"Recent posts
#1
General Discussion / Plugin Update or Removal
Last post by MisterGlass - Today at 01:29:40 AMFirst post.
I installed the plugin os-cloudflared (v1.1_1) from the OPNsense repository. In the Cloudflare dashboard the version of the tunnel is 2026.2.0, which is no longer supported or safe to use thanks to the compromised eMudhra certificates.
https://blog.cloudflare.com/emudhra-certificate-compromise
I'm new to the OPNsense ecosystem and after reading this post I'm not sure who to contact. This plugin should be removed or updated. Do I email the maintainer or is this maintained by the (awesome) OPNsense team?
Cloudflare Tunnel integration
Integrates the Cloudflare Tunnel daemon (cloudflared) into OPNsense,
allowing self-hosted services to be exposed through Cloudflare Zero Trust
without requiring inbound firewall rules or a public IP address.
WWW: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
Inspired by original work by Alan Martines <alancpmartines@hotmail.com>.
Maintainer: rick+github@insanityinside.net
I installed the plugin os-cloudflared (v1.1_1) from the OPNsense repository. In the Cloudflare dashboard the version of the tunnel is 2026.2.0, which is no longer supported or safe to use thanks to the compromised eMudhra certificates.
https://blog.cloudflare.com/emudhra-certificate-compromise
QuoteCloudflare Tunnel (cloudflared) Action the customer should take: Upgrade to 2026.10.2. For container deployments, update and redeploy the fixed image
I'm new to the OPNsense ecosystem and after reading this post I'm not sure who to contact. This plugin should be removed or updated. Do I email the maintainer or is this maintained by the (awesome) OPNsense team?
Cloudflare Tunnel integration
Integrates the Cloudflare Tunnel daemon (cloudflared) into OPNsense,
allowing self-hosted services to be exposed through Cloudflare Zero Trust
without requiring inbound firewall rules or a public IP address.
WWW: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
Inspired by original work by Alan Martines <alancpmartines@hotmail.com>.
Maintainer: rick+github@insanityinside.net
#2
26.7 Series / Re: 26.7.7 — Security audit re...
Last post by cfarachid - Today at 12:10:16 AMThank you both for the explanations and context.
I understand that the audit mainly reflects recent upstream FreeBSD package advisories, and that the OPNsense team is already tracking and addressing them. I also understand that reducing the attack surface is important.
In my case, I use Unbound as the local DNS resolver because I do not currently have a separate DNS server. I will keep SSH disabled unless it is needed, restrict WebGUI access to the LAN or VPN, and apply updates as soon as they are available.
I am setting up WireGuard for remote access rather than exposing services directly to the WAN. For a single-firewall small business, I will stay on the Community Edition for now and monitor the security updates closely.
Thanks again for the clarification and for the active maintenance.
I understand that the audit mainly reflects recent upstream FreeBSD package advisories, and that the OPNsense team is already tracking and addressing them. I also understand that reducing the attack surface is important.
In my case, I use Unbound as the local DNS resolver because I do not currently have a separate DNS server. I will keep SSH disabled unless it is needed, restrict WebGUI access to the LAN or VPN, and apply updates as soon as they are available.
I am setting up WireGuard for remote access rather than exposing services directly to the WAN. For a single-firewall small business, I will stay on the Community Edition for now and monitor the security updates closely.
Thanks again for the clarification and for the active maintenance.
#3
26.7 Series / Re: Invalid argument errors wh...
Last post by (MARLOO) - October 26, 2026, 11:50:50 PMHi Shad,
Yes, smartctl is reading the SMART data even though some attribute names remain unknown. Your output already includes power-on hours, temperature, self-test results and the error log. The separate endurance check also reports 5% used.
SMART is supported and enabled, and your output confirms that the data is being read. Only some attribute names remain unidentified.
The results are good. At the end is a new disk
Also, your report shows 69°C currently and a recorded maximum of 79°C. I would check airflow around the SSD and, if space allows, consider a suitable low-profile heatsink or a small fan to improve cooling.
