"Recent posts
#1
26.7 Series / Re: Make my backup history saf...
Last post by Roger@Opnsense - Today at 03:39:48 AMMaybe even rm /conf/backup/*.xml would be a safer implementation of the flush operation ?
#2
26.7 Series / Re: Make my backup history saf...
Last post by Roger@Opnsense - Today at 03:25:58 AMThanks for all the feedback!
Yes, it was os-git-backup that I have been using, but only with a local repo in /conf/backup/git, which unfortunately I had not cloned elsewhere.
It sounds like the symlink idea is worth testing. I can at least build a new repo using the backups I have made through the GUI, since those are stored on a different machine and give me a reasonable amount of history on their own.
I guess it also makes sense for me to add a nightly cron job to do an additive rsync of /conf/backup to another machine, since it sounds like I cannot uncheck this option and make that setting stick.
I do feel that the "Flush (full) local configuration history" option should be off by default, though. I would not normally expect a restore operation to destroy the history that would allow me to undo that restore.
I could also envisage a workflow where you roll back to an older configuration temporarily and then want to roll forward again. Flushing the history makes that impossible unless you have another copy elsewhere.
Yes, it was os-git-backup that I have been using, but only with a local repo in /conf/backup/git, which unfortunately I had not cloned elsewhere.
It sounds like the symlink idea is worth testing. I can at least build a new repo using the backups I have made through the GUI, since those are stored on a different machine and give me a reasonable amount of history on their own.
I guess it also makes sense for me to add a nightly cron job to do an additive rsync of /conf/backup to another machine, since it sounds like I cannot uncheck this option and make that setting stick.
I do feel that the "Flush (full) local configuration history" option should be off by default, though. I would not normally expect a restore operation to destroy the history that would allow me to undo that restore.
I could also envisage a workflow where you roll back to an older configuration temporarily and then want to roll forward again. Flushing the history makes that impossible unless you have another copy elsewhere.
#3
26.7 Series / Re: WAN/PPPOE connection fail...
Last post by Uncorrupt0152 - Today at 01:21:45 AMHi meyergru,
Thank you for the direct feedback. You are right; my initial post was far too vague. I apologise for that. I've been troubleshooting this all day and was getting frustrated. Let me provide a proper, detailed breakdown of the situation, the hardware, the steps I've taken, and where I am now stuck.
System Information:
OPNsense Version: The latest stable version as of August 24, 2026. This problem started immediately after I ran the update from the GUI.
Hardware: This is a physical appliance, not a VM. It's a custom-built N100 box with 4x Intel i226-V 2.5GbE ports.
ISP: Plusnet (UK) on a Fibre connection.
Network Layout: The core design is OPNsense -> Managed Switch -> Devices. VLANs are used for TRUSTED and UNTRUSTED networks. This setup was working perfectly before the update.
Current Problem: OPNsense DNS Resolution is Broken
This is where I am currently stuck.
I can successfully ping 8.8.8.8 from Interfaces > Diagnostics > Ping. This proves the firewall has a valid route to the internet.
However, if I try to ping a hostname like google.com, it fails with the error: cannot resolve google.com: Host name lookup failure.
4. Attempted Forcing Upstream DNS.
To fix the DNS issue, I went to System > Settings > General.
I manually entered 8.8.8.8 and 1.1.1.1 as DNS servers.
I unchecked the box Allow DNS server list to be overridden by DHCP/PPP on WAN.
Result: No change. OPNsense itself still cannot resolve any external hostnames, even though it can ping external IPs.
5. Attempted Fix Reconfiguring DHCP.
I noticed that the update introduced Kea DHCP, and the old ISC DHCP is now marked as legacy. I assume this is part of the problem.
I tried to configure Kea DHCP (Services > Kea DHCP > Subnets) for my TRUSTED VLAN (192.168.86.0/24). I created the subnet and added an IP pool (192.168.86.100 - 200).
Here is a critical issue: In the "Edit Subnet" screen for Kea, there are no input fields for "DNS servers" or "Routers" as some guides suggest there should be. The fields are simply missing from the GUI.
Summary of Current State:
WAN is UP and has a public IP.
OPNsense CAN ping external IP addresses (e.g., 8.8.8.8).
OPNsense CANNOT resolve any DNS hostnames (e.g., google.com).
Because the firewall's resolver is broken, none of my internal clients can access the internet.
The new Kea DHCP service seems to be missing key configuration options in its interface.
