Quote from: gameshacker on December 15, 2025, 02:57:42 PMAuch die LL und die Global Adresse bekomme ich jeweils bei den Clients.Schau mal in den Firewall-Logs, ob die Pakete nicht evtl. geblockt werden. Die Kombination von 1 und 4 bedeutet ja, dass nur die OPNsense nicht raus darf, alle anderen im Zwischennetz aber schon. Entweder blockiert sich die OPNsense also selber, oder sie hat eine andere IPv6 / Subnetz / VLAN als alles andere im Zwischennetz. Oder sie wird von der FB blockiert.
net.isr.maxthreads = -1
net.isr.bindthreads = 1Add another tunable. This time, we're allowing NIC drivers to use ISR queues.net.isr.dispatch = deferredNext up is to add tunables enabling RSS. (Note that net.inet.rss.bits should be set to the square root of how many cores you have.)net.inet.rss.enabled = 1
net.inet.rss.bits = 2net.inet.rss.bits = xfor 4-core systems, use '2'
for 8-core systems, use '3'
for 16-core systems, use '4'
Etc.Quote from: OPNenthu on December 15, 2025, 10:03:58 AMAre we sure that the Unbound blocklists feature really supports targeting individual hosts? The only place where it's hinted at is in the helptext for the Source Net(s) field, which gives 192.168.1.1 as an example input. However, the field itself and the rest of the helptext talks only about networks.
Same for the docs: https://docs.opnsense.org/manual/unbound.html#blocklistsQuoteMultiple policies can be defined, each separated by one or more source nets. This means you can use blocklists or specific (wildcard) domains on specific networks, allowing more fine-grained control over your setup. The algorithm selects the most specific subnet when domains overlap across subnet sizes.
Might be good to raise a GitHub issue, at least for clarification.
EDIT: the helptext also says something about equally sized networks:QuoteAll specified networks should use the same protocol family and have equal sizes to avoid priority issues.
... not sure if that's per-blocklist entry or across all of them.
Quote from: Patrick M. Hausen on December 15, 2025, 09:42:35 AMOr use AdGuard Home which has a much nicer UI for tasks like this one.