"Recent posts
#11
General Discussion / Re: Beta testers and reviewers...
Last post by Kornelius777 - Today at 08:47:23 AMBUMMER!
Easy to install, works like a charm!
THANK YOU!
Easy to install, works like a charm!
THANK YOU!
#12
Hardware and Performance / Re: 10G but reaching only 5-5....
Last post by ou1 - Today at 07:53:57 AMQuote from: stanps on Today at 03:04:55 AMI don't see that anyone has recommended this, and it may not be feasible but....you could plug a machine directly in to you ISP's endpoint and do a speed test from there. And then plug directly in to your OPNSense fw and check from there.
You might not have full bandwidth on the public side of your fw. It may not even be an OPNSense issue.
It's definitely not an ISP issue, i get full speed with different machine, same opnsense config and sfp+ modules. CPU on DEC 750 is too slow for 10G, unless there are some config options that we've missed.
#13
26.7 Series / Re: Default Deny / State Viola...
Last post by peterwkc - Today at 04:39:02 AMAfter 1 hour of running the fw, it get back to normal. Thread closed.
#14
26.7 Series / Default Deny / State Violation...
Last post by peterwkc - Today at 04:33:31 AMDear all hacker, I did not touch my firewall for quite some time but after i woke up today. My whole internet is not working. Therfore, I try look out the firewall log then found out that all valid connection is drop by the firewall.
Please help me on this as i having no internet now.
Please help me on this as i having no internet now.
#15
26.7 Series / Some observations that may be ...
Last post by erwinvanlonden - Today at 04:07:41 AMI observed some issues with 26.7.4 which caused Unbound to fail and therefore basically killed off my internet access.
This is a home setup so it would not likely to hit businesses that have dedicated hardware.
I run OpnSense in a Proxmox VM with 2 WAN interfaces directly bridged from the hardware into OpnSense as well as 1 LAN interface with around 8 VLAN's stacked on top of that.
By default when you instantiate a VM in a somewhat older Proxmox version, it will attach a x86_64 processor (depending on the underlying hardware). This will become incompatible with some of the later Python libraries such as NumPy which seem to require some fancy processor features that are exposed with newer processor architectures. Therefore when I changed the underlying virtual cpu to x86-64-v2 in Proxmox and rebooted the VM, that problem went away.
Another issue that I encountered was also related to Unbound.
Apparently one of the local network systems had registered with an unsupported hostname "xxxxx." (mind the . at the end) via DHCP. I didn't see this at first and just assigned a static IP address for this system in Kea without modifying the hostname. This causes that hostname to show up in the Unbound static list as well when you have Opnsense configured to do so via the "Register DHCP Static Mappings" setting.
As the "." will cause a concatenation of hostname and domainname resulting in something like "xxxx..example.com". That will cause Unbound to fail as it cannot load an empty zone "..example.com". You'll run into errors like:
```
2026-09-24T22:49:17 Critical unbound [79215:0] fatal error: Could not set up local zones
2026-09-24T22:49:17 Error unbound [79215:0] error: Bad local-data RR xxxxx..example.com IN A 10.10.10.10
2026-09-24T22:49:17 Error unbound [79215:0] error: error parsing local-data at 12 'xxxxx..example.com IN A 10.10.10.10': Empty label
```
After I corrected the hostname and registration in Kea, unbound could start normally.
Not sure if anyone has run into the same issue(s) but it may come in handy to have it posted here for future reference.
Cheers
Erwin
This is a home setup so it would not likely to hit businesses that have dedicated hardware.
I run OpnSense in a Proxmox VM with 2 WAN interfaces directly bridged from the hardware into OpnSense as well as 1 LAN interface with around 8 VLAN's stacked on top of that.
By default when you instantiate a VM in a somewhat older Proxmox version, it will attach a x86_64 processor (depending on the underlying hardware). This will become incompatible with some of the later Python libraries such as NumPy which seem to require some fancy processor features that are exposed with newer processor architectures. Therefore when I changed the underlying virtual cpu to x86-64-v2 in Proxmox and rebooted the VM, that problem went away.
