The automatically generated rule <virusprot> seems to block internal IP's from going to the WAN when a threshold of connections is reached for the internal IP address.
In my case this happened when a server wanted to get update packages and triggered the threshold apparently.
But I have no clue where I can unblock this specific client nor where i can increase the rules that contain the trigger values.
Any manually created rule is inserted after the automatically created rules so will never overrule the automatics.
OPNsense 25.7.1_1-amd64
FreeBSD 14.3-RELEASE-p1
New to OPNsense. I just updated to 25.7.7_4. I am attempting to use Watchguard SSL VPN to connect to a remote location. This application worked without any issues on 25.7.6 and previous versions. I attempted to use it after going to 25.7.7_4 and it fails every time. OF COURSE, (lesson learned) I need to backup/get a snapshot before upgrading. In the firewall logs, it appears to me it is showing the "virusprot overload table" rule is preventing me from connecting with VPN software. Any suggestions?
Do y'all have "Firewall: Rules: [interface]" -> "Advanced features" -> "Max new connections" configured?
I don't seem to have an "Advanced features" under rules. I have Floating, LAN, WAN, WireGuard (Group), WIreGuard_VPN, and my vlans.
A clarification/question: on the Firewall:Log view, I click on the far right button to show the rule that is blocking the VPN connection. It is showing "rulenr 11" and when I count down on the rules, it appears to be the "virusprot" rule.
I'm using a bit of a shorthand representation of the field location, and I missed a step. It should be "Firewall: Rules: [interface]" -> [rule] -> "Advanced features" -> "Max new connections". In other words, on the (normally) left hand menu, select "Firewall", then "Rules", then an interface, then select the edit button for a rule, then select "Show/Hide" next to "Advanced features" at the bottom, then scroll down to "Max new connections". Whew. But you can use this setting to populate the virusprot alias. I do not, for instance, as it can be tough to come up with a reasonable rate against the Internet, especially on modern high-speed services.
Thanks for the assistance. That didn't resolve my issue. I might need to contact Watchguard and get guidance from them on which end is closing the connection. Is there an "easy" way for a newbie to view detailed logs, other than in the gui? I think I have checked all the "log" buttons on the gui and none are giving me any information. Thanks!
Logging settings for (most of) the automatic rules is under "Firewall: Settings: Advanced" -> "Logging". If you enable those, you should see logs in "Firewall: Log Files: Live View" and "Firewall: Log Files: Plain View". Depending on traffic, these can be a little busy.