Recent posts

#1

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by BrandyWine - Today at 03:24:42 AM

Ok, the issue popped up again this morning, verifying that the NVM update didn't in itself fix anything. I just installed the igc_aspm kernel, so we'll see how that goes now.

Code Select Expand

root@scutum:~ # uname -a
FreeBSD scutum.nightsky.internal 14.3-RELEASE-p16 FreeBSD 14.3-RELEASE-p16 igc_aspm-n272154-6f771ce68454 SMP amd64


In post #30 you mention you installed a kernel, which kernel was that one? Between #30 and #31 you installed two kernels ??

#2

Intrusion Detection and Prevention / Re: Constant DNS queries for o...

Last post by agreenbhm - Today at 03:17:11 AM

I noticed today I was experiencing the same issue.  Thankfully I believe I've found a solution (and submitted a pull request to address it).  In short, the ET-Pro telemetry plugin is looping (every minute) through all collected events and submitting them to opnsense.emergingthreats.net.  The way the script is written though results in a separate DNS lookup and connection for every single event, which might be hundreds or thousands in even a smaller network.  The script in question is /usr/local/opnsense/scripts/etpro_telemetry/send_telemetry.py.  The simple solution was to add a requests.Session() object and use that for POSTs (resulting in a single DNS lookup) rather than spawning a new object for every request.  See below for the complete script that you can drop-in place if you'd like.

Code Select Expand

#!/usr/local/bin/python3

"""
    Copyright (c) 2018-2019 Ad Schellevis <ad@opnsense.org>
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

    1. Redistributions of source code must retain the above copyright notice,
     this list of conditions and the following disclaimer.

    2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.

    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGE.
"""

import sys
import os
import argparse
import requests
import time
import random
import syslog
import urllib3
import ujson
import telemetry.log
import telemetry.state

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

parser = argparse.ArgumentParser()
parser.add_argument('-e', '--endpoint', help='Endpoint url to reach',
                    default="%s/api/v1/event" % telemetry.BASE_URL)
parser.add_argument('-i', '--insecure', help='Insecure, skip certificate validation',
                    action="store_true", default=False)
parser.add_argument('-c', '--config', help='rule downloader configuration',
                    default="/usr/local/etc/suricata/rule-updater.config")
parser.add_argument('-l', '--log', help='log directory containing eve.json files',
                    default="/var/log/suricata/")
parser.add_argument('-s', '--state', help='persistent state (and lock) filename',
                    default="/usr/local/var/run/et_telemetry.state")
parser.add_argument('-d', '--days', help='Maximum number of days to look back', type=float, default=1)
parser.add_argument('-D', '--direct',
                    help='do not sleep before send (disable traffic spread)',
                    action="store_true",
                    default=False)
args = parser.parse_args()


exit_code = -1
send_start_time = time.time()
telemetry_state = telemetry.state.Telemetry(filename=args.state, init_last_days=args.days)
if not telemetry_state.is_running():
    cnf = telemetry.get_config(args.config)
    if cnf.token is not None:
        if os.path.isdir(args.log):
            last_update = telemetry_state.get_last_update()
            event_collector = telemetry.EventCollector()
            row_count = 0
            max_timestamp = None
            for record in telemetry.log.reader(args.log, last_update):
                if max_timestamp is None or record['__timestamp__'] > max_timestamp:
                    max_timestamp = record['__timestamp__']
                event_collector.push(record)
                row_count += 1
            # data collected, log and push
            if row_count > 0 and max_timestamp is not None:
                syslog.syslog(
                    syslog.LOG_DEBUG,
                    'telemetry data collected %d records in %.2f seconds @%s' % (
                        row_count, time.time() - send_start_time, max_timestamp
                    )
                )
                # spread traffic to remote host, usual cron interval is 1 minute
                if not args.direct:
                    time.sleep(random.randint(0, 60))
                # the eventcollector loop sets exit_code when issues ocure, no data processed doesn't mean
                # anything is wrong (it's just not of interest to Proofpoint).
                exit_code = 0
                s = requests.Session()
                for push_data in event_collector:
                    params = {
                        'timeout': 5,
                        'headers': {'Authorization': 'Bearer %s' % cnf.token},
                        'data': push_data.strip()
                    }
                    if args.insecure:
                        params['verify'] = False