Another issue that I encountered was also related to Unbound.
Apparently one of the local network systems had registered with an unsupported hostname "xxxxx." (mind the . at the end) via DHCP. I didn't see this at first and just assigned a static IP address for this system in Kea without modifying the hostname. This causes that hostname to show up in the Unbound static list as well when you have Opnsense configured to do so via the "Register DHCP Static Mappings" setting.
As the "." will cause a concatenation of hostname and domainname resulting in something like "xxxx..example.com". That will cause Unbound to fail as it cannot load an empty zone "..example.com". You'll run into errors like:
```
2026-09-24T22:49:17 Critical unbound [79215:0] fatal error: Could not set up local zones
2026-09-24T22:49:17 Error unbound [79215:0] error: Bad local-data RR xxxxx..example.com IN A 10.10.10.10
2026-09-24T22:49:17 Error unbound [79215:0] error: error parsing local-data at 12 'xxxxx..example.com IN A 10.10.10.10': Empty label
```
After I corrected the hostname and registration in Kea, unbound could start normally.
Not sure if anyone has run into the same issue(s) but it may come in handy to have it posted here for future reference.
Cheers
Erwin
#16
Hardware and Performance / Re: DEC 700 and 2700 series - ...
Last post by newsense - Today at 03:48:24 AMNew firmware has been published for
DEC800, DEC3800 & DEC4000 series
09-2026 Version 05.22.01.0029.0020
DEC700 and DEC2700 series
09-2026 Version 05.3A.17.0031-A10.37
DEC800, DEC3800 & DEC4000 series
09-2026 Version 05.22.01.0029.0020
DEC700 and DEC2700 series
09-2026 Version 05.3A.17.0031-A10.37
#17
Hardware and Performance / Re: 10G but reaching only 5-5....
Last post by stanps - Today at 03:04:55 AMI don't see that anyone has recommended this, and it may not be feasible but....you could plug a machine directly in to you ISP's endpoint and do a speed test from there. And then plug directly in to your OPNSense fw and check from there.
You might not have full bandwidth on the public side of your fw. It may not even be an OPNSense issue.
You might not have full bandwidth on the public side of your fw. It may not even be an OPNSense issue.
#18
26.7 Series / ACME cron renewal fails but ma...
Last post by arrowd - Today at 01:38:44 AMI set up the ACME service on my OPNsense (v26.7.4_1 on a Protectli V1410) in the spring. The problem I describe happened at the first cert renewal, but I decided to wait for the next run to see if it repeated. The certificate was due for replacement yesterday but the cron job failed. I then ran it manually and it succeeded without my changing any setting. I have my domain DNS at Cloudflare. My TrueNAS is set up similarly and the ACME runs correctly there. This is apparently a commmon problem on OPNsense as I found at least two separate forum posts saying essentially the same thing. Neither had a solution with people just saying they would renew manually when needed. Do you think this is a permission problem? A Cloudflare problem? Thanks for reading.
Below is the log in debug format. I replaced my domain name with 'mydomainname' and my unique numbers with equal length strings of 'a','b','c','x', or 'y'. The two sets of long log lines between cron/manual runs are identical.
2026-09-24T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: running automation (configd): Restart Web GUI
2026-09-23T13:44:08-04:00configAcmeClient: running automations for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: updated ACME X.509 certificate: opnsense.mydomainname.net (ccccccccccccccc)
2026-09-23T13:44:08-04:00opnsenseAcmeClient: successfully issued/renewed certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T13:43:38-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T13:43:38-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T13:43:38-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: validation for certificate failed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: domain validation failed (dns01)
2026-09-23T00:00:01-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '2': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T00:00:00-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T00:00:00-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T00:00:00-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net
2026-09-22T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net
Below is the log in debug format. I replaced my domain name with 'mydomainname' and my unique numbers with equal length strings of 'a','b','c','x', or 'y'. The two sets of long log lines between cron/manual runs are identical.
