Opnsense 26.1 installed on FreeBSD 14 on EC2 / AWS hangs on reboot after initia

Started by mr401b@gmail.com, Today at 01:35:42 AM

Previous topic - Next topic
Print
Go Down Pages1
User actions
Today at 01:35:42 AM
Thank you in advance for advice, in case people in this forum succeeded in installing "from scratch" Opnsense on AWS EC2 (i.e. not by using the commercial Opnsense AMI).

Followed an older post (only one I found on the topic : https://edepree.com/2020/08/02/installing-opnsense-on-lightsail.html) but this is for Opnsense 20.1 and FreeBSD 12 which is no longer available on AWS.

Details below

su
pkg install wget
wget https://raw.githubusercontent.com/opnsense/update/master/src/bootstrap/opnsense-bootstrap.sh.in
!!! comment out the reboot at the end
chmod +x opnsense-bootstrap.sh.in
sh ./opnsense-bootstrap.sh.in -r 26.1


Installing Opnsense 26.1 on FreeBSD 14 AMI (AWS) on EC2 (t3.micro or t3.small) works fine
...
Message from opnsense-26.1.11_6:

--
One step ahead, one step behind it, now you gotta run to get even
Fetching base-26.1.11-amd64.txz: ............ done
Fetching kernel-26.1.11-amd64.txz: ...... done
...
3. Prevent the standard FreeBSD syslogd from starting automatically by
   adding a line to the end of your /etc/rc.conf file that reads:
        syslogd_enable="NO"
4. Shut down the standard FreeBSD syslogd:
     kill `cat /var/run/syslog.pid`
5. Start syslog-ng:
     /usr/local/etc/rc.d/syslog-ng start
=====
Message from opnsense-26.1.11_6:
--
!!!!!!!!!!!! ATTENTION !!!!!!!!!!!!!!!
! A critical upgrade is in progress. !
! Please do not turn off the system. !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Installing kernel-26.1.11-amd64.txz... done
Installing base-26.1.11-amd64.txz... done
Cleaning obsolete files... done
Please reboot.
root@freebsd:/home/ec2-user #

At this point the VM has 2 ENI (WAN=10.10.1.5, LAN=10.10.2.5) and I edited /usr/local/etc/config.xml (as per the post above) the LAN entry under   <interfaces> before rebooting
Original
    <wan>
      <enable>1</enable>
      <if>mismatch1</if>
      <mtu/>
      <ipaddr>dhcp</ipaddr>
      <ipaddrv6>dhcp6</ipaddrv6>
      <subnet/>
      <gateway/>
      <blockpriv>1</blockpriv>
      <blockbogons>1</blockbogons>
      <dhcphostname/>
      <media/>
      <mediaopt/>
      <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
    </wan>
    <lan>
      <enable>1</enable>
      <if>mismatch0</if>
      <ipaddr>192.168.1.1</ipaddr>
      <subnet>24</subnet>
      <ipaddrv6>idassoc6</ipaddrv6>
      <subnetv6>64</subnetv6>
      <media/>
      <mediaopt/>
      <track6-interface>wan</track6-interface>
      <track6-prefix-id>0</track6-prefix-id>
    </lan>

Modified

    <wan>
      <enable>1</enable>
      <if>mismatch1</if>
      <mtu/>
      <ipaddr>dhcp</ipaddr>
      <subnet/>
      <gateway/>
      <blockpriv>1</blockpriv>
      <blockbogons>1</blockbogons>
      <dhcphostname/>
      <media/>
      <mediaopt/>
    </wan>
    <lan>
      <enable>1</enable>
      <if>mismatch0</if>
      <ipaddr>dhcp</ipaddr>
      <subnet/>
      <media/>
      <mediaopt/>
    </lan>

Also to make sure the serial console remains available:
root@freebsd:/home/ec2-user # cat /boot/loader.conf.local
kern.vty=sc
kern.tty.comconsole="sc"

At this point I reboot and will get in the initial configuration, then hangs here in the console without getting in the menu

OPNsense.localdomain kernel - - [meta sequenceId="8"] <118>Service `sysctl' has been restarted.
OPNsense.localdomain kernel - - [meta sequenceId="9"] <118>>>> Invoking start script 'beep'
OPNsense.localdomain kernel - - [meta sequenceId="10"] <118>Root file system: /dev/gpt/rootfs
OPNsense.localdomain kernel - - [meta sequenceId="11"] <118>Thu Jul  9 18:13:32 UTC 2026
OPNsense.localdomain kernel - - [meta sequenceId="12"] <118>
OPNsense.localdomain kernel - - [meta sequenceId="13"] <118>*** OPNsense.localdomain: OPNsense 24.1.10_8 ***
OPNsense.localdomain kernel - - [meta sequenceId="14"] <118>
OPNsense.localdomain kernel - - [meta sequenceId="15"] <118> LAN (ena1)      -> v4/DHCP4: 10.10.2.5/24
OPNsense.localdomain kernel - - [meta sequenceId="16"] <118> WAN (ena0)      -> v4/DHCP4: 10.10.1.5/24
OPNsense.localdomain kernel - - [meta sequenceId="17"] <118>


 HTTPS: SHA256 42 17 B5 44 80 FE 11 27 C7 53 97 DD 1E 94 BA 24
               F6 53 14 77 66 C0 60 6A D6 E0 91 49 8B 0F AC 25

