Lost internet and couldn't access OPNsense GUI

[Mr. Me]

On Sunday November 24th at 9:49am all of a sudden, all my devices lost internet connectivity.

Background:  This started as a fresh install of OPNsense v24.7 back in September.  The internet comes from a modem to the WAN port of the OPNsense router.  Then the LAN port of the OPNsense router goes to a managed switch.  Devices are connected to the managed switch including a couple of wifi routers set as access points.  The OPNsense router handles the DHCP and unbound DNS.

I have a desktop connected directly to the switch, however it wasn’t getting assigned an IP address because of no DHCP.  I set the desktop to a static address on subnet.  I can access the wireless routers and managed switch’s GUI directly by entering their IP addresses.  However, I couldn’t access the IP of the OPNsense router through the LAN port.  I can ping the OPNsense router’s IP address through the LAN port, but no GUI would attempt to load. My LAN NIC happens to be aq0.

The only way for me to access the OPNsense router was using my cell phone and connect by VPN to the OPNsense router.  Then I can access the GUI’s IP address.

Once inside, I noticed the router had a configuration change on November 21st at 3:30am.  Which was the firmware update to 24.7.9_1-amd64.  It looks like the firmware 24.7.9 was also installed on November 20th previous to that.  I do have a Cron job set for Automatic firmware update.  However, the uptime showed 16 days.  This tells me the Cron job automatically updates the firmware, but never reboots the router.  Is it supposed to auto reboot the router after auto installing firmware?

I then remotely rebooted the router at 11:09am using the cell phone.  After reboot, all of my devices automatically got internet service back again.  I was able to access the OPNsense router’s GUI IP with the desktop through the LAN as if nothing had happened.  I’m assuming devices lost internet from loss of DHCP.  Not sure what was stopping me from connecting to the GUI IP address through the LAN port.

LOGS:
I noticed these logs around the time of internet loss / router access loss.

Audit:> 2024-11-24T09:49:28-05:00 Informational configd.py action allowed interface.linkup.stop for user root
2024-11-24T09:50:09-05:00 Informational configd.py action allowed interface.linkup.start for user root

Backend> 2024-11-24T09:49:28-05:00 Notice configd.py [7568c38f-b88e-4058-bf02-68f8d8e4008e] Linkup stopping aq0
2024-11-24T09:50:09-05:00 Notice configd.py [3e07894d-c4f8-42bc-81bf-dc5db50faa94] Linkup starting aq0

General> 2024-11-24T09:49:28-05:00 Notice opnsense /usr/local/etc/rc.linkup: DEVD: Ethernet detached event for lan(aq0)
2024-11-24T09:49:28-05:00 Notice kernel aq0: atlantic: link DOWN
2024-11-24T09:49:28-05:00 Notice kernel <6>aq0: link state changed to DOWN
2024-11-24T09:50:09-05:00 Notice opnsense /usr/local/etc/rc.linkup: DEVD: Ethernet attached event for lan(aq0)
2024-11-24T09:50:09-05:00 Notice kernel aq0: atlantic: link UP: speed=2500
2024-11-24T09:50:09-05:00 Notice kernel <6>aq0: link state changed to UP
2024-11-24T09:50:09-05:00 Notice opnsense /usr/local/etc/rc.linkup: ROUTING: entering configure using lan

================================

Did this happen because of firmware updates, but the router doesn’t reboot?

I was able to ping the IP of the router, but not get to the router’s GUI webpage.

There was no internet for all clients. 

=================================

This has happened before, but only after I installed Zenarmor.  It was the same fresh install in September.  I would let it run for a week before adding another feature or plugin, then wait a week then add another feature or plugin.   For example, 1 week setup unbound DNS with a block list.  Following week add VPN server, following week add Suricata IDS/IPS.  The final thing was adding Zenarmor plugin and set it up and soon after same thing happened.  Lost internet, couldn’t access router’s GUI, desktop wasn’t leased an IP address by DHCP.  Changed desktop to a static IP and now could access other devices on subnet, but not the OPNsense router’s GUI.

I tried pinging a website on the internet.  I can’t remember exactly, but I discovered IPV6 url was being resolved, but IPV4 url was not being resolved.

I was panicking because I wanted to revert settings back but couldn’t access GUI, then I tried accessing GUI by using cell phone to connect to VPN then router's GUI IP.  Got in.  Deleted Zenarmor plugin, rebooted and it was back to normal and I had normal LAN access to router and normal internet.  Thank goodness I had VPN setup.  I haven’t reinstalled Zenarmor since then, I have been too scared.  Don’t whine and complain about my lan NIC.  I can run it fine for a month and have no problems.

Any thoughts?