Thanks for reporting back!
Yes, smartctl is reading the SMART data even though some attribute names remain unknown. Your output already includes power-on hours, temperature, self-test results and the error log. The separate endurance check also reports 5% used.
SMART is supported and enabled, and your output confirms that the data is being read. Only some attribute names remain unidentified.
The results are good. At the end is a new disk
Also, your report shows 69°C currently and a recorded maximum of 79°C. I would check airflow around the SSD and, if space allows, consider a suitable low-profile heatsink or a small fan to improve cooling.
Thanks for reporting back!
#4
26.7 Series / Re: Invalid argument errors wh...
Last post by Shad - October 26, 2026, 11:27:02 PMsmartctl -i /dev/ada0 :
smartctl -P /dev/ada0 :
fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0
I don't see any changes to the unknown_attributes (I forgot to take a screenshot before updating the drivedb database, but the unknown_attributes are the same).
Last but not least, smartctl -x /dev/ada0 | grep -i percentage :
So I guess I'm good on the hardware side.
Code Select
smartctl 7.5 2025-04-30 r5714 [FreeBSD 15.1-RELEASE-p4 amd64] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Device Model: MTFDDAT128MAZ-1AE1ZABHA
Serial Number: REDACTED
LU WWN Device Id: 5 00a075 10c815ea5
Firmware Version: M104
User Capacity: 128,035,676,160 bytes [128 GB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: Solid State Device
Form Factor: < 1.8 inches
TRIM Command: Available, deterministic, zeroed
Device is: Not in smartctl database 7.5/5706
ATA Version is: ACS-2, ATA8-ACS T13/1699-D revision 6
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is: Mon Oct 26 23:13:49 2026 CET
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
smartctl -P /dev/ada0 :
Code Select
smartctl 7.5 2025-04-30 r5714 [FreeBSD 15.1-RELEASE-p4 amd64] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
No presets are defined for this drive. Its identity strings:
MODEL: MTFDDAT128MAZ-1AE1ZABHA
FIRMWARE: M104
do not match any of the known regular expressions.
Use -P showall to list all known regular expressions.
fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0
Code Select
smartctl 7.5 2025-04-30 r5714 [FreeBSD 15.1-RELEASE-p4 amd64] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Device Model: MTFDDAT128MAZ-1AE1ZABHA
Serial Number: REDACTED
LU WWN Device Id: 5 00a075 10c815ea5
Firmware Version: M104
User Capacity: 128,035,676,160 bytes [128 GB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: Solid State Device
Form Factor: < 1.8 inches
TRIM Command: Available, deterministic, zeroed
Device is: Not in smartctl database 7.5/5706
ATA Version is: ACS-2, ATA8-ACS T13/1699-D revision 6
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is: Mon Oct 26 23:17:43 2026 CET
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
General SMART Values:
Offline data collection status: (0x80) Offline data collection activity
was never started.
Auto Offline Data Collection: Enabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 595) seconds.
Offline data collection
capabilities: (0x7b) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 2) minutes.
Extended self-test routine
recommended polling time: ( 3) minutes.
Conveyance self-test routine
recommended polling time: ( 3) minutes.
SCT capabilities: (0x0035) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.