Also at this point ssh and  https connections to the WAN and LAN public IP fail with timeout and the only way I have to see what happened is to detach the root disk, attach it as data to another VM and look at the logs.  But looking at the system (/var/log/system_20260709.log) and filter (/var/log/filter_20260709.log) logs the system is not dead after printing the fingerprint at the console, the firewall seems to just block SSH and HTTPS to the WAN interface

system_20260709.log
...
OPNsense.localdomain kernel - - [meta sequenceId="18"] <118> HTTPS: SHA256 97 CC 6F 8F 2C 74 F7 F7 A0 E3 06 56 DE 6B 89 D3
OPNsense.localdomain kernel - - [meta sequenceId="19"] <118>               C2 C3 CC 3A 18 46 B4 0D 8C 27 DF E0 C9 2A B0 F5
OPNsense.localdomain opnsense 88982 - [meta sequenceId="20"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : opendns_configure_do())
OPNsense.localdomain opnsense 88982 - [meta sequenceId="21"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : openssh_configure_do(,lan))
OPNsense.localdomain opnsense 88982 - [meta sequenceId="22"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : unbound_configure_do(,lan))
OPNsense.localdomain opnsense 88982 - [meta sequenceId="23"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : vxlan_configure_do())
OPNsense.localdomain opnsense 88982 - [meta sequenceId="24"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : webgui_configure_do(,lan))
OPNsense.localdomain opnsense 88982 - [meta sequenceId="25"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : wireguard_sync(,lan))
OPNsense.localdomain opnsense 92965 - [meta sequenceId="26"] /usr/local/etc/rc.newwanip: The command '/usr/local/sbin/ntpd -g -c '/var/etc/ntpd.conf'' returned exit code '1', th
OPNsense.localdomain opnsense 92965 - [meta sequenceId="27"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : opendns_configure_do())
OPNsense.localdomain opnsense 92965 - [meta sequenceId="28"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : openssh_configure_do(,wan))
OPNsense.localdomain opnsense 92965 - [meta sequenceId="29"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : unbound_configure_do(,wan))
OPNsense.localdomain opnsense 92965 - [meta sequenceId="30"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : vxlan_configure_do())
OPNsense.localdomain opnsense 92965 - [meta sequenceId="31"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : webgui_configure_do(,wan))
OPNsense.localdomain opnsense 92965 - [meta sequenceId="32"] /usr/local/etc/rc.newwanip: plugins_configure newwanip (execute task : wireguard_sync(,wan))
OPNsense.localdomain opnsense 88982 - [meta sequenceId="33"] /usr/local/etc/rc.newwanip: The command '/usr/sbin/daemon -f -p '/var/run/updaterrd.pid' '/var/db/rrd/updaterrd.sh''

filter_20260709.log
OPNsense.localdomain filterlog 25056 - [meta sequenceId="1"] 51,,,c6449923fcfe3ab76e49d9391c552b90,ena1,match,pass,in,4,0x0,,255,0,0,DF,17,udp,576,10.10.2.1,10.10.2.5,67,68,556
OPNsense.localdomain filterlog 25056 - [meta sequenceId="2"] 59,,,f994f615e00b8be0042263f86c79913f,ena0,match,pass,in,4,0x0,,255,0,0,DF,17,udp,576,10.10.1.1,10.10.1.5,67,68,556
OPNsense.localdomain filterlog 99278 - [meta sequenceId="3"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,170.247.170.2,17143,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="4"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,192.112.36.4,39965,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="5"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,198.97.190.53,36777,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="6"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,199.7.83.42,19529,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="7"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,192.36.148.17,46699,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="8"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,199.7.83.42,43062,53,36
OPNsense.localdomain filterlog 99278 - [meta sequenceId="9"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0x0,,64,0,0,DF,17,udp,56,10.10.2.5,192.36.148.17,11280,53,36

... and can see SSH and HTTPS are blocked by the firewall
OPNsense.localdomain filterlog 72498 - [meta sequenceId="49"] 77,,,2e441470eff61ecebaeab50a8128a2e2,ena1,match,pass,out,4,0xb8,,64,62599,0,none,17,udp,76,10.10.2.5,138.197.135.239,123,123,56
OPNsense.localdomain filterlog 72498 - [meta sequenceId="50"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21014,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,55978,22,0,S,1116859751,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="51"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21015,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,55978,22,0,S,1116859751,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="52"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21016,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,55978,22,0,S,1116859751,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="53"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21017,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,56039,443,0,S,1256389213,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="54"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21018,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,56040,443,0,S,2039657916,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="55"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21019,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,56041,443,0,S,2504498693,,64240,,mss;nop;wscale;nop;nop;sackOK
OPNsense.localdomain filterlog 72498 - [meta sequenceId="56"] 4,,,02f4bab031b57d1e30553ce08e0ec131,ena0,match,block,in,4,0x0,,116,21020,0,DF,6,tcp,52,76.65.68.5,10.10.1.5,56040,443,0,S,2039657916,,64240,,mss;nop;wscale;nop;nop;sackOK


Also
Tried FreeBSD 13 with Opnsense 24.1 same behavior. Extracted the /var/log logs (detached root volume, reattached to another VM as data) and in the logs there is no obvious error, kernel panic or anything that could explain the lockdown. 
Print
Go Up Pages1
User actions