Recent posts

#1

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by OPNenthu - Today at 12:11:17 AM

I was initially going to wait until I considered this resolved and then reach back out to let them know, but I'm accelerating that now.

Thanks for sharing the statement but please don't rush on account of my asking about it.  It's good to know if your issue truly is resolved by switching to AMI (and no other factors).

#2

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by fornax - August 04, 2026, 11:59:00 PM

@fornax did you get any statement from them about this?  Are they even working with you to diagnose and root cause, or just pushing you to AMI?

The only time I've reached out to them so far was specifically about the NVM update, but I did summarize the issue, so they did respond to that as well. And I'm glad you mentioned that, because looking back at the email I realize I misread it initially and probably should have tried this sooner. The relevant part is:

At this point we have seen similar behavior in the VP3200 series' coreboot implementation compared to the VP2440's. The VP2440 had a NIC throughput degradation issue that was related to ASPM. (https://kb.protectli.com/wp-content/uploads/sites/9/2026/02/TSB-2025-001_VP2440-ASPM-Network-Interface-Performance-Issue-v2_0.pdf) Our other products don't seem to display this behavior.

I missed that they've actually seen "similar behavior" in my model as in the VP2440, which had a coreboot issue that required an update. So that's entirely on me, I should have pursued that at the time. I was initially going to wait until I considered this resolved and then reach back out to let them know, but I'm accelerating that now.

#3

General Discussion / Re: Crowdsec plugin aliases: c...

Last post by Patrick M. Hausen - August 04, 2026, 11:02:11 PM

The terms "whitelist" and "blacklist" are considered racist and most projects replace(d) them with e.g. "allowlist" and "blocklist". Similar "master" in version control is replaced by "main" and "master/slave" in high availability by e.g. "primary/secondary" or "active/standby".

Kind regards,
Patrick

#4

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by OPNenthu - August 04, 2026, 10:44:55 PM

I'm not aware of a widespread issue with coreboot but then again I don't have a Reddit account.  Who knows what's out there :-/

It's weird that Protectli support tell people to use AMI as coreboot is one of the main selling points and something they recommend.

We don't have a clear picture.  @fornax did you get any statement from them about this?  Are they even working with you to diagnose and root cause, or just pushing you to AMI?

#5

General Discussion / Re: Static IP on WAN side

Last post by viragomann - August 04, 2026, 10:40:10 PM

myip.dk reports the static IP as expected (84.x.x.x)
OPNsense dashboard shows WAN gateway address as (212.x.x.x)

With the old ISP both were the same.  I cannot connect to my VPN now so I suspect something is wrong.

WAN IP and gateway IP must differ at all, otherwise you would not be able to access anything on the internet.

The site displays the public IP, which you're using to access it. So it should be the same as the WAN IP OPNsense displays on the dashboard, but not the gateway.

#6

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by tangofan - August 04, 2026, 10:21:08 PM

Wanted to drop in a status update. I'm not ready to declare victory quite yet, but this is the longest I've gone without an incident in quite a while. Possibly it was an issue with coreboot? Fingers crossed. I'll give it another week and then consider this resolved.

I am also running a Protectli (VP2420) with I226-V NICs and AMI-Bios and never had any stability problems. While I like the idea of coreboot as an open source solution, I have never used it on my two Protectli units and issues like the one you describe make me even less likely to try it in the future.

#7

General Discussion / Re: Roku DNS storm is impactin...

Last post by OPNenthu - August 04, 2026, 10:20:24 PM

I had almost two months of relief from this but now I got a Monit alert email that the CPU was pegged.

It's Roku again.

