r/opnsense

Hi guys. So I got this machine a year ago and basically did nothing. Today I fished it out after looking at it for a week and fired it up. I discovered that opnsense doesn't like the WiFi on it. I asked the internet what was going on and it says:

> Hardware Limitations: OPNsense runs on FreeBSD, which has poor support for modern Wi-Fi standards (such as Wi-Fi 5/6/AC/AX); it generally only supports older 802.11b/g/n cards, typically from Qualcomm Atheros or MediaTek, while excluding Intel cards which often lack AP mode support.

I have "Intel inside" :-(

The advice "the internet" had to offer was:

> Recommended Architecture: For robust performance, it is widely recommended to use dedicated external wireless access points (like UniFi or Ruckus) connected via Ethernet, allowing OPNsense to manage network traffic, VLANs, and security policies while the AP handles the wireless radio signals.

The cheapest hotspot with an Ethernet plug on amazon is 75 euros. My options are:

• Try to fix the WiFi on the existing device
• Buy an external AP.
• Get a compatible WiFi dongle.
• Buy a new computer

I don't really want to shell out for another multi-hundred ordi.

I have a managed switch (in retrospect I could have skipped this) so I can run two VLANS with the AP.

What should I do?

I’ve been a long-time Zenarmor user on a paid Home subscription, and I’d like to raise a growing limitation. Fiber and cable connections are increasingly multi-gigabit, but the Home Edition is still limited to a single-threaded packet engine. The multi-core engine introduced in 2.7 is apparently limited to Business and higher subscriptions. I myself have a 5x5Gig fiber connection at home.

You can check whether the single-threaded engine is your bottleneck by running top -SHP in OPNsense during heavy traffic. In my case:

eastpect{Eastpect Main Event}   CPU1   98.45%
kernel{dummynet}                        9.95%

The eastpect main thread is pinned at ~98% on a single core while the other 15 cores sit largely idle on the box. The traffic shaper (dummynet) uses only about 10%. The system has plenty of total CPU capacity, but all inspected traffic funnels through one saturated thread.

In practice, sustained downloads of around 2 Gbps cause intermittent connectivity problems. They’re most visible with Unbound forwarding over DNS over TLS (e.g., Quad9): TLS handshakes fail, and after repeated failures the upstream is marked unavailable for roughly 15 minutes. However, with Zenarmor disabled, upload throughput also improved from roughly 3.1 Gbps to 4.2 Gbps and the intermittent DNS issue was resolved.

I understand full multi-core scaling is a Business feature. Even one or two additional worker threads on the Home Edition would make a meaningful difference for home users on multi-gig connections. As it stands, I can no longer use Zenarmor on my connection, despite paying for a Home subscription.

26.7.6_3:

• interfaces: PPP type validation fixes for new assignments
• firewall: fix off by one in addAction() in alias diagnostics
• mvc: UidField: revert "allow an arbitrarily specified UID for system scope users upon creation"

26.7.6:

• system: use correct type for IP when killing active states in "lockout_handler" (reported by Omar Habra of Apex Security Research)
• system: reject a null gateway in getGatewayAction()
• system: add "latency_avg" as sanity check for running dpinger
• system: missing chown in backup call for proper non-root web GUI access
• system: do not allow system scope users to be renamed
• reporting: unbound: add DNSSEC status column in details grid
• interfaces: add interface configuration settings in new assignments page
• interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode
• interfaces: improve queue build sequence in interfaces_dependencies()
• interfaces: remove stale VIP address after update (contributed by ExpRam)
• interfaces: be more conservative with -no_dad
• interfaces: add a new 'updateip' hook
• firewall: aliases: reject reversed port ranges
• firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)
• firewall: destination NAT: add safety guards for calculated port ranges
• ipsec: add "replay_window" option to children
• monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)
• openvpn: default keepalive to "10 60" in server mode and improve validation
• bootgrid: upgrade Tabulator to version 6.5.3
• mvc: disable Nginx reverse proxy buffering on configd streams
• mvc: dispatch failed message during reconfiguredAction()
• mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)
• mvc: PortField: always return a string for normalizedPort()
• mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation
• ui: do not add the spinner again when it fails
• plugins: add error returns to plugins_configure()
• plugins: os-ndp-proxy-go 1.5
• src: sysvsem: heap out-of-bounds access in semop(2)
• src: ktls: remote DoS via receive-side kernel TLS
• src: udp: IPv6 UDP sendto(2) bypasses jail loopback restriction
• src: vfs: multiple jail filesystem root escapes
• src: openssl: out-of-bounds read in OpenSSL DTLS retransmission
• src: kqueue: memory safety bugs in kqueue copy-on-fork implementation
• src: syslogd: fix leaking child processes when logging to a pipe
• src: iflib: do not hold the ifnet lock across registration
• src: ixgbe: correct Wake-on-LAN configuration
• src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array
• src: pf: mark non-port packets to require IP checksumming
• src: pf: set the correct type for rule timeouts
• src: loopback: improve checksum offloading
• src: vlan: use the exclusive lock everywhere
• src: routing: initialize V_rt_numfibs earlier during boot
• src: raw ip: clear sin_port on bind(2)
• src: nd6: fix regeneration of temp addresses in detached state
• src: hyperv: fix single page invalidation path
• src: route/fib_algo: fix nexthop index collision across families
• src: ice: do not leave device non-functional if Tx scheduler config fails
• src: netipsec: fix V_spd_size updates
• src: bnxt: assorted updates from stable/15
• src: ixl: assorted updates from stable/15
• src: linxkpi: assorted updates from stable/15
• src: net80211: assorted updates from stable/15
• src: pci: assorted updates from stable/15
• ports: ca_root_nss / nss 3.130
• ports: expat 2.8.5
• ports: pcre2 10.49
• ports: phalcon 5.22.1
• ports: php 8.5.11
• ports: py-duckdb 1.5.6

