-index-check block is always at the top with no timestamps, so it looks like a separate job that rewrites the file each time.
What Elasticsearch is doing during a spike
I logged Elasticsearch's task list and per-thread top every 30 seconds during the 23:15 run last night.
Before (23:13:37): idle. Load was 0.20, and Elasticsearch was running only its own health and monitoring tasks.
From 23:14:39, this search appears:
indices:data/read/search
indices[zenarmor_<id>_conn_all]
"query":{"range":{"start_time":{"gte":1790640000000,"lt":1793232000000}}}
"aggregations":{"daily":{"composite":{"size":1000,
"sources":[{"identity":{"terms":{"field":"ip_src_saddr.keyword"}}},
{"day":{"date_histogram":{"field":"start_time","calendar_interval":"day"}}}],
"after":{"identity":"<ip>","day":...}}}}
The range is Sep 29 to Oct 29 (UTC), exactly 30 days.
It's a composite aggregation by source IP × day, paged 1,000 buckets at a time.
The same query appears in 7 consecutive snapshots (about 3½ minutes), each with a different after key advancing through the source IPs. So it looks like one continuous pass through the whole result set.
At the peak (23:16:10): all 15 of the busiest threads in top -H were Elasticsearch's java, with 13 of them at about 30% each. No other process appeared.
Summary: every 5 hours at :15 since the 2.7.1 upgrade, a 30-day per-device daily aggregation on conn_all runs for about 4 minutes. Every 4th run is heavier (90%+ CPU). There was no such pattern in 11 weeks of CPU history before the upgrade.
Which task sends this query? Is it dashboard-cache? And are the interval or the 30-day window configurable? I'm capturing Periodical.log and the process connecting to port 9200 during my next predicted run at 14:15 today and will post the results.
Periodical.log
On my box this file only ever holds the last minute (about 2 KB). Two samples, Oct 27 07:59 and Oct 29 11:56 (neither at a spike time), look identical:
checking mongodb...
checking mongodb done
dasboard-cache...
CLI dashboard-cache: Caching ...
CLI dashboard-cache: Cached ...
dashboard cache done
elastic-index-check...
elastic-index-check done
done
[2026-10-29T11:56:01][INFO][TEMP] Starting Zenarmor CRON for 2026-10-29 11:56:01
That's followed by Zenarmor's usual 18 internal Cron Check lines, with only scheduled-service-control, userenrich and aliases actually running (all OK). The mongodb / dashboard-cache / elastic-index-check block is always at the top with no timestamps, so it looks like a separate job that rewrites the file each time.
What Elasticsearch is doing during a spike
I logged Elasticsearch's task list and per-thread top every 30 seconds during the 23:15 run last night.
Before (23:13:37): idle. Load was 0.20, and Elasticsearch was running only its own health and monitoring tasks.
From 23:14:39, this search appears:
indices:data/read/search
indices[zenarmor_<id>_conn_all]
"query":{"range":{"start_time":{"gte":1790640000000,"lt":1793232000000}}}
"aggregations":{"daily":{"composite":{"size":1000,
"sources":[{"identity":{"terms":{"field":"ip_src_saddr.keyword"}}},
{"day":{"date_histogram":{"field":"start_time","calendar_interval":"day"}}}],
"after":{"identity":"<ip>","day":...}}}}
The range is Sep 29 to Oct 29 (UTC), exactly 30 days.
It's a composite aggregation by source IP × day, paged 1,000 buckets at a time.
The same query appears in 7 consecutive snapshots (about 3½ minutes), each with a different after key advancing through the source IPs. So it looks like one continuous pass through the whole result set.
At the peak (23:16:10): all 15 of the busiest threads in top -H were Elasticsearch's java, with 13 of them at about 30% each. No other process appeared.
Summary: every 5 hours at :15 since the 2.7.1 upgrade, a 30-day per-device daily aggregation on conn_all runs for about 4 minutes. Every 4th run is heavier (90%+ CPU). There was no such pattern in 11 weeks of CPU history before the upgrade.
Which task sends this query? Is it dashboard-cache? And are the interval or the 30-day window configurable? I'm capturing Periodical.log and the process connecting to port 9200 during my next predicted run at 14:15 today and will post the results.
#6
26.7, 26.10 Series / Re: Protectli VP-6630 Sporadic...
Last post by nero355 - October 29, 2026, 07:29:41 PMQuote from: cynthrune on October 29, 2026, 06:48:49 PMRegardless I would presume freshly reinstalling 26.7 would also deal with the bootloader being broken?Yes, because you immediately use the newest one.
But this :
Quote from: cynthrune on October 29, 2026, 05:47:17 PMSo far the symptoms are:Suggests you have got bigger problems!
Occasionally after anywhere between 12-72 hours my Protectli VP-6630 will hard lock itself, console output will be a primarily black screen with brief, corrupted looking flashes of the console screen appearing. the device will be unresponsive on all interfaces and the fans will lock to 100%.
- Check the PSU/Adapter of the device.
- Run memtest86+ for 24 hours.
- Boot some kind of regular OS and do some tests that put high load on the machine and see what happens...
Good luck! :)
#7
26.7, 26.10 Series / Re: Protectli VP-6630 Sporadic...
Last post by cynthrune - October 29, 2026, 06:48:49 PMQuote from: meyergru on October 29, 2026, 06:21:47 PMThe microcode update was not the root cause of the problems many people had. The old bootloader was.Regardless I would presume freshly reinstalling 26.7 would also deal with the bootloader being broken?
There are threads which show how to update it.
#8
26.7, 26.10 Series / Re: Protectli VP-6630 Sporadic...
Last post by meyergru - October 29, 2026, 06:21:47 PMThe microcode update was not the root cause of the problems many people had. The old bootloader was.
There are threads which show how to update it.
There are threads which show how to update it.
#9
26.7, 26.10 Series / Re: Protectli VP-6630 Sporadic...
Last post by Nullman - October 29, 2026, 06:14:47 PMThis might be hardware related.
#10
26.7, 26.10 Series / Re: Protectli VP-6630 Sporadic...
Last post by cynthrune - October 29, 2026, 06:12:52 PMQuote from: sopex on October 29, 2026, 06:08:34 PMSo you have uninstalled the microcode plugin?The issue has occurred both with the microcode plugin present, and without
