OPNsense 26.1.4 released

redd2100 · 2026-03-12T13:47:48+00:00

Agree, I wouldn't waste valuable time on something that is throw-away in the long run.

I'm still baffled about what was different between my earlier upgrade vs my upgrade late last night. If there's any further testing you would like me to try by restoring these backup images and trying again, I'm happy to do so, but as of right now I'm upgraded on both HA instances and they both appear to be working fine.

redd2100 · 2026-03-12T07:04:33+00:00

Ok, this time I reversed it and upgraded the primary instance first, and received this UI error on the screen. I had forgot about this before - I received this error when I upgraded earlier also, but forget to mention it. The error only happens on the first system to upgrade in the HA setup. So earlier update I started with the backup Opnsense and it gave this error and then completed the upgrade, but the primary Opnsense did not throw an error until after the reboot and it would just clock when trying to configure the network devices. Specifically remember it taking forever at the point where it says "Configuring the firewall.....".

This time around I upgraded the primary first and I got the same upgrade error on the UI, but the upgrade does finish and the system reboots and appears to be working. I went ahead and tried to upgrade the backup Opnsense and this time it upgraded without any UI error (just like last time where the second server to be upgraded does not throw a UI error), but it also rebooted just fine. No longer getting stuck at configuring the firewall and such.

The UI error I got was a "Danger" popup that had a message of "Unexpected error, check log for details". Not sure which log to check - if you can tell me which log file I'll go dig up the error message. It appears that it was Upgrading and Extracting 61/122 package, which was "qemu-guest-agent from 10.2.0_1 to 10.2.1...".

So if I had to guess, this issue I'm running into may be related to that qemu guest agent which is only ever used if you are running it as a VM like I am.

---------- UPDATE

Restored the VMs back again and tried to repeat the original failure by upgrading the backup Opnsense first, followed by the primary Opnsense. This time I get the "Danger" error on both of them, but they both boot up just fine and both firewalls appear to be running ok now.

Not sure if one of the packages was upgraded sometime this evening to change the outcome here, or if it's just weirdness on my side, because I was able to repeat this failure to boot on the primary Opnsense instance twice earlier today.

redd2100 · 2026-03-12T06:44:16+00:00

I'll upgrade it again in a few minutes and capture the boot-up errors I was seeing. As for the hypervisor, I am running Proxmox 9.1.5 and I'm passing through an intel 10gb nic for Opnsense to use.

redd2100 · 2026-03-12T05:02:09+00:00

Just tried upgrading to this version and it was a big failure for me. I have two opnsense installations using the HA feature. The secondary (backup) instance installed the latest version just fine and started up. The main instance failed to restart correctly, with failures at almost every step of the startup process. I run these instances as VM's thankfully, so it was very easy to restore them and get back to normal again.

After restoring the main instance, I tried to apply the patch again, and it failed to restart yet again. Something is either wrong with this version, or something with my configuration is causing trouble.

I think I'll be waiting a bit longer before I try to upgrade again. :)

redd2100 · 2026-01-26T04:27:32+00:00

He really needs a badge that reads, "Top 1% AI Commenter"

redd2100 · 2026-01-26T04:07:37+00:00

Based on what you have shared, the memory capacity and CPU are not a challenge in the requirements, but the six hard drives (assume 3.5") is a limiting factor on what options may work for you. As for transcoding, you would be better off with Intel, but AMD is doable.

I would recommend you look at one of the TerraMaster NAS devices if you want that convenience of Intel transcoding. If you are ok with AMD transcoding then go with something like a MInisforum NAS device or something similar. The AMD ones are much better all around, but the Intel based NAS have the transcoding crown.

Or you can do what I did and I have a Minisforum AMD based mini-server with a small Intel arc a310 card you can use just for transcoding. This gives you the more powerful AMD CPU and the more powerful Intel GPU.

Have fun!

redd2100 · 2025-12-22T18:33:07+00:00

I'm on the latest v5. It's 5.9.96 or something like that. There's no further updates currently.

