"Recent posts
#1
26.7 Series / Re: Wan connection fails after...
Last post by newsense - Today at 09:01:01 AMThere weren't any igc updates for 26.7.3 afaik...
Are you sure there weren't any radix issues when booting the previous kernel ?
Are you sure there weren't any radix issues when booting the previous kernel ?
#2
26.7 Series / Re: Wan connection fails after...
Last post by RamSense - Today at 08:10:44 AMI can confirm the same radix4_lockless problem on a DEC850v2 running OPNsense 26.7.3_8.
In my case WAN itself remained available, but IPv4 routing to a WireGuard interface was broken after restoring the configuration onto a replacement SSD. The WireGuard tunnel had a healthy handshake and IPv6 through the same tunnel worked normally.
The kernel log contains repeated errors:
[fib_algo] inet.0 setup_fd_instance: radix4_lockless algo instance setup failed
[fib_algo] inet.0 (radix4_lockless#43) rebuild_fd_flm: table rebuild failed
[fib_algo] inet.0 (radix4_lockless#43) rebuild_fd: sync rebuild failed
The failure counter reached at least 42.
The interesting part is that the routing table itself looked completely correct:
route -n get 10.10.10.2
interface: wg0
netstat -rWn4:
10.10.10.2 link#11 UHS Nhop#16 wg0
netstat -4onW:
Nhop#16:
IFA 10.10.10.1
Gateway wg0/resolve
Netif wg0
Despite this, normal IPv4 traffic to 10.10.10.2 was incorrectly sent towards pppoe0.
A normal:
ping -c 1 10.10.10.2
failed, while:
ping -r -S 10.10.10.1 -c 1 10.10.10.2
worked immediately.
IPv6 to the same WireGuard peer also worked normally.
The decisive test was changing only the IPv4 FIB algorithm:
sysctl net.route.algo.inet.algo=radix4
Immediately afterwards the normal IPv4 ping worked through wg0 and full IPv4 Internet access through WireGuard was restored.
Changing nothing else was required.
Current workaround:
System > Settings > Tunables
net.route.algo.inet.algo = radix4
So this appears to be a radix4_lockless FIB rebuild/lookup failure rather than a WireGuard, NAT or firewall configuration problem.
Hardware: DEC850v2
OPNsense: 26.7.3_8
WAN: PPPoE
IPv4 default algorithm before workaround: radix4_lockless
Available algorithms: bsearch4, radix4_lockless, radix4
I have now also filed this as OPNsense src issue #323, including the full diagnostic results and the reproducible radix4_lockless → radix4 A/B test.
GitHub: https://github.com/opnsense/src/issues/323
Hopefully this helps confirm that the radix4_lockless rebuild errors can cause different IPv4 routing failures depending on the system/configuration.
In my case WAN itself remained available, but IPv4 routing to a WireGuard interface was broken after restoring the configuration onto a replacement SSD. The WireGuard tunnel had a healthy handshake and IPv6 through the same tunnel worked normally.
The kernel log contains repeated errors:
[fib_algo] inet.0 setup_fd_instance: radix4_lockless algo instance setup failed
[fib_algo] inet.0 (radix4_lockless#43) rebuild_fd_flm: table rebuild failed
[fib_algo] inet.0 (radix4_lockless#43) rebuild_fd: sync rebuild failed
The failure counter reached at least 42.
The interesting part is that the routing table itself looked completely correct:
route -n get 10.10.10.2
interface: wg0
netstat -rWn4:
10.10.10.2 link#11 UHS Nhop#16 wg0
netstat -4onW:
Nhop#16:
IFA 10.10.10.1
Gateway wg0/resolve
Netif wg0
Despite this, normal IPv4 traffic to 10.10.10.2 was incorrectly sent towards pppoe0.
A normal:
ping -c 1 10.10.10.2
failed, while:
ping -r -S 10.10.10.1 -c 1 10.10.10.2
worked immediately.
IPv6 to the same WireGuard peer also worked normally.
The decisive test was changing only the IPv4 FIB algorithm:
sysctl net.route.algo.inet.algo=radix4
Immediately afterwards the normal IPv4 ping worked through wg0 and full IPv4 Internet access through WireGuard was restored.
Changing nothing else was required.
Current workaround:
System > Settings > Tunables
net.route.algo.inet.algo = radix4
So this appears to be a radix4_lockless FIB rebuild/lookup failure rather than a WireGuard, NAT or firewall configuration problem.