Code Select Expand

# top

last pid: 94206;  load averages:  12.54,  12.19,    7.00                                          up 1+00:26:27  15:38:35
75 processes:  3 running, 72 sleeping
CPU: 97.8% user,  0.0% nice,  2.3% system,  0.0% interrupt,  0.0% idle
Mem: 937M Active, 1712M Inact, 2074M Laundry, 1646M Wired, 1151M Free
ARC: 705M Total, 221M MFU, 403M MRU, 532K Anon, 14M Header, 63M Other
    566M Compressed, 6726M Uncompressed, 11.89:1 Ratio
Swap: 8192M Total, 2265M Used, 5926M Free, 27% Inuse

  PID USERNAME    THR PRI NICE  SIZE    RES STATE    C  TIME    WCPU COMMAND
 4737 root        11 113    0  470M  371M CPU1    1  2:41 191.32% python3.13
 4013 root        11 111    0  514M  396M RUN      3  2:43 180.62% python3.13
48625 unbound      4  3    0  802M  376M kqread  1 191:11  19.53% unbound
17859 root          3  0    0    81M    36M kqread  1  14:54  1.34% syslog-ng
87088 root          1  0    0    14M  1748K bpf      3  13:56  1.33% filterlog
...

You cannot view this attachment.


I went back to post #4 and re-added the host override in Unbound.

I see from the query logs that the override is in effect (it's using "Source=Local-data"), but the client is still spamming so much that it's keeping the OPNsense CPU busy and the system temps elevated.

Code Select Expand

# top

last pid: 43681;  load averages:    6.45,    2.66,    2.83                                           up 1+00:52:34  16:04:42
77 processes:  3 running, 74 sleeping
CPU: 97.9% user,  0.0% nice,  2.0% system,  0.1% interrupt,  0.0% idle
Mem: 1176M Active, 1138M Inact, 1838M Laundry, 1680M Wired, 1689M Free
ARC: 724M Total, 243M MFU, 402M MRU, 1668K Anon, 14M Header, 64M Other
     583M Compressed, 6817M Uncompressed, 11.69:1 Ratio
Swap: 8192M Total, 2147M Used, 6045M Free, 26% Inuse

  PID USERNAME    THR PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
  750 root         11 111    0   443M   342M RUN      2   1:59 193.59% python3.13
   23 root         11 114    0   464M   367M CPU3     3   2:03 191.15% python3.13
 9890 unbound       4   0    0   617M   501M kqread   3   0:57   9.36% unbound
17859 root          3   0    0    85M    39M kqread   1  15:06   0.70% syslog-ng
87088 root          1   0    0    14M  1748K bpf      2  14:08   0.70% filterlog
...

Hopefully it calms down in some time but I may need to break down and install a standalone DNS there to get this load off of OPNsense.  As a last resort I'll consider disabling the telemetry blocks :(

[o]

#8

General Discussion / Crowdsec plugin aliases: crowd...

Last post by tangofan - August 04, 2026, 09:55:34 PM

On my 26.7.1_1 installation of OPNsense I recently successfully ran the rules migration and switched to the new firewall and NAT rules UI. However there was one oddity that I noticed. For the Crowdsec plugin I am having TWO aliases for IPv4, crowdsec_blocklists and crowdsec_blacklists (and similarly two aliases for IPv6).

The "blacklists" alias appears in a floating rule, which I manually created some years ago, the blocklists alias appears in automatically generated rules (see attached pic). Apparently only the ipv4 crowdsec_blocklists alias is populated (see attached pic).

I'm wondering, what happened here. Did Crowdsec at some point in time change the naming scheme of their aliases from xxx_blacklists to xxx_blocklists? If so, I assume I could just delete my manual rules and delete the alias crowdsec_blacklists and crowdsec6_blacklists. Or does these aliases actually mean different things?

Thanks in advance for any insights.

#9

26.7 Series / Re: Kea-dhcp4,problem. No conn...

Last post by nero355 - August 04, 2026, 09:38:13 PM

I am guessing you have got a setting similar to "If the IP Address is not in the DHCP Leases Database then refuse any connectivity to the Client" Enabled somewhere ??

#10

General Discussion / Re: Static IP on WAN side

Last post by kermitxyz - August 04, 2026, 09:21:58 PM

Thanks.  It's strange because with the previous ISP the IP address shown on the dashboard gateway widget was the same as my actual static IP.  With the second ISP it is not.

The service is now working (incoming traffic too) so perhaps it just needed to settle.  But I would be interested to know the reason for the difference between the two?