I'm very confused about this. My setup is an opnsense router and a raspberry pi DNS pi-hole. This issue is only happening with one specific website right now for some reason. If I go to hangryjoes.com everything is fine but when I want to place an online order it takes me to ordernow.hangryjoes.com and then gives me a DNS error. Checked the query logs and I see it's trying to go to ordernow.hangryjoes.com.home.arpa even though I don't see the home arpa part in my browser website bar. In Services<ISC DHCPv4<LAN the Domain name and list is empty so I don't know why this specific website is the only one experiencing this issue.

Has anyone else had their XB7 Xfinity gateway just randomly stop working?

I keep mine in bridge mode and pass it to an opnsense router. I woke up on Monday and I had no Internet. Started running through my checks and everything on my side was good. The gateway wasn't giving my router the public ipv4 address no matter what I did. I contacted Xfinity and after they got me to run a couple tests then they reprovisioned the router which didn't help. They sent out a tech who replaced the whole gateway after testing the coaxial cable.

The part I find is odd is that my friend had an XB7 gateway stop working in a very similar way. The app shows the device online and will even run a speed test, but no ipv4 address so no outside connection. Tech showed up and replaced it with an xb8 in both instances and it was fixed.

I am trying to move my opnsense to new hardware, but I am going to migrate my network card to the new machine. I logged into the current machine, tell it to make a backup which downloads to my tablet. I go into the backup.xml file that was just created and it is references a DDNS configuration that I haven't used in 5 years. I log back into my machine and verify that that DDNS information isn't there and it is not. I go back to the backup and search some other strings that I know should be there and they are not. I am currently running OPNsense 26.7.5-amd64 on both machines and the new machine was a clean installation and only logged into so that I can set the IP address on the LAN. I haven't made any changes to the new machine because I thought the backup would do all the hard work.

I thought this would be so simple to backup, move, restore so I am sure I am missing some basic step. Thoughts

I am currently looking at doing a huge revamp of my home network. I have been playing with Proxmox and want to add OPNsense into the mix.

I know I can put it on my Proxmox box (Zeon 2680V4/32GB/20TB+1TB) but I have an old SFF ITX board based computer that I have used as my shop computer. It is an Athlon 5350 with 16GB ram and a 500GB SSD. It has PCIE 2.0.

I have done some research and know that 8 lanes can support a dual 10Gbs NIC at full saturation on both channels. What I don't know is what the load on the processor is at this level. Will the Athlon be able to keep up? It is 4C/8T at 2.04GHz

How are you guys going about making rules?

- As Needed
- Starting out with a foundational list

If anyone using a foundational list could lead me in the right direction I would appreciate that. I have heard there are some rules on GitHub but I am not sure if it would be overkill. I am just looking to set my home network up as solid as can be. Feel free to ask me anything that would help.

While updating from 26.7.3_11 to 26.7.5, I noticed this in the update log:

=====
Message from opnsense-26.7.5:

--
Just a dream and the wind to carry me

The update otherwise completed fine. Is this one of the release quotes the devs hide in the package message? Does anyone know where this one is from?

Hi, I'm still on 26.1.11 and obviously need to upgrade to 26.7 but I'm confused about a few things and need to ensure I'm ready before I proceed.

I have backups of config ready.

I still have firewall rules in the Rules section and I don't think I migrated them however when I look in Rules [new] they do appear there as well, so does that mean I have migrated them without really realising? Do I need to or should I migrate them before upgrading to 26.7?

I'm also still using ISC DHCPv4 [legacy] do I need to migrate from that before upgrading to 26.7?

Many thanks

Lost power, and now the cpu load (normal was 0.3-0.8) is now sitting at 2.5-4 and disk light is constant on.
GUI very slow, and fails to draw screen elements.

If I stop packet engine, all goes back to normal.
I reset the reporting db once and it seemed better for a couple hours.

I have Zenarmor in bypass mode now and the box is behaving.

Anyone else seen this?