"Recent posts
#1
General Discussion / Re: Adult and Child DNS resolv...
Last post by Patrick M. Hausen - Today at 09:33:52 PMI suggest you investigate AdGuard Home. Runs well as a plugin on OPNsense and allows to manage per client policies directly in the AGH management UI.
#2
26.1, 26,4 Series / Re: pppoe requiring me to re-e...
Last post by pj97 - Today at 08:04:57 PMhttps://forum.bell.ca/t5/internet/pppoe-not-working-after-a-recent-firmware-update/td-p/109253/page/6
Seems it is Bell modem related, not opnsense
Seems it is Bell modem related, not opnsense
#3
General Discussion / Re: Adult and Child DNS resolv...
Last post by OPNenthu - Today at 07:59:40 PMDo you specifically need different upstream resolvers?
One solution since you already have VLANs is to set up blocklist policies in Unbound (Unbound DNS->Blocklists). Separate resolvers or DNS servers aren't needed if you are just wanting per-VLAN filtering.
The kids can circumvent your DNS blocks via e.g. browser or OS network settings. You probably already know but worth mentioning.
One solution since you already have VLANs is to set up blocklist policies in Unbound (Unbound DNS->Blocklists). Separate resolvers or DNS servers aren't needed if you are just wanting per-VLAN filtering.
The kids can circumvent your DNS blocks via e.g. browser or OS network settings. You probably already know but worth mentioning.
#4
Hardware and Performance / Re: proper way to limit SFP mo...
Last post by pfry - Today at 07:43:29 PMQuote from: DEC740airp414user on Today at 04:30:21 PMboth modules are very hot to the touch. I was wanting to limit to 1Gb to see if it helped
It should. Most SFP+ devices can accept SFPs... but my limited experience with such is... mixed. In addition, some 1000BASE-T SFPs are quite low power, and some are similar to your existing SFP+. Caveat emptor.
#5
General Discussion / Adult and Child DNS resolver i...
Last post by pasha-19 - Today at 07:05:24 PMI have been researching creating multiple DNS resolvers one for adults and one for children.
If DNSmasq:53053 without forwarding provides local DNS and DHCP services for multiple vlans both IPv4 and IPv6. DNSmasq:53053 is DNATed and has FW Rules for all DNS queries with an IPv6 source address as the local ONLY DNS resolver (my ISP is IPv4 only).
Unbound is the adult DNS resolver (IPv4 source addresses); query forwarding to DNSmasq to all local dns resolution and DOT to quad9 for forward resolution of external resources. DNAT and FW Rules enforce this currently.
Child DNS services can be provided using DNScrypt-proxy and DOH. I have been looking for a DOT solution for the Child DNS services, too.
In what seem to be circular possibilities OPNSENSE is reported to have supported multiple Unbound instances in the past and no longer apparently. OPNSENSE also supported Stubby at one time and Unbound forwarding to Stubby for external DOT queries also appear to have been supported in the past. Documentation indicates that Stubby with parallel design choices to Unbound can support query forwarding for local domains (to DNSmasq:53053) and DOT resolution using CleanBrowsing servers for children. Both sets of filtered dns servers could also be replaced by CloudFlare servers (1.1.1.2/... and 1.1.1.3/... respectively.
QUESTION: In the old code base for OPNSENSE or maybe as a community plugin would it be reasonable for Stubby to be supported as a very similar alternative to Unbound when one wishes to create a second DNS resolver for support of a second distinct set of users (children in this case)? Multiple Unbound instances is also a desirable possibility.
If DNSmasq:53053 without forwarding provides local DNS and DHCP services for multiple vlans both IPv4 and IPv6. DNSmasq:53053 is DNATed and has FW Rules for all DNS queries with an IPv6 source address as the local ONLY DNS resolver (my ISP is IPv4 only).
Unbound is the adult DNS resolver (IPv4 source addresses); query forwarding to DNSmasq to all local dns resolution and DOT to quad9 for forward resolution of external resources. DNAT and FW Rules enforce this currently.
Child DNS services can be provided using DNScrypt-proxy and DOH. I have been looking for a DOT solution for the Child DNS services, too.
In what seem to be circular possibilities OPNSENSE is reported to have supported multiple Unbound instances in the past and no longer apparently. OPNSENSE also supported Stubby at one time and Unbound forwarding to Stubby for external DOT queries also appear to have been supported in the past. Documentation indicates that Stubby with parallel design choices to Unbound can support query forwarding for local domains (to DNSmasq:53053) and DOT resolution using CleanBrowsing servers for children. Both sets of filtered dns servers could also be replaced by CloudFlare servers (1.1.1.2/... and 1.1.1.3/... respectively.
QUESTION: In the old code base for OPNSENSE or maybe as a community plugin would it be reasonable for Stubby to be supported as a very similar alternative to Unbound when one wishes to create a second DNS resolver for support of a second distinct set of users (children in this case)? Multiple Unbound instances is also a desirable possibility.
#6
General Discussion / Re: Problem with ping on one e...
Last post by lmoore - Today at 06:28:30 PMIn addition, to see the source address that has been used by your NAT rule, you could run 'pftop'. The address will be listed under the 'GW' column.
The output should look something like this;
Code Select
pftop -s1 -v state -f 'icmp and host 212.XXX.XXX.XXX'The output should look something like this;
Code Select
pfTop: Up State 1-2/2 (101), View: state, Order: none, Cache: 10000 22:28:53
PR DIR SRC DEST STATE AGE EXP PKTS BYTES RATE PEAK AVG RU GW
icmp In 10.11.0.5:1 212.XXX.XXX.XXX:8 0:0 3 9 6 360 120 *
icmp Out 87.XXX.XXX.XXX:27203 212.XXX.XXX.XXX:8 0:0 3 9 6 360 120 * 10.11.0.5:1 #7
26.7 Series / Re: System Backup - os-git-bac...
Last post by Maurice - Today at 06:26:23 PMDid you enable DNS64? Then it's expected behavior. IPv6 is generally preferred over IPv4 and it doesn't matter whether the destination address is a "native" IPv6 address or an address synthesized by DNS64.
Cheers
Maurice
Cheers
Maurice
#8
26.1, 26,4 Series / Re: DEC840 slow upload test wh...
Last post by tedhughes - Today at 04:35:33 PMQuote from: JamesFrisch on July 29, 2026, 08:16:37 AMahh, no?
https://www.fs.com/products/185594.html
And bevor you ask, friend of mine his XGS-PON with that and OPNsense ;)
@tedhugehes I you would at least only slop your own thread, instead of someone elses. *old man yelling at cloud* Back in my days, we called that thread hijacking.
"Thread hijacking" - of which there were zero replies to a thread created 5 months ago on what looked like a similar topic. Keep on beclowning yourself, though. And please show me another transceiver that I can't plug into my ISP's ONT. Please? A third might help!
#9
Hardware and Performance / Re: proper way to limit SFP mo...
Last post by DEC740airp414user - Today at 04:30:21 PMboth modules are very hot to the touch. I was wanting to limit to 1Gb to see if it helped
#10
Hardware and Performance / Re: proper way to limit SFP mo...
Last post by pfry - Today at 03:44:57 PMSX and LX are short and long-wave optics, respectively. CX is STP, KX is PCB (base signaling, e.g. SFP). Most appropriate of those choices would probably be KX. Note the "most" - it may not be appropriate/functional. You seem to have connectivity (at default settings? 10GBASE-T?)... The module has moderate (advertised) power consumption - 1.8W. If it works, you may be stuck with it.
