22.7.9 creates spuky network issues that require full service restart

[bachmarc]

Hello,
I have a virtualized opnsense with a few subnets that was running clean so far.... now I have successfully installed
OPNsense 22.7.9-amd64
FreeBSD 13.1-RELEASE-p5
upgrade... well almost successfully.

My interface vtnet1 is bound to a subnet 192.168.111.0/24 => my lan cable stuff in the house.
But after a while the clients lose the connection to the net and switch to WLAN *.*.112.0/24.

All this happens quite quietly... the DHCP clients lose their lease, if I assign a static IP I still can't ping the server in the basement. I can't reach the server from the 112 subnet either.

But the gateway on *.*.111.1 is reachable and also the interface vtnet1 is active according to ifconfig.
The WebUI looks completely normal...all services are running.

Ok, the dhcpd log never gets to the DHCPACK but I see requests coming in...and offers going out.
Ping to the server does not work

In the end i can't get anything in the WebUI.... tried:
- restart services
- de/activate interface
-Filtering rules of the firewall are on swipe for everything

Restarting OPNSense or restarting services with option 11 in SSH bring my *.*.111.0 network back up. Until it silently dies again after a while....

I come from Linux and apparently BSD is quite different... I can't find a hint in a log what dies and why.

I asked here in the german forum where to find more technical hints in BSD, unfortunately I didn't get any hints.

Now it ran for one day and then the WLAN went away.

The kernel of the host on which the OPNsense guest is running suddenly throws:
brsolnetwlan: received packet on enp8s0f1 with own address as source address (addr:d2:57:d1:5c:59:4f, vlan:1)

Shortly after that the LAN was gone...
I went to the server in the basement and restarted the Opnsense services with option 11: Tada! Works again, without reboot, without changes to the hypervisor host, without touching the cabling. The host kernel reports no more errors.
Unfortunately probably only until tomorrow...

I was tired of it now and reset the VM to the state before the upgrade 22.7.9. There it ran super stable.
Is now of course extremely annoying if you can now no longer make an upgrade without having to hear the grass grow afterwards, because the system subtly fails somewhere.
I would have liked to make a bug report but: "something wrong" uses small and I do not know BSD well enough.

Nevertheless I wanted to let you know that something does crazy things inside 22.7.9

Regards Marc

[slackadelic]

If you're using suricata, disabled it, then apply the latest patch which should put you at 22.7.9_3 then start suricata again.

[bachmarc]

If only I would use it... I am sorry: I do not 

STOP: It seems suricata is installed... was simply not aware of that my IPS is suricata...
I read several other posts about it, but none sounds like what I experience, isnt it?

[slackadelic]

I would just make sure to apply the latest patch so you're at _3 patch level which has some fixes in it

Re-test and see if that works.

[bachmarc]

In older days (Kids smaller, no grand parents in the house) it was my server... now it is THE server and I am just Mr Responsible aka Admin=> suddenly I have to announce changes and maintenance windows

=> I will have to wait for a while to avoid a riot in the house. Maybe situation gets clearer around 22.7.9