SMART Attributes Data Structure revision number: 32
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 100 100 050 Pre-fail Always - 12
5 Reallocated_Sector_Ct 0x0033 100 100 010 Pre-fail Always - 0
9 Power_On_Hours 0x0032 100 100 000 Old_age Always - 9997
11 Unknown_SSD_Attribute 0x0022 100 100 000 Old_age Always - 140
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 2920
170 Unknown_Attribute 0x0033 099 099 010 Pre-fail Always - 16
171 Unknown_Attribute 0x0022 100 100 000 Old_age Always - 0
172 Unknown_Attribute 0x0032 100 100 000 Old_age Always - 0
173 Unknown_Attribute 0x0033 041 041 010 Pre-fail Always - 1780
174 Unknown_Attribute 0x0032 100 100 000 Old_age Always - 140
181 Program_Fail_Cnt_Total 0x0022 100 100 000 Old_age Always - 11643680983326
183 Runtime_Bad_Block 0x0032 100 100 000 Old_age Always - 0
184 End-to-End_Error 0x0033 100 100 097 Pre-fail Always - 0
187 Reported_Uncorrect 0x0032 100 100 000 Old_age Always - 0
188 Command_Timeout 0x0032 100 100 000 Old_age Always - 2794
190 Airflow_Temperature_Cel 0x0022 031 021 000 Old_age Always - 69 (Min/Max 14/79)
194 Temperature_Celsius 0x0022 031 021 000 Old_age Always - 69 (Min/Max 14/79)
195 Hardware_ECC_Recovered 0x003a 100 100 000 Old_age Always - 3772716375
196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 16
197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0022 100 100 000 Old_age Always - 2
SMART Error Log Version: 1
No Errors Logged
SMART Self-test log structure revision number 1
Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Completed without error 00% 9991 -
# 2 Vendor (0xff) Completed without error 00% 19 -
SMART Selective self-test log data structure revision number 1
SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
1 0 0 Not_testing
2 0 0 Not_testing
3 0 0 Completed [00% left] (57881389-57946924)
4 0 0 Not_testing
5 0 0 Not_testing
Selective self-test flags (0x0):
After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.
The above only provides legacy SMART information - try 'smartctl -x' for more
I don't see any changes to the unknown_attributes (I forgot to take a screenshot before updating the drivedb database, but the unknown_attributes are the same).
Last but not least, smartctl -x /dev/ada0 | grep -i percentage :
Code Select
0x07 0x008 1 5 N-- Percentage Used Endurance IndicatorSo I guess I'm good on the hardware side.
#5
26.7 Series / Re: Invalid argument errors wh...
Last post by (MARLOO) - October 26, 2026, 10:37:52 PMQuote from: Shad on October 26, 2026, 05:28:02 PMNew smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
Hi Shad,
Unknown_Attribute alone does not indicate a faulty obsolete drive. Several Micron models are already supported, so could you post:
smartctl -i /dev/ada0
smartctl -P show /dev/ada0
You can remove the serial number before posting.
You can also try a newer drive database without replacing the installed one:
fetch -o /root/smart_drivedb.h https://raw.githubusercontent.com/smartmontools/smartmontools/main/drivedb/drivedb.h
smartctl -B +/root/smart_drivedb.h -a /dev/ada0
Let us know whether any of the Unknown_Attribute names change.
#6
26.7 Series / Re: 26.7.7 — Security audit re...
Last post by franco - October 26, 2026, 06:24:19 PM> However, the security audit reports six vulnerable packages:
I'm curious... what is the motivation for these random security vulnerability posts? We're not fast enough? We're not aware of this?
I checked the release date for 26.7.7 and it was just 13 days ago. Since then FreeBSD released TWO batches of security advisories we miss. Unbound, Curl, NSS, Brotli, OpenSSH 10.6 breaking their own PQ compatibility they introduced in 10.5.
I've not even mentioned last weeks PHP surprise or any of the AI security reports we received, are fixing and trying to manage while releasing 26.10 business major update on Wednesday and a 26.7.8 very likely on Thursday.
Last week was one of the craziest weeks I've ever seen. We're going to see more of it. If you can please don't try to nudge us for something we very likely already work on. This would be my takeaway from last week.
Thank you,
Franco
I'm curious... what is the motivation for these random security vulnerability posts? We're not fast enough? We're not aware of this?
I checked the release date for 26.7.7 and it was just 13 days ago. Since then FreeBSD released TWO batches of security advisories we miss. Unbound, Curl, NSS, Brotli, OpenSSH 10.6 breaking their own PQ compatibility they introduced in 10.5.
