2 Problems: IPsec and IPv6

[lazydaze]

Absoltuley love OPNsense!

But, after the recent update to 15.7.9 I get an IPsec error (openvpn/ipsec):
Warning: Illegal string offset 'enable' in /usr/local/www/vpn_ipsec.php on line 258
Warning: Illegal string offset 'phase1' in /usr/local/www/vpn_ipsec.php on line 287 Warning: Invalid argument supplied for foreach() in /usr/local/www/vpn_ipsec.php on line

Which in turn gives me a:
OPNsense has detected a crash report or programming bug

Now with IPv6, everything works great until I reboot. It will then disable IPv6 on all devices until I turn DHCPv6 on and off in the WAN settings.

I don't know if this is just something I'm doing wrong or a bug? Any help would be nice. Thanks!

[AdSchellevis]

I checked the code,  the warning was indeed a bug. It will be fixed in the next release. (commit https://github.com/opnsense/core/commit/db5faebf0fbe43cd927c66a43f98f67557777312 contains the fix)

Although I don't think this warning is causing your issue, this code is only executed on this form (and not during boot).
Maybe your system log gives you some additional information after boot, it is weird that it functions correctly until reboot.
 

[lazydaze]

The error I get after a restart is:
opnsense: /usr/local/etc/rc.newwanipv6: rc.newwanipv6: Failed to update WAN[wan] IPv6, restarting...

After I restart I have to go to my WAN interface and turn off DHCP6 then turn it back on for IPv6 to work.

It then works perfectly fine. I get 10/10 on Comcast IPv6 test site.

I used the site, which you linked on twitter, to do my IPv6 setup:
https://www.kirkg.us/posts/setting-up-ipv6-with-opnsense-and-comcast/

[AdSchellevis]

It looks like a race condition or execute order issue somewhere, could you try to run this :

Code: [Select]

configctl interface reconfigure wan
in a console after restart? and look if it solves something.

[lazydaze]

Rebooted and IPv6 was down. I rand that command...

Output read: OK

Tested and got 10/10.

Rebooted again and IPv6 went down.

On another note, I started to use PowerD on Adaptive and after about 2 hours it will put serious load on the CPU. 1.01, 1.14, 1.03... and the graph will read at 51%. I turn off PowerD and it goes back to a normal range.
Kinda weird, just thought I'd bring it up.

[franco]

Load averages are an interesting concept: an average of 1 means that at each point in time there is one process scheduled to run, which means the system is perfectly balanced. A load average higher than 1 means there is more work to be done than the system can handle, a load average lower than 1 means the system could do more.

When powerd is switched on it will slow down the CPU save power. That also means that your 0.1 load average will be balanced to 1, saving 0.9 of processing time worth of power. The load average will increase to about 1 every time unless the peak capacity was exceeded... it means powerd is doing a great job.

Thanks for narrowing the IPv6 issue down. We'll see if we can fix this in time for 15.7.10 today.

[franco]

We've identified the issue but find ourselves in a weird situation: the code that is missing was disabled in August 2011, long before we started this project. It points to an inherent issue with the way the backend is set up, not being able to selectively trigger the IPv6 reload (it would trigger both IPv4 *and* IPv6 and mess with operation).

We can't fix this for 15.7.10, seeing that nobody came up with a solution for this up until now, but at least now we know exactly why it fails and how it can be fixed mid-term. Thanks for your understanding.

[lazydaze]

Cool, I'll be looking forward to 15.7.10 and future releases!

Thanks for all the help and explaining PowerD.