Hardware: DEC850v2
OPNsense: 26.7.3_8
WAN: PPPoE
IPv4 default algorithm before workaround: radix4_lockless
Available algorithms: bsearch4, radix4_lockless, radix4
I have now also filed this as OPNsense src issue #323, including the full diagnostic results and the reproducible radix4_lockless → radix4 A/B test.
GitHub: https://github.com/opnsense/src/issues/323
Hopefully this helps confirm that the radix4_lockless rebuild errors can cause different IPv4 routing failures depending on the system/configuration.
#3
26.7 Series / Re: Lenovo M720q randomly hang...
Last post by Seimus - Today at 03:06:18 AMThis sounds like the BUG with Intel iGPUs on Linux.
I have had this with one of my Proxmox nodes, where the issue was not during the reboot cycles but during usage of the iGPU and a deep power state.
Is it possible if not already that you try to disable the iGPU(but if you do that you may not have any video output) in BIOS or at least look at the C states and disable them for a test.
Note here that in order for intel to use Turbo, you need to have at least a C3 state.
Regards,
S.
I have had this with one of my Proxmox nodes, where the issue was not during the reboot cycles but during usage of the iGPU and a deep power state.
Is it possible if not already that you try to disable the iGPU(but if you do that you may not have any video output) in BIOS or at least look at the C states and disable them for a test.
Note here that in order for intel to use Turbo, you need to have at least a C3 state.
Regards,
S.
#4
26.7 Series / Re: Unbound crashes after rebo...
Last post by Colt45 - Today at 03:06:09 AMIm also running into this issue on one of my routers. Not using any DNSBL.
I happened to look at the statistics and it showed a recursion time of something like 8.8415e-4 which I thought was very strange.
I restarted it and its fine now. It seems to run for at least a couple weeks with no other issues once it is restarted right after the router boots.
I happened to look at the statistics and it showed a recursion time of something like 8.8415e-4 which I thought was very strange.
I restarted it and its fine now. It seems to run for at least a couple weeks with no other issues once it is restarted right after the router boots.
#5
26.7 Series / Re: Lenovo M720q randomly hang...
Last post by Colt45 - Today at 03:00:14 AMIve had this same issue on and off with one of my machines. A Dell Optiplex 3040 with an i5-6500 in my case.
Unfortunately Ive not been able to discover what the issue is other than plugging some sort of display does cause it to boot. Looking at what is on the screen when it does 'hang' it is past EFI and the bootloader, so I think it is some sort of kernel issue.
Maybe something with this machine is causing it to believe there is a display connected and its stuck trying to read EDID or something. Im not sure. I wouldnt think that this would stop the boot up process but it is.
I made the mistake of upgrading my apartment router remote one day and it never came back up after, which is how I discovered the issue. It wasnt until the second upgrade that I put two and two together. I plugged in HDMI to see what was up, rebooted and it came up immediately. I was then able to replicate the hang by trying to boot with HDMI disconnected.
Unfortunately Ive not been able to discover what the issue is other than plugging some sort of display does cause it to boot. Looking at what is on the screen when it does 'hang' it is past EFI and the bootloader, so I think it is some sort of kernel issue.
Maybe something with this machine is causing it to believe there is a display connected and its stuck trying to read EDID or something. Im not sure. I wouldnt think that this would stop the boot up process but it is.
I made the mistake of upgrading my apartment router remote one day and it never came back up after, which is how I discovered the issue. It wasnt until the second upgrade that I put two and two together. I plugged in HDMI to see what was up, rebooted and it came up immediately. I was then able to replicate the hang by trying to boot with HDMI disconnected.
#6
Tutorials and FAQs / Re: [HOWTO] Configure IPv6 in ...
Last post by IsaacFL - Today at 02:53:53 AMThis really should be one of the top posts. I refer to this constantly for my IPv6 setup. About the only thing I change and ONLY IF you run a vpn ie wireguard or Tailscale (limit of my personal experience) is the get WAN IPv6. These are a little cleaner if they have a WAN addresses. Otherwise they try to work with the LAN I/f with mixed results.
#7
General Discussion / Re: how insecure is FreeBSD 14...
Last post by DEC740airp414user - Today at 12:31:27 AMThanks I appreciate the response
#8
General Discussion / Re: how insecure is FreeBSD 14...
Last post by newsense - Today at 12:06:47 AMIt's not.
OpenSSL released the patches this week for all supported versions. Vulnerabilities rated medium were the highest in the lot, none of them required an out of band patching for BE. They will be addressed on the next dot release.
The same is true for OpenSSH. Versions 10.4 and 10.5 came out weeks apart, July 7th and August 11th.
