WAN/PPPOE connection failure after recent update

[Uncorrupt0152]

After the latest update, the
PPPOE connection is failing to
establish on the WAN interface.
Logs indicate process 50512
terminated and show routing
refusal for an addressless WAN
interface. Although the logs later
show successful negotiation, the
interface overvievw page shows
the WAN interface as unassigned.
Please advise."

[meyergru]

Sorry to have to be so rude, but:

This post is almost a piece of modern art in its unspecificity.

"Latest update" without version numbers; "process 50512 terminated" without naming the process or quoting the message — and a PID that became meaningless seconds later; "routing refusal" as a paraphrase instead of the actual log entry; "successful negotiation" without saying which phase; and WAN being "unassigned" without showing the interface assignment or configuration.

Not a single actual log line is included, although the logs supposedly contain the relevant clues. There is no information about the previous and current OPNsense versions, hardware or virtualisation, interface and driver, ISP, PPPoE configuration, or what exactly "unassigned" is supposed to mean.

The description even contradicts itself: the connection fails, negotiation succeeds, and WAN is unassigned.

What exactly do you expect anyone to advise on? Please provide the raw information instead of an unspecific summary of it. As it stands, this is not a diagnosable problem report; it is merely a description of the fact that you have a problem.

[Uncorrupt0152]

Hi meyergru,

Thank you for the direct feedback. You are right; my initial post was far too vague. I apologise for that. I've been troubleshooting this all day and was getting frustrated. Let me provide a proper, detailed breakdown of the situation, the hardware, the steps I've taken, and where I am now stuck.

System Information:

    OPNsense Version: The latest stable version as of August 24, 2026. This problem started immediately after I ran the update from the GUI.

    Hardware: This is a physical appliance, not a VM. It's a custom-built N100 box with 4x Intel i226-V 2.5GbE ports.

    ISP: Plusnet (UK) on a Fibre connection.

    Network Layout: The core design is OPNsense -> Managed Switch -> Devices. VLANs are used for TRUSTED and UNTRUSTED networks. This setup was working perfectly before the update.

Current Problem: OPNsense DNS Resolution is Broken

This is where I am currently stuck.

    I can successfully ping 8.8.8.8 from Interfaces > Diagnostics > Ping. This proves the firewall has a valid route to the internet.

    However, if I try to ping a hostname like google.com, it fails with the error: cannot resolve google.com: Host name lookup failure.

4. Attempted Forcing Upstream DNS.

    To fix the DNS issue, I went to System > Settings > General.

    I manually entered 8.8.8.8 and 1.1.1.1 as DNS servers.

    I unchecked the box Allow DNS server list to be overridden by DHCP/PPP on WAN.

    Result: No change. OPNsense itself still cannot resolve any external hostnames, even though it can ping external IPs.

5. Attempted Fix Reconfiguring DHCP.

    I noticed that the update introduced Kea DHCP, and the old ISC DHCP is now marked as legacy. I assume this is part of the problem.

    I tried to configure Kea DHCP (Services > Kea DHCP > Subnets) for my TRUSTED VLAN (192.168.86.0/24). I created the subnet and added an IP pool (192.168.86.100 - 200).

    Here is a critical issue: In the "Edit Subnet" screen for Kea, there are no input fields for "DNS servers" or "Routers" as some guides suggest there should be. The fields are simply missing from the GUI.

Summary of Current State:

    WAN is UP and has a public IP.

    OPNsense CAN ping external IP addresses (e.g., 8.8.8.8).

    OPNsense CANNOT resolve any DNS hostnames (e.g., google.com).

    Because the firewall's resolver is broken, none of my internal clients can access the internet.

    The new Kea DHCP service seems to be missing key configuration options in its interface.

My Specific Question:
Why would OPNsense be unable to perform DNS lookups, even when public DNS servers are explicitly defined in the general settings and the WAN connection is confirmed to be working? Could this be a bug in the latest version related to Unbound DNS, or is there another setting I'm missing that would cause this behavior?

Thank you for your time and expertise. The failing ping diagnostics, my general DNS settings, and the Kea DHCP subnet page that is missing the router/DNS option fields.

[meyergru]

If your observations are correct, that makes two problems:

1. OpnSense cannot resolve DNS names.
2. Your former ISC DHCP does not work any more.

Obviously, the former version was not 26.7-based, but probably much earlier. There were several serious changes from, say, 25.x to 26.7., including which DHCP is preferred.

Thus, you essentially have two options:

a. Install the os-isc-dhcp plugin to restore your ISC DHCP setup - while it is EOL, this will give you local subnets again, solving point 2.
For point 1, I would first try to chec if "nslookup www.google.com 8.8.8.8" from the CLI of your OpnSense works, verifying WAN access. Then you can try to use Google DNS for OpnSense and Unbound.

b. Follow along the DNSmasq instructions from the docs, preferably on a fresh install to rule out other/older DNS or DHCP services blocking DNSmasq. If you switch DHCP, your reservations or internal DNS names will not be carried over automatically with either DNSmasq or Kea, anyway. There are external scripts to do that, but with a normal installation, it is probably better to do it manually.

I would prefer to start from scratch in your situation, because even the firewall and NAT rules have been changed. The jump from your old version to the current one is too far to justify the migration effort. I think it is easier to start fresh, maybe you can jot down or print out the relevant old rules and DHCP reservations first.

[dseven]

You're conflating issues quite a bit (PPPoE, DNS on the firewall itself, DHCP, ...)

Kea DHCP won't affect how the firewall itself accesses DNS services, but FYI anyway; if you want to set explicit DNS servers or router for a subnet in Kea, you'd need to uncheck "Auto collect option data".

If you want to try specifying the DNS servers that the firewall itself uses, you might want to check "Do not use the local DNS service as a nameserver for this system" as well (at System -> Settings -> General). If that allows the firewall itself to resolve DNS names, you have some issue with Unbound. If it doesn't, perhaps your ISP blocks access to DNS other than their own servers? What was your DNS configuration before the problem started?