Recent posts

#21

26.7, 26.10 Series / Re: [Solved] UPNP fatal error ...

Last post by axsdenied - November 12, 2026, 03:29:43 PM

I'm actually getting a different set of errors.  Not sure if the patch addressed this:

2026-11-12T07:21:12-07:00ErrorminiupnpdFailed to broadcast good-bye notifications
2026-11-12T07:21:12-07:00ErrorminiupnpdLast message 'sendto(udp_shutdown=' repeated 10 times, suppressed by syslog-ng on xxx.xxxx.lan
2026-11-12T07:21:12-07:00Errorminiupnpdsendto(udp_shutdown=0) to [FF0E::C]: Socket operation on non-socket
2026-11-12T07:21:12-07:00ErrorminiupnpdLast message 'sendto(udp_shutdown=' repeated 10 times, suppressed by syslog-ng on xxx.xxxx.lan
2026-11-12T07:21:12-07:00Errorminiupnpdsendto(udp_shutdown=0) to [FF05::C]: Socket operation on non-socket
2026-11-12T07:21:12-07:00ErrorminiupnpdLast message 'sendto(udp_shutdown=' repeated 10 times, suppressed by syslog-ng on xxx.xxxx.lan
2026-11-12T07:21:12-07:00Errorminiupnpdsendto(udp_shutdown=0) to [FF02::C]: Socket operation on non-socket
2026-11-12T07:21:12-07:00ErrorminiupnpdLast message 'sendto(udp_shutdown=' repeated 10 times, suppressed by syslog-ng on xxx.xxxx.lan
2026-11-12T07:21:12-07:00Errorminiupnpdsendto(udp_shutdown=0) to 239.255.255.250: Socket operation on non-socket
2026-11-12T07:21:12-07:00ErrorminiupnpdPerforming STUN failed. EXITING
2026-11-12T07:21:12-07:00ErrorminiupnpdSTUN: Performing STUN failed: Device not configured
2026-11-12T07:21:12-07:00ErrorminiupnpdLast message 'STUN server not supp' repeated 3 times, suppressed by syslog-ng on xxx.xxxx.lan
2026-11-12T07:21:12-07:00ErrorminiupnpdSTUN server not supported, not returning OTHER-ADDRESS / support CHANGE-REQUEST's required for endpoint-independent (1:1) CGNAT filtering tests per RFC 5780.
2026-11-12T07:21:12-07:00Errorminiupnpdcould not open lease file: /var/run/miniupnpd.leases-ipv6
2026-11-12T07:21:12-07:00Errorminiupnpdcould not open lease file: /var/run/miniupnpd.leases

#22

Dutch - Nederlands / Re: DEC740 te koop

Last post by vicking - November 12, 2026, 02:15:29 PM

Zoals de topic aangeeft heb ik een DEC740 te koop. Top machine maar in onbruik geraakt.

- Aangekocht op 13/11/2023.
- In perfecte staat.
- Minimum bod - 500€

Nog te koop?

#23

Development and Code Review / Re: netflector available as pl...

Last post by vicking - November 12, 2026, 02:05:29 PM

Another question. I am also using igmp proxy between my iptv wan and vlan. Do you think I could also configure this with Netflector?

#24

High availability / Re: CARP - Preventing individu...

Last post by Patrick M. Hausen - November 12, 2026, 12:03:21 PM

With one shared LAG, tying CARP state to a single real parent interface

But CARP does not do that. It does not know anything about interface states - or interfaces. Neither do the paritcipating nodes exchange any information.

A CARP node

- multicasts its own CARP address(es) and priority to each broadcast domain (network, VLAN) where CARP is active
- listens to similar multicasts in the same broadcast domain
- if it doesn't receive one it activates its own CARP address and assumes the master role
- if it does and if the hash of CARP addresses matches its own, and if the priority of the received message is higher than its own, it does not activate its own address and assumes the standby role

That's it. Essentially stateless. Each node works completely independent of all others.

#25

German - Deutsch / Re: OPNSense 26.7 - AdGuard Ho...

Last post by Patrick M. Hausen - November 12, 2026, 11:59:02 AM

M.E. ist die OPNsense der ideale Ort für AGH. Wenn du gleichzeitig Dinge tun willst wie DOT/DOH blocken, alle Clients über den einen offiziellen Resolver zwingen, etc. dann macht das viel weniger Streß als mit Port-Forward zu einem weiteren System.

#26

German - Deutsch / Re: OPNSense 26.7 - AdGuard Ho...

Last post by Patrick M. Hausen - November 12, 2026, 11:55:41 AM

M.E. ist die OPNsense der ideale Ort für AGH.