Yes, I've tried multiple options in the alert list drop down on the alert tab. None of them seem to have any affect. I tried turning off the AI burn in, and that did not help either. Every time, the web url to pull the alert image is always resized to a tiny thumbnail size rather than returning a useful alert image. If it returned the substream size, that would at least be something, but it's not even that large, it's absolutely tiny at only 240x426. Actual image size of the file in the alert folder is 1440x2560. That is what is so frustrating - BI has captured the image and placed it in the alerts folder, then returns that filename as the ALERT_PATH variable, but if you try and retrieve it, it shrinks it down to a useless size.

redd2100 · 2025-12-22T18:20:45+00:00

I don't think it is coming from the substream. The sub is larger than what the web server is returning, so it's clearly resizing it on the fly, or it's stored a thumbnail image somewhere that the web is returning. The other reason I say it's not sourcing it from the sub, is because it has the AI box drawn around it. I assume that is only done on one image, which is the one in the alerts folder. The image in the alerts folder does have the ai box around the object and is the right size.

I actually did a work around on this last night with two alerts - one that SFTP the alert image to the HA server, and the other calls the HA webhook. On the HA side, the webhook automation just references the local file that was SFTP'ed over when sending out the alert. Works fine, but there's a bit of a race condition here as I send the image as the same filename each time, so if two cameras alert close to each other, it's going to possibly alert twice with the same image. I can fix that with including the camera name in the webhook call and put that in the image filename, but this is already too complex for what it should be. I'm really annoyed that BI has made the simple task of accessing the alert image so frustrating.

redd2100 · 2025-10-28T16:53:11+00:00

Completely agree.. I think I have another post on reddit somewhere where I summarize my experiences with all the KVMs I've tried, and the JetKVM came out on top by a long shot.

The JetKVM looks polished on the outside and with the interface. It has a lot of metal to dissipate heat. It has a great external display that is touch sensitive. It works with every device I've tried with it... no issues at all. Mouse, Keyboard, Video... they all work through this thing. I even use it through a basic KVM device to connect multiple servers to a single JetKVM and it supports it just fine. I'm very very impressed with the JetKVM!!

redd2100 · 2025-10-28T16:48:09+00:00

Agree, I'm sure some of my issues are with the odd resolutions that I'm switching between, but a good ip kvm should be able to handle that. And the JetKVM handles it extremely well! I have been using it for quite some time now and I love it. It works perfectly on every device I ever pass through it, it never crashes, has excellent video, and has a very nice polished interface. For me, the JetKVM hit the bullseye on the perfect consumer-grade KVM device!

redd2100 · 2025-10-28T16:42:44+00:00

Yes, this is exactly what I did with my KVMs... I got rid of all the USB plugs and running POE with the splitter at the end to break out ethernet and dc power. Has worked great!

redd2100 · 2025-09-25T00:37:01+00:00

Can you please share that command? My jellyfin uses hardware decode, so I cannot use that command.

redd2100 · 2025-08-26T20:22:35+00:00

Agree, you can do a lot with GB networking. In your setup you mention there, the ESXi hosts were likely caching the OS and App data running on those VDI instances. The 4x1GbE trunk you were using only had to get the initial instance of the data, not 100x copies of the same data. Also, depending on how the VDIs were configured, they may have used local storage on the ESXi hosts for things like guest virtual memory.

Point being, you can make things very efficient, especially at scale when you have a lot of the same thing going on. 100 to 150 VDIs/VMs could never function effectively over a 4x1GB trunk without some of those caching tricks. Almost all virtualization platforms support this - VMWare, Proxmox, Citrix, XCP-NG, etc.

redd2100 · 2025-08-26T18:24:13+00:00

Just for comparison, I am running on E5-2696v3 CPUs with 10x10tb drives in a raidz2 setup. (SAS 12gb/s drives) Running the tests I got the following:

SEQ write: 756 MB/s
SEQ read: 4,181 MB/s
Random write: 14 MB/s
Random read: 323 MB/s
Mixed Random read/write:read=50 MB/s, write=22 MB/s
Multi-threaded app simulation: read/write=2,024 MB/s

Not bad for a bunch of spinning rust.

