Messages

Some of this is the classic UTM problem, the more applications run on the firewall, the more vulnerabilities you have.

The squid thing though - there should be a way to define proxy rules, analogous to firewall rules, like fortinet does it.

A cli would be so nice.

There are however a few popular youtube videos pushing that scenario, which I disapprove ;) .

I might add that usage as transparent filtering bridge is a niche application and not generally well supported or documented.

By now I think it was probably a result of a prior reconfiguration of network interfaces without restarting the VM.

That is a bit of a weird question - we are hosted on ovhcloud, and after the latest update to 26.1.7_1 the interfaces vtnet0 (LAN) and vtnet1 (WAN) have switched places. So to fix, I had to reassign the interfaces, vtnet0 is now WAN and vtnet1 is now LAN, and everything works again.

Can this happen at all? If so, how to prevent it?

Das Netzdiagramm kann man so machen, ich würde aber die OPNSense direkt an die Fritzbox und den Rest dann alles hinter die OPNSense.

IPv6 halte ich für zu komplex, das sprengt mit all den Detailkomplexitäten sicher den Rahmen.

Mikrotik kann man sich auch schön ein Konfigurationstemplate machen, was man dann nur Copy&Paste aufbringt.

Aber das wären auch meine Kandidaten gewesen, Unifi und Mikrotik.

Same problem here, same solution works. No idea why. On another firewall with haproxy, it works.

I pay 12 cents Canadian per kWh (8 cents USD, 7 Eurocents, 6 pence) so my router would have to be using a truly biblical amount of power before I'd consider changing it to something else.

Well, I pay 27 cents european.

IMO the power bills are too high with hardware like that. Better buy a cheap N100 system or something similar. Or at least that was true before the techbros bought all the RAM.

Ich verstehe es nicht... Wenn die GUA sich ändert (welche?), dann passiert was?

Wenn die Public IP von der Firewall sich ändert, auf die ja das SNAT passiert, dann muss die Firewall nicht nur die IP ändern sondern auch die SNAT Regel entsprechend mitnehmen auf die neue IP.
Das hat bei mir mit v6 nicht zuverlässig funktioniert, dann ist alle paar Tage das v6 ausgefallen. Ich halte das für einen Bug, aber das ist halt auch ein extrem selten genutztes Feature.

[Or at least scale the frame to the full height that is available?]

I know you're helping Patrick but it doesn't make things easier here. This is the first post:

Maybe we can get rid of the scrolling subframe? Or at least scale the frame to the full height that is available?

On my screen the firewall rules window uses about half of the available height, but I can scroll way down

This is the commit in 26.1.6:

https://github.com/opnsense/core/commit/0e999cc5a

OP asked for it but did not acknowledge its existence.

One of the reasons we ask for actionable tickets is so the requester can confirm that is what they wanted (or not).

Everybody else adding related context in this forum thread doesn't help progress the initial request anymore.


Cheers,
Franco

Yes, I did not catch that. It is true that this particular bug is fixed, thank you.

Still, the general problem of poor space usage remains. So I completely agree with Patrick on that matter.

I'm not sure what you want exactly. If something as clear as "there is too much empty space, please use it more efficiently" from the perspective of an end user is not good enough, you should probably document it somewhere.

Can we, perhaps, all acknowledge that the complaints of especially the long time users and/or contributors are reasonable and deserve to be heard and discussed in good faith?

Coming back to the general issue of modern UIs - there is a general trend to waste space. I don't think that is something one should accept as normal and reasonable.
The reason that I attach so much importance to this is that this is the central problem of managing firewalls - keeping track of a potentially large
amount of rules.

The answers to that I read in the linked issue do not convince me - like "you should use categories heavily and select only one at a time".
The situation on the ground is that I come into setups I have not built myself and need the be able to work with them. Literally everything is possible, it's like the wild west, and I have never yet taken over a well configured firewall.

That means it is absolutely crucial to be able to get a good overview over a considerable amount of rules just by looking at that firewall rule table.

So those perhaps 20% of wasted vertical space do matter.