Recent posts

#1

26.7 Series / Re: Wireguard vs. DNS resoluti...

Last post by oc - Today at 05:31:18 PM

Apologies for the later reply - in my timezone folks were working and I couldn't reboot the OPN during the day.

Further troubleshooting steps:

1. I have disabled all the wireguard peers and rebooted the OPNsense. Boot time was fast, similar to before enabling WG on it.

2. I have left disabled all the wireguard outbound peers (3 of them, two to public VPN providers, and one to a personal VPN - going to three different countries), but re-activated all the inbound VPN peers (the OPN as server and the various clients such as my phone, tablet, laptop, etc.) and rebooted the OPNsense. Boot time was also fast, similar to before enabling WG on it. Also - interestingly - the DNS resolution worked on the client I've tested it on (my mobile phone, connected to the OPNsense via cellular data). Note: I've only rebooted once in this configuration, so perhaps the fact that the client I tested with could resolve was a fluke, but I somehow doubt it.

3. I have then (after step 2, without re-rebooting the OPNsense) reactivated the three outbound peers, but they were flakey. I tried to refresh the individual instances in the dashboard, but the flakiness persisted. However, upon refreshing the wireguard service itself all re-became stable and all "lights are green".

4. Some observations: when booting, I noticed the following sequence:

....
....
Starting DNSmasq
Starting Unbound DNS
....
....
Starting Wireguard VPN
....
....
Starting Unbound DNS
....
....

Q1: Is it normal that Unbound DNS appears twice, before and after the Wireguard VPN service start?

Q2: These observations point to the opinions expressed online, that the issues are when having dynamic IPs resolved through name resolution as outbound VPN connections. I thought some more about that, and the issue is that indeed the TTL on those records are short, between 60 and 300 seconds. I don't have control over those, but I have created CNAMEs pointing to them with 3600s TTLs and used those as peer names - but that doesn't help either, as (I believe) Unbound is clearing its cache upon reboot, and therefore a new query will still be necessary if the remote peers are addressed by name upon reboot, which brings us back to the Unbound vs. WG chicken-or-egg conundrum. Any workable solution? Thank you, and have a great weekend!

[view]

#2

General Discussion / Re: Installation Image availab...

Last post by nero355 - Today at 04:59:43 PM

You can find the business images here: https://opnsense-update.deciso.com/

Use your subscription key to few view the contents of the mirror.

^_^

#3

26.7 Series / Re: Fetching base-26.7.3-amd64...

Last post by nero355 - Today at 04:37:16 PM

Not a DNS issue, but close.
IPv6 bugging out was the cause. Apparently the FW itself can't speak IPv6 with the outside world anymore hence IPv6 timed out.
Clients behind the FW have no issue with IPv6. Weird.

Already tried disabling IPv6, but I missed that there was still a default fe80:: route learned via RA that caused the timeout.
After deleting that route:

Did you do that manually ?!

There shouldn't be any need to do so : You can tell OPNsense to use IPv4 for all of it's own connections to the Internet in the Settings/Configuration with just one simple checkbox :)

#4

26.7 Series / Re: Running OPNsense 26.7 on a...

Last post by nero355 - Today at 04:32:53 PM

Please keep in mind that USB sticks typically don't have SMART or similar interfaces

The ones that are basically a SSD inside do have it I believe ?!

But it's something that I would not recommend to anyone to be honest : Just get a cheap SSD instead :)

#5

26.7 Series / Re: Unbound stopps suddenly

Last post by nero355 - Today at 04:23:35 PM

4 GB is not enough for newer versions with larger blocklists.

That's INSANE for something as simple as adblocking... :(

Please either listen to Patrick :

If you like to use DNSBL I recommend delegating that to a servicd that is designed specifically with large lists in mind.
Like AdGuard Home which can run directly on OPNsense and comes with a much nicer UI to manage excepted devices, manual allowlists, statistics etc.