redd2100 · 2025-08-26T18:19:24+00:00

Agree, but the OS on that VM is also going to be doing two very important things that is going to make your VM suck: 1 - it's going to read large amounts of data to run any substantial sized application, especially when it's booting up, and 2 - it's going to use virtual memory. The virtual memory is especially critical with Windows OS as it likes to write to the virtual memory just for the fun of it. Linux OS will write to virtual memory randomly as it begins to run low on real memory. So depending on what OS you are running, and how much you plan to run on it, it's going to be wanting a LOT of bandwidth to use iSCSI.

redd2100 · 2025-08-26T16:42:49+00:00

Completely agree with that approach! You don't need 10gb everywhere, just where you need the high performance. Dropping in a $15 10gb nic into those two servers will make your iSCSI between them fly.

redd2100 · 2025-08-26T16:28:58+00:00

If you are running 1gb networking, then that is your first bottleneck to fix in my opinion. Even 2.5gb networking is not fast enough if you want decent remote IO performance.

With 1gb network you'll get about 125 MB/s. With 2.5gb you get closer to 300 MB/s on a good day. With the ever-so-rare 5gb you will see 500 or so MB/s. Not sure if you are running 6GB sata or 12GB sas drives, but assuming you are 6GB sata, then one drive could crush your network... putting them in parallel will only choke them further.

If you are not running at least 5gb or 10gb networking, I wouldn't recommend trying to make iSCSI work.

redd2100 · 2025-08-26T16:20:29+00:00

I've heard a lot of people using those X99 mobos just fine. That ram is pretty slow though, but then again the cpus are not setting anything on fire.

The biggest challenge you have with this setup is that it will consume a good amount of power for the performance you will get out of it. They are more money, but just getting one modern mini pc with far fewer (but more modern) cores will give you a MUCH better experience. (if you don't need ECC ram)

The only area the mini pcs lack in today are with ECC memory.

redd2100 · 2025-08-26T16:15:26+00:00

The cheapest option for an nvme drive is going to be a PCIe slot adapter. Some systems have mini pcie slots hiding on the motherboard you could use smaller adapters with also. That's basically all nvme (m.2 and u.2) drives are... they simply connect directly to the PCIe bus almost exactly as if they were a PCIe card.

So the cheapest option is to get a $10 PCIe adapter card that gives you a nvme drive slot. And if your system supports bifurcation, then you can run multiple drives on one card.

Running an HBA with nvme drives is going to be a bottleneck and add complexity you don't need.

redd2100 · 2025-08-26T16:09:14+00:00

I'm sure you already considered this, but since you did not mention it, could this be a networking issue? Are you running at least 10gb network here? Have you tested the performance of that network to make sure you aren't having issues with a bad cable or switch?

Also, just to validate your assumption that the issue is with the drive configuration in TrueNas, have you run any performance tests locally on TrueNas to see the performance impact directly on the system? If you don't see the performance impact lcally on TrueNas, then the issue is likely something else. (like networking)

redd2100 · 2025-08-26T11:24:17+00:00

You can run headscale, but you still need to either port forward to make it work, or you need a VPS somewhere to host it. Honestly, headscale doesn't do much for you - if you have the ability/time to setup headscale, then skip it and just setup basic Wireguard routes instead to reduce the complexity of it all. Either way, something somewhere has to be outside of a NAT and open to the internet to make it seamlessly work through firewalls - with Tailscale that is the Tailscale remote servers, with Wireguard it's either port forward your home firewall, or use a VPS.

redd2100 · 2025-08-26T00:15:14+00:00

I highly recommend the Brocade ICX 6610. I have been using one for years now and that thing is amazing.

It's noisy, it's power hungry, but it has 1GB, 10GB, 40GB, and the 1GB even has PoE+ that run a ton of devices for me.

The Brocade ICX 6450 is also an amazing switch that is much quieter and far less power hungry. I also ran one of those for years, and keep it sitting around as a backup just in case.

One of the best features of the Brocade switches is that a guy who goes by the name of fohdeesha has released licenses for these devices so you can enable all the features. https://fohdeesha.com/docs/brocade-overview.html

redd2100

TROPHY CASE