Recent posts

[- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.]

#1

26.7 Series / Re: Multiple VLANs - sometimes...

Last post by danman - Today at 05:59:10 AM

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

I've on that port only VLANs TAGGED to the switch and also now that - "- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration." but that doesnt change anything. Same issue as before.

Means you don't want that type of access anywhere else on your network ?

I've created a VLAN management for that but I'm not sure if Im going to use it.I might set things differently. But for now, the port 3 is the physical (no VLAN/untagged) access to the opnsense router.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I hope so :D

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

Haha, yeah its not connected to the Internet. I just want to set things up first. It can be handy to check out any firewall issues. I might reset the switch, might be an issue there.
I watched a video last night that you should suppose to set the VLAN PVID only on untagged ports but how does opnsense know which VLAN to handle the switch with then? And I always changed the PVID to work with OpenWrt and this works fine for years that way.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

Yeah, port 5 gets all VLANs (tagged) and some goes to the port 4/openwrt (tagged) and the other 3 ports are untagged.

Just by writing the last sentence I realised I never checked the untagged ports. Which I did now. Port 1 is running on ID 80 which works. Port 2 ID 20 and Port 3 on 50. All ports are working fine and gets the right DHCP/IP range etc. PVID works on that side, that is good.

So that basically means to me, that I probably should set up on opnsense igc1 port with the right IP range (25)? I'm trying to set the switch on VLAN ID 25 same for the openwrt but it always gets 80 and sometimes 60. If I set a static ip for the switch that would work too but as I mentioned there are coming a few more devices with TAGGED ports and I dont wanna play that game.

Just wondering why openwrt doesnt have the issues with PVID and opnsense has it or I can't find the set up for it or whatever.

So if I can't use PVID 25 for Port 4 & 5 to tell OPNsense in which DHCP/IP range it should put those devices how can I change it on opnsense side and not setting up static IPs?

#2

26.7 Series / VLAN devices are on LAN IPs

Last post by tonys - Today at 05:42:04 AM

Since upgrading to 26.7.x.x, all my VLAN devices (192.168.20.x, 192.168.40.x) now have LAN IP addresses. Here's my configuration (ssh'd into the Protectli VP2420 box):

*** OPNsense.home.lan: OPNsense 26.7.1_1 (amd64) ***

 DMZ (igc2)      -> v4: 192.168.30.1/24  (Protectli hardware port 3, DMZ addresses are correct)
 Guest (vlan01)  -> v4: 192.168.20.1/24 
 IoT (vlan02)    -> v4: 192.168.40.1/24
 LAN (bridge0)   -> v4: 192.168.1.1/24.  (Protectli hardware port 1, routes to WiFi)
 OPT4 (igc3)     -> (Bridged to LAN for external devices)
 WAN (igc1)      -> v4/DHCP4.            (Protectli hardware port 2)

------------------------------------------------------------------------------------

Interfaces: Assignments

wan  WAN hardware  igc1 
lan  LAN bridge    bridge0 (LAN->OPT4 Bridge) 
opt1 DMZ hardware  igc2 
opt2 Guest vlan    vlan01 Guest_VLAN (Parent: igc0, Tag: 20) 
opt3 IoT   vlan    vlan02   IoT_VLAN (Parent: igc0, Tag: 40) 
opt4 OPT4 hardware igc3 
opt5 OPT5 hardware igc0

BACK PANEL OF VP2420
  ___________________________________

 |                                   |
 |  [Port 4]  [Port 3]  [Port 2]  [Port 1] <-- (Physical Labels)
 |   igc3       igc2      igc1      igc0   <-- (OPNsense OS Names)

 |___________________________________|

Prior to the upgrade, all guest devices were assigned IP addresses in the 192.168.20.x space and all IoT devices were assigned IP addresses in the 192.168.40.x space. Now the ARP table shows all devices that are part of vlan01 (Guest) and vlan02 (IoT) having LAN IPs in 192.168.1.x space. I've tried rebooting several times but no luck. How do I get my VLAN IPs back? I don't want guests and IOT devices on my LAN.

