Both using the AmneziaWG pkg in pfSense directly? Same errors? Crash report?

My setup: WAN: 1xPPPoE LAN: 1xLAGG link using 2 interfaces (No address set) 8xVLAN set on the LAGG (All network have the DNS set to hit the router ) General setting: 2xIPv4 public DNS server DNS Resolution Behavior : local, fallback to remote CoreDNS: , (Unbound Resolver, is disabled) Port: 53 Default Group 2xIPv4 Public DNS Example GUEST Group 2xIPv4 more restrictive public DNS server No Fallback Port Forwarding: 1xRule to redirect all query on port 53 target IP 127.0.0.1 Firewall Rules (Tested on the Guest network) : 1xPass all traffic on port 53 only 1xPass all traffic with the tag cordns_allow in the Tagged box 1xBlock All trafic with the tag cordns_deny

@SteveITS - perfect. Thank you.

@PatRyan Like you, my challenge was still valid, so renewal took the short cut : V2_bhf.tld Renewing certificate account: V2_bhf.tld server: letsencrypt-production-2 /usr/local/pkg/acme/acme.sh --issue --domain 'bhf.tld' --dns 'dns_nsupdate' --domain '*.bhf.tld' --dns 'dns_nsupdate' --home '/tmp/acme/V2_bhf.tld/' --accountconf '/tmp/acme/V2_bhf.tld/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/V2_bhf.tld/reloadcmd.sh' --dnssleep '120' --log-level 3 --log '/tmp/acme/V2_bhf.tld/acme_issuecert.log' Array ( [path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/ [PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/ [SSL_CERT_DIR] => /etc/ssl/certs/ [NSUPDATE_SERVER] => /tmp/acme/V2_bhf.tld/bhf.tldnsupdate [NSUPDATE_KEYNAME] => update [NSUPDATE_KEYALGO] => 165 [NSUPDATE_KEY] => /tmp/acme/V2_bhf.tld/bhf.tldnsupdate [NSUPDATE_ZONE] => bhf.tld ) [Mon Mar 23 08:19:08 CET 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory [Mon Mar 23 08:19:09 CET 2026] Registering account: https://acme-v02.api.letsencrypt.org/directory [Mon Mar 23 08:19:10 CET 2026] Already registered [Mon Mar 23 08:19:10 CET 2026] ACCOUNT_THUMBPRINT='PeytXQsPkEceYAR-EuMNTi2YZSlVOL3elQBM35eLgdk' [Mon Mar 23 08:19:10 CET 2026] Using pre-generated key: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key.next [Mon Mar 23 08:19:10 CET 2026] Generating next pre-generate key. [Mon Mar 23 08:19:10 CET 2026] Multi domain='DNS:bhf.tld,DNS:*.bhf.tld' [Mon Mar 23 08:19:12 CET 2026] Getting webroot for domain='bhf.tld' [Mon Mar 23 08:19:13 CET 2026] Getting webroot for domain='*.bhf.tld' [Mon Mar 23 08:19:13 CET 2026] bhf.tld is already verified, skipping dns-01. [Mon Mar 23 08:19:13 CET 2026] *.bhf.tld is already verified, skipping dns-01. [Mon Mar 23 08:19:13 CET 2026] Verification finished, beginning signing. [Mon Mar 23 08:19:13 CET 2026] Let's finalize the order. [Mon Mar 23 08:19:13 CET 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/3014454136/493388472841' [Mon Mar 23 08:19:15 CET 2026] Downloading cert. [Mon Mar 23 08:19:15 CET 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06abfe80bb1d434cac4626288b9bd6a07137' [Mon Mar 23 08:19:16 CET 2026] Cert success. -----BEGIN CERTIFICATE----- MIIFEzCCA/ugAwIBAgISBqv+gLsdQ0ysRiYoi5vWoHE3MA0GCSqGSIb3DQEBCwUA MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD ...... 9G6czgghzpvBovndMOzjt6CfCCLR7cIOL+snnBAozBBJmfR4gCRMJMaRVP/UWrcw mT28jk4I9LCITO6ujVh8JtE5EaVWw/doCztWSw7BxrCYmvoCA89Xqbc1lxQcHvnD LG++YLs77A== -----END CERTIFICATE----- [Mon Mar 23 08:19:16 CET 2026] Your cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer [Mon Mar 23 08:19:16 CET 2026] Your cert key is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key [Mon Mar 23 08:19:16 CET 2026] The intermediate CA cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/ca.cer [Mon Mar 23 08:19:16 CET 2026] And the full-chain cert is in: /tmp/acme/V2_bhf.tld/bhf.tld/fullchain.cer [Mon Mar 23 08:19:16 CET 2026] Your pre-generated key for future cert key changes is in: /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key.next [Mon Mar 23 08:19:16 CET 2026] Running reload cmd: /tmp/acme/V2_bhf.tld/reloadcmd.sh IMPORT CERT V2_bhf.tld, /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key, /tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer update cert![Mon Mar 23 08:19:17 CET 2026] Reload successful And that's a pass. It looks like the (your) file /tmp/acme/bhf.tld/reloadcmd.sh could be created ? At least, it should be there, because that's the 'command' to import the created certificate into the pfSense certificate GUI storage. Instead of "bhf.tld" you should have your domain name. It contains one line : For me : usr/local/pkg/acme/acme_command.sh importcert "V2_bhf.tld" "bhf.tld" "/tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.key" "/tmp/acme/V2_bhf.tld/bhf.tld/bhf.tld.cer" "/tmp/acme/V2_bhf.tld/bhf.tld/ca.cer" "/tmp/acme/V2_bhf.tld/bhf.tld/fullchain.cer"

@keyser Thank you i now understand what is happening

Since it was "Dead" and now it is not, should it be renamed pfSense ZE?

@Pizzamaka said in unbound stops and won't start again + high cpu: What still puzzles me is why starting unbound through UI does not work whereas running pfblocker update does start unbound. Not 100% sure, but it could be that when killed unbound leaves behind its PID file in /var/run/. A shell script could potentially just unilaterally delete any existing unbound PID file before attempting to restart it. That's just a guess on my part, though, as I have not looked at the code in the pfBlockerNG scripts. When you attempt to restart the DNS Resolver from the GUI, do you see anything in the pfSense system log at that time mentioning a PID file for unbound? If you do, that would validate my guess.

Now that pfSense Plus software version 24.03-RELEASE is out this development category has been retired. New threads should be created in appropriate categories for any issues on 24.03. Mods can move threads out of this category into more suitable categories if someone needs to continue an old thread, or link to a thread here from a new thread instead.

@geoffb I can confirm that the parsing of the NTP block is buggy and we can reproduce it on all the uses cases. For the moment, the NTP field is not functional.