2026-09-24T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: running automation (configd): Restart Web GUI
2026-09-23T13:44:08-04:00configAcmeClient: running automations for certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00configAcmeClient: updated ACME X.509 certificate: opnsense.mydomainname.net (ccccccccccccccc)
2026-09-23T13:44:08-04:00opnsenseAcmeClient: successfully issued/renewed certificate: opnsense.mydomainname.net
2026-09-23T13:44:08-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T13:43:38-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T13:43:38-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T13:43:38-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T13:43:38-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: validation for certificate failed: opnsense.mydomainname.net
2026-09-23T00:00:01-04:00opnsenseAcmeClient: domain validation failed (dns01)
2026-09-23T00:00:01-04:00opnsenseAcmeClient: AcmeClient: The shell command returned exit code '2': '/usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf''
2026-09-23T00:00:00-04:00opnsenseAcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 7 --debug --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/xxxxxxxxxxxxxx.yyyyyyyy' --certpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/cert.pem' --keypath '/var/etc/acme-client/keys/xxxxxxxxxxxxxx.yyyyyyyy/private.key' --capath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/chain.pem' --fullchainpath '/var/etc/acme-client/certs/xxxxxxxxxxxxxx.yyyyyyyy/fullchain.pem' --domain 'opnsense.mydomainname.net' --days '60' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/aaaaaaaaaaaaaa.bbbbbbbb_prod/account.conf'
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using challenge type: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account config is valid (CERT_HOME): OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: account is registered: OPNsense GUI Certificate
2026-09-23T00:00:00-04:00opnsenseAcmeClient: using CA: letsencrypt
2026-09-23T00:00:00-04:00opnsenseAcmeClient: renew certificate: opnsense.mydomainname.net
2026-09-23T00:00:00-04:00opnsenseAcmeClient: certificate must be issued/renewed: opnsense.mydomainname.net
2026-09-22T00:00:00-04:00opnsenseAcmeClient: issue/renewal not required for certificate: opnsense.mydomainname.net
#19
Hardware and Performance / Re: amd-xgbe ("ax"): interface...
Last post by BrandyWine - Today at 01:12:45 AMNeed to look deeper.
EPYC's do have various implementations of the PHY, but I see most (the newer stuff) use the axp driver. The pciconf shows a device ID that supposedly uses the newer AXP code, but technically still from the amd-xgbe module.
I suspect an iflib issue.
What AMD EPYC is it exactly?
https://cgit.freebsd.org/src/commit/?id=7113afc84c0
Quote from: bot0x1458 is indeed the AMD EPYC integrated 10-GbE controller used by FreeBSD's axp driver. The important detail is that FreeBSD's driver was added as an iflib-based driver, and the hardware exposes separate RX DMA queues and management counters. If traffic works but RX counters remain at zero, this is likely a driver/statistics-path problem rather than PCI identification.
EPYC's do have various implementations of the PHY, but I see most (the newer stuff) use the axp driver. The pciconf shows a device ID that supposedly uses the newer AXP code, but technically still from the amd-xgbe module.
I suspect an iflib issue.
What AMD EPYC is it exactly?
https://cgit.freebsd.org/src/commit/?id=7113afc84c0
#20
26.1, 26,4 Series / Re: Unstable internet connecti...
Last post by pseudonym3k - September 24, 2026, 10:38:40 PMQuote from: GCustom on September 24, 2026, 09:10:05 AMChanging Data Length from the default 1 to 56 has already made a dramatic difference for me, so thanks for that. But I think the larger problem is still relying on a single monitor IP as the authority for whether a gateway is usable.I'm glad it helped, having found that was a game changer for me as well.
That said, I have never found a monitor IP that was 100% reachable when my internet connection was fine, so I ended up turning it off as I had more false positives than it helped. Fine in my case since I'm just one house with one connection. What we both have mentioned - multiple monitor IPs and if all are unreachable then assume the connection is down - seems the only practical use of the function, yet it doesn't exist. Unless I'm missing something...