#3

26.7 Series / Re: 26.7 upgrade warning

Last post by unixpgmr - Today at 05:38:26 AM

Thanks for the info. I have them but they are not installed.

#4

26.7 Series / Re: 26.7 upgrade warning

Last post by tangofan - Today at 05:31:07 AM

I was read though the upgrade notes that came up with the 26.7 upgrade. I read this:

The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.

What does it mean by "remove the plugin before proceeding"?. What plugin is it talking about?

Thanks

There are two plugins os-cpu-microcode-intel and os-cpu-microcode-amd and - depending on the CPU in your system - you can install the one you need to get updated microcode. It sounds though that you didn't install either, but I'd check to be on the safe side before upgrading your system. You can install/uninstall/see plugins under System -> Firmware -> Plugins.

#5

26.7 Series / 26.7 upgrade warning

Last post by unixpgmr - Today at 05:17:56 AM

I was read though the upgrade notes that came up with the 26.7 upgrade. I read this:

The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.

What does it mean by "remove the plugin before proceeding"?. What plugin is it talking about?

Thanks

#6

26.7 Series / Re: Startup: Unable to load dy...

Last post by NobodyStar - Today at 02:03:15 AM

I was able to solve this although I didn't have v83 I had 82
run

pkg info | grep -i mongodb

it will give you a version and name in my case 82 something once you have that run

pkg delete (whatever the name with the version you got from the first command was)

heaven73 was quite helpful in figuring that out

#7

German - Deutsch / Re: Hardware für 10gbit

Last post by Patrick M. Hausen - Today at 12:05:56 AM

Und was ist der Default bei Init7? Statisch, DHCP, PPPoE? Und welche Dienste willst du benutzen.

#8

General Discussion / Re: Adult and Child DNS resolv...

Last post by cookiemonster - Today at 12:02:53 AM

@cookiemonster was there a time when Unbound in OPNsense didn't support multiple DoT resolvers?  I don't remember but I'm curious what stubby is adding in that chain.

It probably didn't support multiple DoT resolvers at the time. I set it up some years ago and since multiple OPN upgrades so it has stayed. Maybe it was also some additional options that made it more desirable at the time: options of distribution to upstreams, ciphersuites, and other available knobs to tweak. I fail to remember.
Now looking at Unbound, if simply having DoT with multiple upstreams is the only wanted feature then you are right, Unbound on it's own would do.
The setup has served me well all along so I'm happy to leave it as it is. Good point though.

#9

German - Deutsch / Re: Hardware für 10gbit

Last post by Ferly - Today at 12:01:20 AM

Alles Default. Init7 10GBit.

[opnsense]

#10

26.7 Series / Re: Multiple VLANs - sometimes...

Last post by nero355 - August 01, 2026, 11:50:18 PM

My set up currently is with a OpenWrt router which has also a few VLANs.
So the switches are actually all set up and working for OpenWRT.

OK, but please note that this :

No need for that.

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

Unless I misunderstood you and this :

opnsense
On opnsense I deleted LAN entirely because I use Port 3 (igc2) for management of the opnsense device directly.

Means you don't want that type of access anywhere else on your network ?

This is one peace is missing currently.

Then that could be the issue...

But then I am curious about how you got any VLAN traffic flowing at all ?!

Also when I set up a static IP on the switch to VLAN ID 25 that works but I dont want to add on every single device a static IP.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I've created them all but I also disable sometimes the firewall just to check it out.
Not sure if that helps or makes things even worth though.

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

switch

- Port #1

I use port 5 for that. I could change that.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

This is currently on Port 4 and it seems to work so far, more or less. Similar issues with the switch though.

Like I mentioned above, I'll give it a shot later on.

Just double check everything and then post the results here and we can try to fix whatever needs fixing...

Thank you for the reply! Really appreciate it.

You are welcome! :)