I've not even mentioned last weeks PHP surprise or any of the AI security reports we received, are fixing and trying to manage while releasing 26.10 business major update on Wednesday and a 26.7.8 very likely on Thursday.
Last week was one of the craziest weeks I've ever seen. We're going to see more of it. If you can please don't try to nudge us for something we very likely already work on. This would be my takeaway from last week.
Thank you,
Franco
#7
High availability / Re: CARP update of backup fire...
Last post by BoNetTech - October 26, 2026, 05:49:08 PMHi babagoo,
Good, that is some progress: this time 8 packages came down instead of 4. Since it stops at a different package each time (before it was php85 dom, now krb5), I do not think a single file is the problem. It looks more like the connection drops now and then during longer downloads.
Things to try:
1. Just run the update again. Packages already downloaded are kept, so every new try should get a bit further. It may need a few tries.
2. If your virtual machines use the NAT network of VMware, try a bridged network adapter for the WAN interface instead, or the other adapter type if you have a choice. NAT in VMware Workstation is a common source of dropped long transfers.
3. Test the connection from the firewall with a longer ping to a public address, and look at whether you lose packets. Packet loss would explain what you see.
4. If your host computer runs a VPN, a firewall program or an antivirus with web scanning, switch it off for a moment during the update.
Please tell us if one of these changes anything.
Sergio
Good, that is some progress: this time 8 packages came down instead of 4. Since it stops at a different package each time (before it was php85 dom, now krb5), I do not think a single file is the problem. It looks more like the connection drops now and then during longer downloads.
Things to try:
1. Just run the update again. Packages already downloaded are kept, so every new try should get a bit further. It may need a few tries.
2. If your virtual machines use the NAT network of VMware, try a bridged network adapter for the WAN interface instead, or the other adapter type if you have a choice. NAT in VMware Workstation is a common source of dropped long transfers.
3. Test the connection from the firewall with a longer ping to a public address, and look at whether you lose packets. Packet loss would explain what you see.
4. If your host computer runs a VPN, a firewall program or an antivirus with web scanning, switch it off for a moment during the update.
Please tell us if one of these changes anything.
Sergio
#8
26.7 Series / Re: Invalid argument errors wh...
Last post by Shad - October 26, 2026, 05:28:02 PMI tried to repair the file system, for some reasons it completed almost instantly and said that the file system had recovered.
but I already had some problems with this disk, and given that I had bought a 2nd hand msata disk (basically new ones are more expensive than nvme for some reasons), I seized the opportunity to migrate to the new disk.
Apart from the isc -> kea unexpected migration, it was smooth.
New smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
For now I'll keep it as it is, and look after periodic smart tests to see how it's going.
Thanks for your help.
but I already had some problems with this disk, and given that I had bought a 2nd hand msata disk (basically new ones are more expensive than nvme for some reasons), I seized the opportunity to migrate to the new disk.
Apart from the isc -> kea unexpected migration, it was smooth.
New smart scan also shows unknow_attribute although it comes from a reputable brand (Micron).
For now I'll keep it as it is, and look after periodic smart tests to see how it's going.
Thanks for your help.
#9
Hardware and Performance / Re: Mono Gateway (an NXP-based...
Last post by Greg_E - October 26, 2026, 05:26:21 PMThat's not a good sign!
#10
Hardware and Performance / Re: Semi parts bin new build
Last post by Greg_E - October 26, 2026, 05:24:53 PMQuote from: pfry on October 23, 2026, 01:19:34 AMHeh. I haven't seen a quad X710 for $125, though (unless $150 counts).
They have gone up recently, I probably should have bought 3 of them when I bought. The dual 25g x710 have also gone up recently.
One thing to note about these cards, not all speeds are available in the x710 series. You may be limited to 1/10 or 10/25. But the twisted pair should offer multi-gig speeds from 10m up through 10g.
