Messages

Why not use the battle tested OpenVPN server with MFA already existing in OPNsense core?

Its more like:
- You already half finished a firewall rule
- You notice you need a new alias
- You can add it in a different tab, but you have to save the rule and then edit it again and then add the alias

I mean yeah its a planning issue but it interrupts the workflow surprisingly often. I dont know if often enough to create complex dependencies to solve this, but it would be a "nice to have" if at least the available aliases in an open firewall rule would update.

Ich sehe hier gerade keinen Handlungsbedarf. Man kann noch viel mehr falsch konfigurieren und warnungen werden auch fast immer überlesen.

Geh mal zu "System - Settings - Administration" und ändere das interface wo die Webgui hört. Da kommt wohl das bekannteste Fenster was so ziemlich alle ignorieren xD

Wenn man die Doku liest und 1:1 befolgt hat man keine dieser Probleme:

https://docs.opnsense.org/manual/dnsmasq.html#dhcpv4-with-dns-registration

I tested the pf traffic shaping recently and performance was not that great, its still experimental. I would not deploy it in production but rather wait.

Ideas that are in the mind is e.g. creating a new Alias while having a Firewall Rules dialog open, but for that to ever happen we have to follow the roadmap a bit further and push the "Firewall - Automation - Filter" component which is entirely MVC and was reworked a lot during the past year. It's soon going to be called "Firewall - Rules [new]".

GUI improvements take a long time to develop and test.

You can close the issue and open a new one following the template.

The more focused your request is on a simple topic, also generally with a configuration example and/or documentation, the more likely it will be a feature request.

If its mixing lots of different concepts/features and its a long wall of text it most likely doesnt get that much attention.

Put yourself in the shoes of somebody triaging 10 issues every day, the ones with a simple direction are more likely to get picked up.

The API can take a comma separated string of interfaces ("" empty string is floating). So e.g LAN,,WAN will produce all LAN, Floating, WAN. (search endpoint).

I transfered it to core.

I guess this mostly falls into the Macro/Wizard dicussion.

Technically a vlan, layer 3 interface and dhcp are different technologies. So the GUI does not intermingle them for maximum flexibility.

Since all new components are API enabled, crafty individuals could build their own workflows (e.g a script that does exactly what they want with all assumptions their environment requires)

These could also have their own GUIs as the plugin system is very advanced and can hook into existing models.

For more inspiration check out the new system wizard.

Reading the reviews link it does not seem like that commit is in FreeBSD 14. Which means this will not hit the OPNsense kernel for a while if its not backported. So this looks more like it takes well into 2026-27 and FreeBSD 15 based OPNsense.

It requires an interface selection if the rules are not in floating. Maybe thats the issue?

You can turn off the rebind protection in 'System - Settings - Administration'

It should not be an issue if tagged and untagged is not mixed on the OPNsense on the same network interface.

If your trunk only has vlans configured on the OPNsense, then untagged frames are not evaluated on the port, as long as you don't actively use the parent interface of the VLANs.

By using a second interface for untagged, you are most likely good.

Wireguard is a stateless protocol. Once peers have handshaked, they will happily use that socket forever, until one side sends a handshake from a new socket.

But, a peer might be behind a firewall that does not allow receiving this new handshake (the state is open for the old socket only), so the peer never updates and continues to send all packets to the last known socket.

If you want failover you need a stateful protocol like OpenVPN that notices if the control channel gets interrupted and re-establishes automatically.

Wireguard is only self healing if both peers can always talk directly to the other peers socket.