My Specific Question:
Why would OPNsense be unable to perform DNS lookups, even when public DNS servers are explicitly defined in the general settings and the WAN connection is confirmed to be working? Could this be a bug in the latest version related to Unbound DNS, or is there another setting I'm missing that would cause this behavior?
Thank you for your time and expertise. The failing ping diagnostics, my general DNS settings, and the Kea DHCP subnet page that is missing the router/DNS option fields.
Thank you for the direct feedback. You are right; my initial post was far too vague. I apologise for that. I've been troubleshooting this all day and was getting frustrated. Let me provide a proper, detailed breakdown of the situation, the hardware, the steps I've taken, and where I am now stuck.
System Information:
OPNsense Version: The latest stable version as of August 24, 2026. This problem started immediately after I ran the update from the GUI.
Hardware: This is a physical appliance, not a VM. It's a custom-built N100 box with 4x Intel i226-V 2.5GbE ports.
ISP: Plusnet (UK) on a Fibre connection.
Network Layout: The core design is OPNsense -> Managed Switch -> Devices. VLANs are used for TRUSTED and UNTRUSTED networks. This setup was working perfectly before the update.
Current Problem: OPNsense DNS Resolution is Broken
This is where I am currently stuck.
I can successfully ping 8.8.8.8 from Interfaces > Diagnostics > Ping. This proves the firewall has a valid route to the internet.
However, if I try to ping a hostname like google.com, it fails with the error: cannot resolve google.com: Host name lookup failure.
4. Attempted Forcing Upstream DNS.
To fix the DNS issue, I went to System > Settings > General.
I manually entered 8.8.8.8 and 1.1.1.1 as DNS servers.
I unchecked the box Allow DNS server list to be overridden by DHCP/PPP on WAN.
Result: No change. OPNsense itself still cannot resolve any external hostnames, even though it can ping external IPs.
5. Attempted Fix Reconfiguring DHCP.
I noticed that the update introduced Kea DHCP, and the old ISC DHCP is now marked as legacy. I assume this is part of the problem.
I tried to configure Kea DHCP (Services > Kea DHCP > Subnets) for my TRUSTED VLAN (192.168.86.0/24). I created the subnet and added an IP pool (192.168.86.100 - 200).
Here is a critical issue: In the "Edit Subnet" screen for Kea, there are no input fields for "DNS servers" or "Routers" as some guides suggest there should be. The fields are simply missing from the GUI.
Summary of Current State:
WAN is UP and has a public IP.
OPNsense CAN ping external IP addresses (e.g., 8.8.8.8).
OPNsense CANNOT resolve any DNS hostnames (e.g., google.com).
Because the firewall's resolver is broken, none of my internal clients can access the internet.
The new Kea DHCP service seems to be missing key configuration options in its interface.
My Specific Question:
Why would OPNsense be unable to perform DNS lookups, even when public DNS servers are explicitly defined in the general settings and the WAN connection is confirmed to be working? Could this be a bug in the latest version related to Unbound DNS, or is there another setting I'm missing that would cause this behavior?
Thank you for your time and expertise. The failing ping diagnostics, my general DNS settings, and the Kea DHCP subnet page that is missing the router/DNS option fields.
#4
General Discussion / Re: OPNSense Discord is growin...
Last post by Srixun - Today at 01:17:03 AM100%. Just because something is different, doesnt mean its good or bad. There are many avenues to the same end goal.
There are hundreds and hundreds of troubleshooting forum posts where people have gotten answers in minutes and progressed and those people have done great in helping out other members as well.
Simply put, not everything is for everyone. If you dont like the idea of a discord, then you arent forced to use it, but some people do like discord as an avenue and its a lower barrier to entry for people coming into the fold in some arenas.
Just here to help and build and grow, and while I saw a comment before of "Its not the community, its YOUR Community" I am 100% certain that it is a cross pollination of users. and users that use the forums will see and use the discord, and vice versa.
Some of this thinking that "Different is ew and different is bad" is a kind of short sighted viewpoint in my opinion. When we can 100% work together and benefit OPNSense across the board and grow this community and build something better.
There are hundreds and hundreds of troubleshooting forum posts where people have gotten answers in minutes and progressed and those people have done great in helping out other members as well.
Simply put, not everything is for everyone. If you dont like the idea of a discord, then you arent forced to use it, but some people do like discord as an avenue and its a lower barrier to entry for people coming into the fold in some arenas.
Just here to help and build and grow, and while I saw a comment before of "Its not the community, its YOUR Community" I am 100% certain that it is a cross pollination of users. and users that use the forums will see and use the discord, and vice versa.
