OPNsense Forum

English Forums => 26.1 Series => Topic started by: bman on March 10, 2026, 09:58:39 AM

Title: FW live view not working regex
Post by: bman on March 10, 2026, 09:58:39 AM
Hi team,

some time ago (probably on 25.x) I've noticed that my saved live view filters do not work. Just waited some time that maybe get fixed.
Found out that interfaces changed, ex. DMZ now vlan02 etc. So fixed this, but regular expression filters does not work anymore.
The syntax looks same in config, but not working.

I see the error in backend log:
Script action stderr returned "b"/usr/local/opnsense/scripts/filter/read_log.py:101: SyntaxWarning: invalid escape sequence '\\['\n if re.search('filterlog\\[\\d*\\]:', record['line']):""

Example I used:
- filter interface, action and more ports with contain operator:
dstport~443|80|22|23|25

This now does not work. Is that an issue or was there some plan to remove regex from live view?

thx
Title: Re: FW live view not working regex
Post by: franco on March 10, 2026, 12:55:40 PM
Hi,

Thanks for the report! I think this is only an intermediate fix:

https://github.com/opnsense/core/commit/92e0d5a96fbe

I asked my colleague to comment on the "443|80|22|23|25" regex use.  Haven't seen this before.


Cheers,
Franco
Title: Re: FW live view not working regex
Post by: tuto2 on March 10, 2026, 01:40:27 PM
Hi,

I seem to have missed that regex was allowed in the old page. https://github.com/opnsense/core/commit/41664263de3f4fe211d0e7af9d0a471c300ceb21 Should address this.

# opnsense-patch 4166426

Cheers,
Stephan
Title: Re: FW live view not working regex
Post by: bman on March 10, 2026, 03:08:51 PM
Hi Franco, Stephan,

I've applied the patch and same regex(s) I used before are working again.

thanks
Title: Re: FW live view not working regex
Post by: lmoore on March 10, 2026, 03:14:34 PM
Quote from: franco on Today at 12:55:40 PMHi,

Thanks for the report! I think this is only an intermediate fix:

https://github.com/opnsense/core/commit/92e0d5a96fbe

I asked my colleague to comment on the "443|80|22|23|25" regex use.  Haven't seen this before.


From re_format(7):

     A (modern) RE is one‡ or more non-empty‡ branches, separated by '|'.  It
     matches anything that matches one of the branches.

Cheers,

Larry.
Title: Re: FW live view not working regex
Post by: franco on March 10, 2026, 03:17:36 PM
"not seen before" was directed towards the fact that regex are/were supported in the JS here, not the regex itself :D


Cheers,
Franco