Or grab yourself a Raspberry Pi 2B/3B or Intel Atom NUC and run Pi-Hole + Unbound on it :)


_{The laptop I posted this from has 4 GB of RAM FFS! LOL! ^_^}

#6

26.7 Series / Re: Fatal error: Uncaught Erro...

Last post by nero355 - Today at 04:15:48 PM

it is possible that its happing because of unclean removal of the zenarmor package.
the machines were the upgrade fails, all coming back with this nasty spaming mongodb error:

[04-Sep-2026 10:18:09 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library 'mongodb.so' (tried: /usr/local/lib/php/20250925/mongodb.so (Cannot open "/usr/local/lib/php/20250925/mongodb.so"), /usr/local/lib/php/20250925/mongodb.so.so (Cannot open "/usr/local/lib/php/20250925/mongodb.so.so")) in Unknown on line 0

will try to remove the /usr/local/etc/php/ext-20-mongodb.ini file prior the upgrade

FYI : https://www.zenarmor.com/docs/guides/best-practices-for-zenarmor-deployment#reporting-database

TL;DR : Anything related to MongoDB on your system can be removed if you are running the latest version of ZenArmor :)

#7

26.7 Series / Re: ZFS over UFS and config re...

Last post by nero355 - Today at 04:05:53 PM

ZFS requires slightly more RAM but is way less prone to corruption upon unexpected power loss.

IMHO the SSD you are using is the part that you should worry about and the file system only comes after that !!

Try to find a SSD model that has proper Power Loss Protection with decent capacitors onboard that fully protect the SSD's data : Both the Index and the Data on it and the RAM Cache ofcourse!


Why I am mentioning this :

Most SSD models on the market don't have ANY of the above !!
They just discard the data after/during the next boot and do some basic checks and that's it... If they even have a proper RAM Cache at all...


So watch out with your next SSD purchase and I am not just talking about the sky high prices these days ;)

#8

26.7 Series / Re: Problems with upgrade from...

Last post by Vulhunter25 - Today at 03:59:49 PM

So unfortunately I recently upgraded proxmox to latest version. Unknow to me it deleted the snapshots I had and I was relying on them being there. Ugh stupid on my part.

I removed the routing tunable setting and rebooted. Searching the log I see vtnet1 getting the ip address and gateway. It successfully sets them. However no access to internet. Additionally the dhcp script is running every hour to renew the address. That seems excessive.

I am getting the feeling I will need to rebuild this system, but am hesitant to use 26.7.3.

[!!! Upgrade your Bootloader after upgrading to 26.7 !!!]

#9

26.7 Series / Re: Confused by 26.7 upgrade

Last post by nero355 - Today at 03:53:58 PM

And what is 'config.xml'?

Ehh... seriously... ?!?!

It's the file that holds your complete OPNsense configuration and can be easily downloaded for backup purposes via the webGUI so you can restore it in the current or new installation of OPNsense ;)


You have just hit a bad spot in time during the history of OPNsense in my opinion where a lot of migrations need to be done to be compatible with future source code upgrades or whatever it's officially called :
- ISC DHCP got moved to a plug-in.
Luckily migrating to either KEA or DNSmasq is pretty easy thanks to .CSV file exports for your Static DHCP Mappings.

- Firewall Rules (Leagacy) got moved to a plug-in.
Firewall Rules [New] is now the only Firewall Rules section and needs to be migrated indeed.
The official plan was before upgrading from 26.1 to 26.7 but luckily it's not that strict and can be done afterwards too!

- Port Forward just got renamed to Destination NAT.
So that was pretty easy :)

- Outbound NAT is going to be the new Source NAT from now on.
So this also needs migrating now.
The offical plan is during 26.7 and before upgrading to 27.1 next year, but maybe you can get away with doing that later on too... Dunno...

And last but absolutely not least :
!!! Upgrade your Bootloader after upgrading to 26.7 !!!
However this is a FreeBSD thing and not OPNsense specific ;)

Once we get all this stuff behind us I am sure the updates/upgrades will be a lot less hassle than they seem to be now :)



Good luck! with all of the above...

#10

26.7 Series / Re: Network Driver Install

Last post by nero355 - Today at 03:32:38 PM

Is there a step by step guide on how to install the drivers for a mini computer that didn't detect any drivers, I believe its a RealTek NIC

In all honesty :

Just don't use it if you can't replace the RealTek NIC(s) or add aditional Intel NIC(s) to avoid future issues :)