Some of this thinking that "Different is ew and different is bad" is a kind of short sighted viewpoint in my opinion. When we can 100% work together and benefit OPNSense across the board and grow this community and build something better.
#5
26.1, 26,4 Series / Re: Dnsmasq Leases display ord...
Last post by Greelan - Today at 12:47:08 AM #6
26.1, 26,4 Series / Re: Dnsmasq Leases display ord...
Last post by VimFuego - August 24, 2026, 11:52:25 PMConfirming this patch also fixes the IPv6 address ordering as well, thanks.
#7
26.7 Series / Re: can't find where to delete...
Last post by RobLatour - August 24, 2026, 11:40:34 PMThanks for this Patrick,
However, for clarification, by this I assume you mean to check the option on the interface entitled:
"This interface does not require an intermediate system to act as a gateway"
Which I did, followed by a save and apply, followed by another backup of my settings.
However, when I looked in them the same entry as shown in my original post was there.
```
<opt2>
<gateway>192.168.7.1</gateway>
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
<numberoptions>
<item/>
</numberoptions>
<range>
<from>192.168.7.24</from>
<to>192.168.7.24</to>
</range>
<winsserver/>
<dnsserver>192.168.7.1</dnsserver>
<ntpserver/>
<staticmap>
<mac>24:0a:c4:26:9e:43</mac>
<ipaddr>192.168.7.24</ipaddr>
<hostname>MasterClock</hostname>
<descr>MasterClock</descr>
<arp_table_static_entry>1</arp_table_static_entry>
<winsserver/>
<dnsserver/>
<ntpserver/>
</staticmap>
</opt2>
```
Will these now be ignored?
I'm asking as I would otherwise just test it, but I have to wait for mid morning tomorrow for the existing lease to expire.
Thanks again for your help.
However, for clarification, by this I assume you mean to check the option on the interface entitled:
"This interface does not require an intermediate system to act as a gateway"
Which I did, followed by a save and apply, followed by another backup of my settings.
However, when I looked in them the same entry as shown in my original post was there.
```
<opt2>
<gateway>192.168.7.1</gateway>
<ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
<numberoptions>
<item/>
</numberoptions>
<range>
<from>192.168.7.24</from>
<to>192.168.7.24</to>
</range>
<winsserver/>
<dnsserver>192.168.7.1</dnsserver>
<ntpserver/>
<staticmap>
<mac>24:0a:c4:26:9e:43</mac>
<ipaddr>192.168.7.24</ipaddr>
<hostname>MasterClock</hostname>
<descr>MasterClock</descr>
<arp_table_static_entry>1</arp_table_static_entry>
<winsserver/>
<dnsserver/>
<ntpserver/>
</staticmap>
</opt2>
```
Will these now be ignored?
I'm asking as I would otherwise just test it, but I have to wait for mid morning tomorrow for the existing lease to expire.
Thanks again for your help.
#8
German - Deutsch / Re: Netzwerkproblem
Last post by knebb - August 24, 2026, 09:47:55 PMMoin,
Du hast recht, ich bin in manchen Bereichen über's Ziel hinausgeschossen. Und ja, es war `traceroute`gemeint, nicht `tcpdump`. Mein Fehler.
Und ja, der OT ghostet uns wohl- aber deshalb hatte ich das ja auch noch ergänzt. Um die (ziemlich sichere) Lösung für das Problem zu posten.
/KNEBB
Du hast recht, ich bin in manchen Bereichen über's Ziel hinausgeschossen. Und ja, es war `traceroute`gemeint, nicht `tcpdump`. Mein Fehler.
Und ja, der OT ghostet uns wohl- aber deshalb hatte ich das ja auch noch ergänzt. Um die (ziemlich sichere) Lösung für das Problem zu posten.
/KNEBB
#9
Virtual private networks / Wireguard site to site with mu...
Last post by erdeidominik99 - August 24, 2026, 09:37:57 PMHy! I have 2 WAN connections. I have a wireguard site to site connection which I want to use the second wan for outgoing connection, not the default route one. I know that wireguard uses the system routing tabl, I tried to set up a floating rule with no success, then set up an SNAT rule to change the source ip, it works now, the connection goes out at the second WAN, but if the primary WAN fails it is not working, because the interface is down. Static route to the remote site ip is not an option, because I have another services on that ip, which I need the WAN failover function. Is there a solution to use the second WAN for the wireguard connection?
#10
26.7 Series / Re: Unbound stopps suddenly
Last post by jonny5 - August 24, 2026, 08:16:56 PMI've also see Unbound suddenly stop working, I also wrote a cronned script that checks if it is active and restarts it if necessary
