The firewall that kept crashing: USB network adapters and a kernel bug
My OPNsense firewall rebooted itself every few hours, once taking the internet down for 5.5 hours. Two different faults were hiding behind one symptom.
The problem
My home firewall runs OPNsense on a reused laptop. The laptop has one built-in network port, so the second connection went through a USB Ethernet adapter. The internet kept dropping, and one outage lasted 5.5 hours.
Fault one: a bad adapter
The USB adapter's error counters told the story: over 1,100 dropped packets every 30 minutes, compared with zero on the built-in port. The system log showed the adapter detaching from USB entirely. I swapped in a different, powered USB adapter and the drops went to zero.
But the crashes continued.
Fault two: a kernel bug
The firewall had saved 15 crash dumps. Every one pointed at the same place: FreeBSD's USB packet-capture code dereferencing a bad pointer. Any heavy traffic over USB could trigger it, so swapping adapters could never fix it.
The fix: get USB out of the path
I reconfigured the firewall as a "router on a stick": both the internet side and the home side run over the laptop's single built-in port, separated by VLANs on a managed switch.
Result: 15 crashes in 3 days became zero, and the firewall ran for days without a reboot.
Lessons
- Ping lies. Pings looked perfect throughout. The error counters and crash logs were the real evidence.
- One symptom can hide two faults. Fixing the first one (the bad adapter) made it look as if the problem had moved, when the second fault had been there all along.