OPNsense 22.1 Released With This Open-Source Firewall Now Powered By FreeBSD 13

[aht0]

Okay, thanks for clarifying. Guess I lucked with my motherboard.

[brad0]

Be careful of upgrading if you're using IPv6. Something broke in the OPNsense framework and radvd might not function in your environment.

There is some other breakage with IPv6 with the release too. Also project management does not seem to have the maturity to deal with fixing this. He just wants to close the bug report, after others have run into this, and run away.

[brad0]

I do own Gigabyte Aorus-M, with RTL8168/8169 NIC which seems to work just fine under FreeBSD, so I must admit I find this claim puzzling.

It's been known for well over a decade that the respective re(4) driver in the *BSD's have some warts and cause problems. There is a lack of magic tweaking. No documentation and the vendor driver is a mess. Some people luck out. But the symptoms are watchdog resets which are an issue with the transmit path and the other being quite poor performance.

From the OPNsense changelog for 22.1..

"The Realtek vendor driver is no longer bundled with the updated FreeBSD kernel. If unsure whether FreeBSD 13 supports your Realtek NIC please install the os-realtek-re plugin prior to upgrading to retain operability of your NICs."

[monty11ez]

It's a shame they moved away from HardenedBSD. I'm hoping that someone forks the project to continue with the HardenedBSD backend.

[aht0]

He is not talking about RTL8139. This affects all of their Gigabit controllers, RTL8168 / 8169 / 8110, etc.

They're definitely not fine. That's the whole point of the comment.

I do own Gigabyte Aorus-M, with RTL8168/8169 NIC which seems to work just fine under FreeBSD, so I must admit I find this claim puzzling.

[brad0]

Be careful of upgrading if you're using IPv6. Something broke in the OPNsense framework and radvd might not function in your environment.

[brad0]

If you are for some Godforsaken reason using RTL8139 from year 2000 then yes, its futzware. Sucked even on Windows at that. pfSense box with those shitty cards rebooted every 5min.

Newer Realteks seem to be fine in comparison although I've mostly used Intel dual-NICs.

He is not talking about RTL8139. This affects all of their Gigabit controllers, RTL8168 / 8169 / 8110, etc.

They're definitely not fine. That's the whole point of the comment.

[aht0]

Did they finally get the Realtek support under BSD fixed and integrated? Or is it still futzware?

If you are for some Godforsaken reason using RTL8139 from year 2000 then yes, its futzware. Sucked even on Windows at that. pfSense box with those shitty cards rebooted every 5min.

Newer Realteks seem to be fine in comparison although I've mostly used Intel dual-NICs.

[castlefox]

We're using it for work as well - it's awesome. I much prefer it to the various proprietary firewall products.

What I meant (and expressed poorly) was that all home users with moderate technical proficiency (and up) should absolutely use this.

I am decent with computers but I am new to networking to using/managing firewalls. Does OPNsense 22.1 have good enough documentation that I could figure it out myself?
I am tempted to put OPNsense 22.1 on some hardware for my small home network.

[MarkG]

Just updated to 22.1, and the upgrade went well -- with one huge (for me) exception. OPNsense has deprecated their Dynamic-DNS client (not well maintained on GitHub, but has been rock-solid (for me) for several years), and the replacement seems to be, at best, pathetic, and only supports a few DDNS servers.

It seems I would have been fine until 22.7 (scheduled for 6 months from now) when they'll officially remove the current DDNS client from their distro. But, one of my pet-peeves is to avoid time-bombs to the extent possible.

My solution was to shut down their DDNS stuff, and add an update client (srsly just a 1-line cron-job) to a machine that I already run 24x7.

Overall, I'm still trying to decide how 'happy' I am with this update (and yeah, I've contributed to OPNsense, but not enough to get a vote).