#27

German - Deutsch / Re: OPNSense 26.7 - AdGuard Ho...

Last post by heiligst - November 12, 2026, 11:54:13 AM

Ah, ok - danke - lese ich mir durch.



Die Frage ist halt, ob es nicht generell "besser"/problemloser bei künftigen gr. Updates ist, wenn man beide Programme separat betreiben würde!?


Derzeit läuft OPNSense hier:
Lenovo M720q Tiny, i3-8100T, 8GB Ram, 500GB NVMe, Intel i350-T4 V2

Extra Hardware tauschen oder zusätzlich kaufen möchte ich nicht unbedingt.

Würde mir einen passenden Adapter besorgen und im obigen Tiny einfach eine zweite NVME betreiben und beide Programme (OPNSense+AdGuard Home) dann getrennt in Proxmox betreiben - so bliebe man dann unabhängiger, oder?

#28

High availability / Re: CARP - Preventing individu...

Last post by swiftshearwater99 - November 12, 2026, 11:53:40 AM

Hey everyone,

I'm currently trying to set up my first CARP HA scenario.
I've installed and licensed the latest OPNsense Business Edition on both nodes.

Both OPNsense instances have two 10G ports configured as a LAG, with all networks configured as VLANs on that interface.
Additionally, each instance has two 1G ports. One is dedicated to pfsync, while the other is used for management access.
All VIPs on the master node have their skew set to 0, while those on the backup node are set to 100. The base is set to 1.
Preemption is enabled on both nodes (the checkbox to disable it is unchecked). I haven't configured anything regarding the demotion level so far.

As far as I understand it, the demotion level can trigger a complete failover if one of the interfaces goes down (assuming it's configured correctly).
However, since all CARP interfaces are VLANs, I assume the demotion mechanism would never be triggered because the VLAN interfaces can't go down individually.
This would mean that CARP failovers could still occur independently for each interface if a particular VLAN experiences connectivity issues or the switch gets misconfigured.

What I'm looking for is a way to prevent the backup node from taking over any CARP VIPs unless the primary node goes offline entirely.
I've found some solutions involving custom scripts that need to be installed via SSH directly in the filesystem. However, I'm a bit concerned that these scripts might break after updates or interfere with the update process itself.

That's why I'd prefer a solution that can be configured entirely through the GUI.
I also came across Monit, but I haven't looked into it in detail yet.

It might sound a bit strange that I'm looking for a solution to this particular scenario, considering that all networks are connected through a single 10G LAG and should theoretically fail together.
However, there are two main reasons for this.

1. Switch firmware bugs
Occasionally, the switches encounter a firmware bug that causes them to stop forwarding traffic for a single VLAN on one switch unit or overload just one particular VLAN. Sometimes even other Devices overload a VLAN which causes an interruption that the switch then can keep isolated in that VLAN.

2. Switch configuration errors
Sometimes, someone makes changes to the switch configuration and somehow manages to remove a VLAN from one of the OPNsense ports.

In both cases, I'd rather have an outage affecting a single network than have the backup node silently take over all CARP IPs, potentially hiding the underlying issue, or taking over only that particular VLAN, sending me in the wrong direction during troubleshooting.

Essentially, I want to avoid individual CARP VIP failovers and ensure that the backup node only takes over when the primary node fails completely.
Does anyone have an idea how to achieve this, preferably using only the OPNsense GUI?

With one shared LAG, tying CARP state to a single real parent interface sounds a lot less surprising than letting each VLAN decide for itself. A partial takeover can look healthy from the firewall side while the switch config is still broken, which is the annoying bit.

#29

German - Deutsch / Re: OPNSense 26.7 - AdGuard Ho...

Last post by Patrick M. Hausen - November 12, 2026, 11:44:01 AM

Das Plugin gibt es wie immer über das Community-Repo von Michael:

https://www.routerperformance.net/opnsense-repo/

Wenn du nur AGH brauchst, folge der zweiten Anleitung ("just AdGuard"), dann gibt es erfahrungsgemäß keine Konflikte bei späteren Updates.

#30

German - Deutsch / OPNSense 26.7 - AdGuard Home?

Last post by heiligst - November 12, 2026, 11:25:30 AM

Hallo!

Bin derzeit noch auf einer alten Version, welche zum Teil Probleme macht.
Ich wollte deshalb in nächster Zeit frisch installieren und habe nun gelesen, dass es in der aktuellen Version kein AdGuard-Home Plugin mehr gibt.

Stimmt das?
Falls ja, kommt das wieder?


Oder sollte man ev. gleich auf Proxmox umsteigen und beides (OPNSense+AdGuard Home) getrennt/virtuell betreiben?


Danke!

LG