Recent posts

#91

26.7, 26.10 Series / Re: OPNsense downgrades itself...

Last post by bitdigger - November 10, 2026, 06:11:07 PM

I resolved the issue by replacing the firewall hardware. I don't have any idea as to why this happened, but it works now and lacking more time to investigate I consider this to be resolved.
Thanks anyways for the attention.

#92

26.7, 26.10 Series / issue with legacy firewall rul...

Last post by Andreas1 - November 10, 2026, 05:55:04 PM

I do have some OPNsense installations and somehow missed it during the upgrades to migrate the firewall rules from legacy to "new".
Now I have the current version 26.7.8_2 and no migration assistent anymore. I even tried the legacy firewall plugin (os-firewall-legacy).
Any idea how to handle that?

Thanks in advance.

#93

26.7, 26.10 Series / Re: [SOLVED] WAN PPPoE IPv6 de...

Last post by franco - November 10, 2026, 05:41:51 PM

Yup it used to be a bit more effective with janky PPPoE behaviour some years ago, but it has gotten better so it's not strictly needed anymore (and not set by default either).


Cheers,
Franco

#94

26.7, 26.10 Series / Re: Gradual Internet Performan...

Last post by pfry - November 10, 2026, 04:26:10 PM

[...]so that's something we will all just have to learn to live with :)[...]

rc.conf:
ip6addrctl_enable = "YES"
ip6addrctl_policy = "ipv4_prefer"

OPNsense: "System: Settings: General" -> "Networking" -> "Prefer IPv4 over IPv6"

I also only use IPv4 only, with no IPv6 address assignments or discovery, and "net.inet6.ip6.auto_linklocal = 0", so I can't comment on effect.

#95

26.7, 26.10 Series / OPNsense downgrades itself in ...

Last post by bitdigger - November 10, 2026, 03:47:15 PM

Dear all,
I am in the process of upgradeing a little firewall with 2nics. This is a barebone installation. Since I want the latest version, I downloaded it and made a USB stick, booted from there etc. The downloadable image, at least to my knwonleadge available is 26.7, the latest version to which a system can be upgraeded is 26.7.8_2. I manage to do this, cann reboot etc. Dashboard update check tells me I am on the latest version.
Then, while configuring some aliases and NAT entries etc. all of a sudden the Dashboard tells me I am on
OPNsense 25.7.11_9-amd64
FreeBSD 14.3-RELEASE-p7
OpenSSL 3.0.18
and this obviousely can't be upgraded (and hence it never should be there anyways).
What is going on here? I must overlook something obvious or see ghosts or somthing?
Btw. I repeated this already 2 times...

#96

26.7, 26.10 Series / Re: Gradual Internet Performan...

Last post by nero355 - November 10, 2026, 03:47:03 PM

Which makes this bug even more critical to fix, don't you think?

I am not sure what's going on since I have no IPv6 on my WAN side to test with, but my point was that IPv6 having higher priority over IPv4 is nothing new and almost always has been like that so that's something we will all just have to learn to live with :)

OPNSense 26.7 was announced on 7/15/2026.
Here I am, after 4 months of grief, finally with a workaround but definitely not a proper solution.

I am not sure if things are really like that since you mention a bug/change that has been introduced and very quickly reverted only very recently ?!

There has been some work done to the Interfaces Assignment webGUI also, so maybe something went wrong there too in your case...

My Apple devices are now "pausing" for a short period of time, I assume trying to reach an IPV6 address and finally realizing they can't so they fall back to IPV4 and complete the connection.
SiriusXM takes about 10-15 seconds when I change channels (which is instantaneous when I use the external VPN which CAN reach IPV6) and even attempting to log into this forum paused for about 30 seconds before the login popup appeared.

Are you sure it's not some weird DNS issue ?!

Usually a VPN forces all the DNS traffic through itself and to the VPN Provider's DNS Servers so that could be another reason for such a huge difference between the two.

Sigh... I should have stayed on 26.1.x but the EOL warnings prompted me to upgrade.

It all depends on the setup you have :

As long as you don't have any Port Forwards to the OPNsense OS itself there is very little to worry about IMHO :)

#97

High availability / HA with prefix delegation: Wro...

Last post by ajr - November 10, 2026, 02:55:18 PM

In this HA setup, there are some VLANS, which are associated to WLANS by
unifi accesspoints. Each of them has a different subnet (by prefix id).
Prefix delegation works correctly and assigns addresses from the right prefix
to the mobile clients (using Track interface).
The setup is the same as described here https://forum.opnsense.org/index.php?topic=50602.msg259211#msg259211
The IP6 gateway announced in the past was that from system->gateways
(WAN_DHCP6), which is the LLA of the DSL-Router (fe80::cece:1eff:feb3:757f) and worked perfectly on failover.
This changed recently to LLAs like fe80::20d:b9ff:fe48:5c1e, which are unusable.

How can I force radvd to announce WAN_DHCP6 ?

Version:  26.7.8_2

#98

26.7, 26.10 Series / Re: No link with Intel E810 on...

Last post by tuto2 - November 10, 2026, 02:36:32 PM

I don't have any further insight or experience to contribute at this stage, but what module coding and link partners have been tested? We don't have a non-production DEC appliance, but we do have DACs, AOCs, and SR/LR SFP28 modules on hand that we can recode at will, so if there's a specific combination that hasn't been tested (or needs validation) I might be able to provide another test case.

This seems to be the culprit: https://github.com/opnsense/src/commit/27ffeba0e6b5b8d8ebb8eec9d2566f56421ee946

There's a test kernel available if you want to give it a go:

# opnsense-update -zkr 26.7.8-next

Reboot afterwards, link should come up immediately on boot without the tunable.

#99

Portuguese - Português / Re: Crash - Atualizando do 26....

Last post by Micheale45 - November 10, 2026, 02:30:20 PM

Pelos relatos, eu começaria por verificar o espelho de atualização antes de remover o AdGuard. O caso do servidor virtualizado indica que a troca do Cloudflare (São Paulo) pelo espelho oficial de Amesterdão resolveu um erro de validação SHA-256. Isso não prova que seja a mesma causa no teu caso, mas é um teste simples e bastante pertinente. Se voltar a falhar, seria útil partilhar o erro completo e os logs de atualização para perceber se é um problema de integridade do pacote, do repositório ou de algum plugin. E, antes de novas tentativas, convém guardar um backup da configuração.

#100

26.7, 26.10 Series / Re: Messages in firewall log w...

Last post by mooh - November 10, 2026, 02:18:06 PM

I'm the maintainer of the ndp proxy btw, if you find something actionable I can help, but just a logging issue isn't actionable from my side right now.

I didn't mean to push you or anyone. I'm looking for pointers because I'm at a loss how to proceed investigating other than reading the code.

For example, there are a number of automatic rules that would fit the logged messages, but they are "ipv6-icmp from (self) to fe80::/10 icmp6-type neighbrsol", etc. Is there a chance that packets forwarded by the proxy match "(self)" even though the actual source address is not one of the firewall's?