Messages

Rules are processed in order, by default as first match, so there is no impediment to adding overriding restrictions prior to the default rules.

What problem are you trying to solve?

Yes, I have decided to make the switch next week after I return, planning to make some use of GeoIP features in rules.

After a year off I have bought a three year business licence. I will probably use it this time (previously ran with community anyway).

E-mail notifications for me have been sporadic. I read the forum daily yet my awareness of the PHP patch came about six hours after it might have done. I do not regularly check the Opnsense GUI. Happily, based on comments in the CVE thread, I was not at any evident risk. Nevertheless, I wanted an improvement in timeliness.

Given my time zone, releases usually occur in my evening or through to dawn. I decided on an agent to check the Announcements page then send me a notification through Apple Notifications if there was a relevant change (not routine RC). While I am writing this a local LLM is building the agent, to run about when I rise and an hour before I usually retire. My routine visits to the forum will cover the day.

This is one of the possible solutions.

That was exactly the conclusion I was leaning towards

Yes, you argued it in your opening post. For this reason I disagree with @nero355 that your post might be useful as implicitly standalone advice in Opnsense documentation. As one of the options, of course it lays out a valid position. However, one does not need to be in a production environment or launch a thousand devices to find Kea / Unbound an optimal solution for home needs. Patrick put the basics of that clearly.

It depends on the user, not the system.

An upgrade option with no or negligible sunk cost thanks to a return is a clean purchase so choose what suits.

To clarify something myself, by load factors I referred to the 1, 5, 15 minute loads reported by Unix/Linux. You should see them on the Opnsense dashboard. Basically, if they are under your core count then no processes are waiting. I find it a useful measure and pay much less attention to CPU. I run a mail server myself, and use Q-Feeds (paid) on both sides.

Sorry I have no information about the 304 itself.

Based on what you write, my own view would differ a little. You describe a system completely fulfilling its load requirements with a caveat of 95% CPU but without circumstances or timeframe for that. What do the load factors say on your dashboard? They are more interesting for estimating headroom, given you have already said the user experience is fine. Are you planning to add load or to upgrade the 2.5Gb/s link in the next few weeks?

Machines constantly develop in speed and price, so it makes sense to buy when it will make a difference rather than for future needs, to wait until the current system is actually or imminently deficient. A latest router is basically a quick-buy drop-in and the latest will have best performance over price.

While my link is only 1 Gb/s and the chip in my DEC697 might be considered practically antique, my downlink and the 2.5 Gb/s routed backbone (3 nets) run full tilt with load factors way below interesting levels. I would love to buy a DEC850 but have no excuse so I bought a new Mac instead. Unless there is more information that you have written, I suggest keeping options.

I would really very much like to keep my devices from doing anything more than using my network to access the WAN. I do not have wifi anymore

For that requirement for the TV you need a basic IoT setup as meyergru said, the TV on its own port or VLAN, configured for outgoing internet access only. Does it matter whether other devices can see each other? If so, you need a VLAN for each, otherwise just the two.

Alternatively, it is possible to lock down the TV so that it can reach nothing but the time of day, and is accessible only from the internal network. A small Mikrotik router can be configured to do this.

I maintain a dumb TV with AppleTV in front like connervt, and imprison an NVR as described in the previous paragraph. Having to VPN in to check what the cameras are seeing is the trade-off when I am out of the house.

I found this explanation pretty good: Opnsense firewall rules

Are you planning an initial setup or preparing to migrate? Following the relevant dialogs works with only rare exceptions.

Alas, I am in a still smaller minority. Visually it is good except that it is back to a single column rather than the compact two-column display. Options?

Having to scroll an important status display is an anathema to me. Back to trying to rearrange the dashboard so the entire column is visible while other components are in their place.

Interestingly, the sentence starting "However" in the second paragraph said all that was necessary as an opening and probably sufficient question.

Given it looks like a question to or by AI, I decided to give just the critical sentence (with contextual "In OPNsense") to a local model (Qwen3.6 35B A3B in this case). After thinking strenuously for 1.2s (a minute elapsed) it came up with a lengthy explanation and correct answer, together with validation tests and informative notes for beginners.

That is not how I do OPNsense myself, but it seems that simple clear questions work either way.

When you replace the battery, use an SR44 / 357 silver oxide rather than the alkaline LR44. They are less likely to leak and last much longer. I found this decades ago in my HP32SII (still in use, incidentally).

Que ce soit par segmentation par interfaces ou par utilisation de VLAN sur une seule interface, je séparerais sans hésiter la comptabilité de la réception et des autres fonctions administratives. Le contrôle d'accès aux serveurs relève généralement de leur gestion et non de celle du routeur.

Le choix entre VLAN et segmentation d'interfaces dépend de la configuration actuelle ou prévue du câblage, des commutateurs et du réseau Wi-Fi. Les commutateurs sont-ils compatibles VLAN ? L'OPNsense est-il une solution prête à l'emploi permettant de dupliquer l'infrastructure existante ?

(Traduit)

I prefer the new widget in part because I rarely have need to check the Dashboard, so do not have a firm mental image from which to see discrepancies immediately. I experienced that problem recently in the old columnar widget, where the fact a service was off (hence a problem) did not stand out. With the new widget it is clear at once.

I also prefer not to have to scroll merely to check states rather than when reading text. Any warning should be visible immediately so again, the new widget wins. I try not to clutter my Dashboard, and with the new widget and some other rearrangements it is single screen, organised and clear on a large display or a Macbook Air.

It may have helped in my case that my theme is opnsense-dark where it seems to fit quite well, so I was not triggered by unexpected contrast. In any case I tend to run with low screen brightness and contrast. I can see from some other people's screenshots that in other contexts the display tones may need tuning.

Adding this by way of explanation rather than merely sitting back happily.

Some do, some don't.