So Firefox rolled out early this year an integrated free VPN in their browser that bypasses the Zenarmor policies. I have every Proxy in the policy blocked and it still is working. Is there going to be a policy update to block the Firefox VPN?
Hi,
Thank you for your feedback. This has been scheduled for investigation and will be included in an upcoming release. In the meantime, you can add this as a Custom Application by monitoring user sessions via the Live Sessions connections report. Please refer to the following documentation for further details:
https://www.zenarmor.com/docs/opnsense/policies/application-control-rules#definingupdating-a-custom-application
Best regards
i tried this and couldn't get the custom application to hit. i assume i am setting things up wrong.
i tried adjusting the custom app like 10x different ways. when i go back to the live sessions after updating custom app / policy, i still just see the entry allowed (green shield)
Hi,
Can you share the configuration via "'Have Feedback" option?
Quote from: dirtyfreebooter on August 12, 2026, 12:11:29 AMi tried this and couldn't get the custom application to hit. i assume i am setting things up wrong.
i tried adjusting the custom app like 10x different ways. when i go back to the live sessions after updating custom app / policy, i still just see the entry allowed (green shield)
Custom apps in ZA are broken. And for some time now.
I already did open a ticket (21.10. 2025) for it, but it's in a backlog.
Regards,
S.
Quote from: Seimus on August 14, 2026, 07:22:35 PMQuote from: dirtyfreebooter on August 12, 2026, 12:11:29 AMi tried this and couldn't get the custom application to hit. i assume i am setting things up wrong.
i tried adjusting the custom app like 10x different ways. when i go back to the live sessions after updating custom app / policy, i still just see the entry allowed (green shield)
Custom apps in ZA are broken. And for some time now.
I already did open a ticket (21.10. 2025) for it, but it's in a backlog.
Regards,
S.
this makes sense, but i tried also making some other custom apps, and none of those worked either. like real simple ones, by IP address or just a port, so try and see if any custom app was working. seems like you said, custom apps just doesn't work and they apparently have no tests around that.
It's honestly a bother because the Custom apps allowed more granular block or allow for stuff ZA didn't recognized such as DTLS, which is currently categorized as QUIC.
The feature is broken close for a year. I hope it will be fixed...
Regards,
S.
Hi,
It seems different from QUIC issue. We need to check the config file.