26.4.2 BE on August 14th included 10.4 as it was the latest available on Freshports at the time.
No available patches are missed. It's all a matter of timing and risk assessment. Nothing critical is missing from BE and there's no need to jump between CE and BE for security reasons.
OpenSSL released the patches this week for all supported versions. Vulnerabilities rated medium were the highest in the lot, none of them required an out of band patching for BE. They will be addressed on the next dot release.
The same is true for OpenSSH. Versions 10.4 and 10.5 came out weeks apart, July 7th and August 11th.
26.4.2 BE on August 14th included 10.4 as it was the latest available on Freshports at the time.
No available patches are missed. It's all a matter of timing and risk assessment. Nothing critical is missing from BE and there's no need to jump between CE and BE for security reasons.
#9
Development and Code Review / Looking for feedback
Last post by hdholm - August 29, 2026, 11:48:25 PMBecause I use it, I've created a plugin to manage and monitor a Tang daemon. It seems to be working for me. I don't know if there is interest in making it more widely available and how I would go about that - submit a pull request? Any comments or constructive criticism are gratefully accepted. The plugin itself is pretty straightforward, the existing FreeBSD ports do the hard lifting. Code is at https://github.com/hdholm/plugins/tree/tang/security/tang The plugin depends on llhttp, jose, and tang which are all available from FreeBSD ports. I keep everything on an internal server to which I point the FW firmware update, but I could make it public if there was interest.
If you're not familiar with Tang, it is part of a two part system used primarily on Linux. If you encrypt your hard drives and specifically your root drive it means you can't boot after an automated restart without someone typing in the key - unless you have tang server. Asa simplified explanation, the other part of the system (clevus) lives on the encrypted system and reaches out to the tang portion when booting to unlock the encryption. If the tang server is available (which is usually only true on your local network) then the encryption is unlocked, otherwise the disks remain secure. Having this on an internal (or even gateway in simple cases) firewall, is an obvious choice for where this lives since if the firewall is down, you probably need local intervention for things beyond typing in the encryption key.
If you're not familiar with Tang, it is part of a two part system used primarily on Linux. If you encrypt your hard drives and specifically your root drive it means you can't boot after an automated restart without someone typing in the key - unless you have tang server. Asa simplified explanation, the other part of the system (clevus) lives on the encrypted system and reaches out to the tang portion when booting to unlock the encryption. If the tang server is available (which is usually only true on your local network) then the encryption is unlocked, otherwise the disks remain secure. Having this on an internal (or even gateway in simple cases) firewall, is an obvious choice for where this lives since if the firewall is down, you probably need local intervention for things beyond typing in the encryption key.
#10
German - Deutsch / ACME Client zurücksetzen
Last post by PrinceLG - August 29, 2026, 11:18:43 PMHallo zusammen,
ich habe meine OpnSense auf eine neue Hardware übertragen (Neuinstallation 26.7.3 und Restore der letzten Konfigurtion).
Funktioniert auch alles perfekt, leider werden im ACME Client keine Konfigurationen gezeigt, Konten Zertifikate etc alles weg.
Der ACME Client bietet das Zurücksetzen an hier ist mir nicht klar wie das funktioniert.
Im Hinweis zum Zurücksetzen heisst es "Der ACME Client wird bei der nächsten geplanten Ausführung automatisch alles neu generieren."
Frage: was ist konkret mit diesem Hinweis gemeint: "bei der nächsten geplanten Ausführung" gemeint ?
Ich habe gedacht, damit ist der nächste Cronjob zur Erneuerung gemeint, aber es geschieht seit Tagen nichst der ACME Client bleibt leer.
Wie kann ich die Daten aus dem Zertifikatsspeicher wie angedacht übernehmen?
Viele Grüße
Karl
ich habe meine OpnSense auf eine neue Hardware übertragen (Neuinstallation 26.7.3 und Restore der letzten Konfigurtion).
Funktioniert auch alles perfekt, leider werden im ACME Client keine Konfigurationen gezeigt, Konten Zertifikate etc alles weg.
Der ACME Client bietet das Zurücksetzen an hier ist mir nicht klar wie das funktioniert.
Im Hinweis zum Zurücksetzen heisst es "Der ACME Client wird bei der nächsten geplanten Ausführung automatisch alles neu generieren."
Frage: was ist konkret mit diesem Hinweis gemeint: "bei der nächsten geplanten Ausführung" gemeint ?
Ich habe gedacht, damit ist der nächste Cronjob zur Erneuerung gemeint, aber es geschieht seit Tagen nichst der ACME Client bleibt leer.
Wie kann ich die Daten aus dem Zertifikatsspeicher wie angedacht übernehmen?
Viele Grüße
Karl