                    r = s.post(args.endpoint, **params)
                    if r.status_code != 201:
                        syslog.syslog(
                            syslog.LOG_ERR,
                            'unexpected result from %s (http_code %s)' % (args.endpoint, r.status_code)
                        )
                        exit_code = -1
                        break
                    else:
                        try:
                            ujson.loads(r.text)
                        except ValueError:
                            syslog.syslog(syslog.LOG_ERR, 'telemetry unexpected response %s' % r.text[:256])
                            exit_code = -1
                            break
                if exit_code == 0:
                    # update timestamp, last record processed
                    telemetry_state.set_last_update(max_timestamp)
            else:
                # no data
                exit_code = 0
        else:
            syslog.syslog(syslog.LOG_ERR, 'directory %s missing' % args.log)
    else:
        syslog.syslog(syslog.LOG_ERR, 'telemetry token missing in %s' % args.config)


sys.exit(exit_code)


#3

26.1, 26,4 Series / Re: How reliable is Firewall:D...

Last post by pfry - Today at 01:51:42 AM

I have a dim recollection of scrambled displays after applying rule changes (for sessions created prior to the change). Might be worth a search. I think that if you look up one of your odd sessions in the log, it'll read correctly.

#4

26.1, 26,4 Series / Re: How reliable is Firewall:D...

Last post by DaElephant - Today at 12:41:22 AM

Huh. What does the inbound state look like? I'd expect a pair like this...You cannot view this attachment.

I have not seen this again, after reporting it yesterday.  The other part of the pair was the IPs reversed, with the rule being let out anything from the firewall.  If this happens again I'll be sure to grab a screenshot of the whole pair.

#5

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by fornax - Today at 12:20:02 AM

Ok, the issue popped up again this morning, verifying that the NVM update didn't in itself fix anything. I just installed the igc_aspm kernel, so we'll see how that goes now.

Code Select Expand

root@scutum:~ # uname -a
FreeBSD scutum.nightsky.internal 14.3-RELEASE-p16 FreeBSD 14.3-RELEASE-p16 igc_aspm-n272154-6f771ce68454 SMP amd64


#6

26.7 Release Candidate Series / Re: OPNsense 26.7.r2_3 Disk Wi...

Last post by MoonbeamFrame - July 12, 2026, 10:23:52 PM

Applied the patch and rebooted the lab firewall (26.7.r2_3)

This did not change the widget layout.

#7

26.7 Release Candidate Series / Re: I'm cut off from my router...

Last post by nero355 - July 12, 2026, 08:03:41 PM

So my first step was to have the firmware upgraded over a crappy internet connection.

Then why do it via the webGUI ?!
_{(Or at all to be honest...)}

Next time SSH to it and use something like screen or tmux ;)

I started the upgrade for OPNsense without carefully reading the release notes.

Well... now you know...

I noticed the required reboot, which did give me pause for a moment, but not long enough to call it off (I never had it not get back after an upgrade).

That's something that has always bothered me a bit :

I want more control over the update process and not have things done for me after a step has been completed.

* The machine has remote management, but only accessible via the LAN side. With OPNsense down (no DHCP available) I can't ask someone to connect to it.

You don't need DHCP to connect directly to it ?!

Just ask someone you trust to assign a Laptop the right IP Address in the same subnet and connect P2P to it :)

With the upgrade to a (for me) unknown version in an unknown state, is there an other option than power cycle and hope for the best?

I would ignore that option for now and try the stuff mentioned above!

#8

Tutorials and FAQs / Re: OPNsense aarch64 firmware ...

Last post by Maurice - July 12, 2026, 08:00:31 PM

OPNsense 26.1.11 aarch64 packages and sets were released on 2026-07-02.

Hotfix 26.1.11_6 was released today.

#9

26.7 Release Candidate Series / Re: Services widget

Last post by nero355 - July 12, 2026, 07:51:08 PM

In addition to I've noticed a scroll bar in single column mode even if I dragged the table down completely.

To be honest :

I have noticed this kind of stuff in earlier OPNsense releases with some widgets and could not care less about it since it's not something I am looking at all the time and might also have to do with compatibility with the various browsers I am using :)

This is another example : https://forum.opnsense.org/index.php?msg=270100

"Oh well..."

#10

Tutorials and FAQs / Re: OPNsense aarch64 firmware ...

Last post by Maurice - July 12, 2026, 07:44:17 PM

The fingerprints were moved to GitHub, they're in my fork of opnsense/core:
https://github.com/maurice-w/opnsense-core/tree/stable/25.7/src/etc/pkg/fingerprints/OPNsense/trusted