Messages

What exactly was your fix, please?

Of course!

Here is an explanation of what I did to configure the firewall rules successfully. Frankly, it barely makes sense even to me, since I simply reapplied the exact configuration I had in the previous version. After setting and applying the LAN pass rule again, I used the following commands in the shell: pfctl -F state and pfctl -e

After that, even though my PC could access the OPNsense dashboard, it still couldn't reach the internet. I enabled gateway monitoring (monitoring IP: 8.8.8.8), and checking 'Use System Nameservers' in the Unbound settings (enabling DoT got the job done as well).

What happens when you Enable all the Anti-Lock Out Rules for webGUI and SSH access ?

Or are they already Enabled ?!

Yes, already enabled. Anyway, I fixed the problem(s) eventually, but I had to struggle a lot.
Very strange behavior compared to the old version.
Thanks

Hi everyone,

I upgraded to OPNsense 26.7, but the default LAN pass rule no longer seems to work—I can't even access the web GUI from the LAN subnet. I have to disable the firewall (pfctl -d) via the console just to reach it. Since this is just a lab setup, I reset the firewall entirely and recreated the rule from scratch, but the issue persists. I'm not sure what I'm missing—could you help me troubleshoot this?
Thanks

In Firewall - Settings - Advanced, do you have "Disable Anti-lockout" checked?

Unchecked

[Automatically generated rules]

Hi everyone,

I migrated the entire configuration from my old OPNsense firewall to version 26.7.1.

Everything is working fine except for the firewall rules. Previously, I could access the OPNsense dashboard from my LAN PC thanks to a pass rule, but I can no longer reach it. Currently, I have to disable the firewall filter using pfctl -d just to log in. I tried adding a new pass rule, but as soon as I apply changes, I get kicked out and have to run pfctl -d again.

I suspect there might be an issue with the Automatically generated rules. Has anyone encountered this, or could you help me figure out what's going wrong?

Thanks!

The guide suggests to do policy-routing for all LAN traffic in step 4. This means any traffic would be sent out to the current upstream gateway (gateway group). Hence you would not be able to reach any internal destination, even not OPNsense itself.
The suggested rule in step 5 would allow DNS only to OPNsense befor this.

If DNS resolution on your internal devices works anyway without it, you either didn't state the gateway in step 4 or your internal devices are not configured to use OPNsense for DNS resolution.

For the time being, I can reach OPNsense dashboard even without the rule, if I exactly got what you meant about this point.
As for DNS resolution I set up Unbound for DoT DNS. I also set up NAT rules for DNS redirection and even block DoH DNS queries from LAN clients.
Maybe I missed something here.
Thanks

[(step 5)]

Hi everyone,

I set up a dual WAN failover on my OPNsense machine (it actually runs in a Proxmox VM) by following the official guide here:

https://docs.opnsense.org/manual/how-tos/multiwan.html

It suggests to add an allow rule (step 5) for DNS traffic "to make sure traffic to and from the firewall on port 53 (DNS) is not going to be routed to the Gateway Group". However, I didn't add it and everything works fine nonetheless; no problem with internet traffic.

Could anyone please tell me why?
Thanks

The release notes for 25.7.8 have an important note:

https://forum.opnsense.org/index.php?topic=49869.0

The Unbound blocklists feature formerly known as a business feature is
now a community feature.  Since this required merging both the existing
community one with the business one you need to make sure to reapply the
blocklist settings after the reboot since it will not generate a new and
possibly incompatible format.  Make sure to check your automatically
migrated settings while at it.

Maybe this is it?

My blocklist is disabled at the moment, if I got what you mean.
Thanks

In general it doesn't. I run it at multiple offices and an entire data centre with that setting and no problems at all.

Something about your configuration must be unusual. Still pondering what that might be. Did you change the interfaces setting for Unbound, possibly? Something in private networks?

I read about another user on Reddit who is dealing with the same issue as mine. Anyway, I've never complained about OPNsense, but I have already run across a couple of problems with the last version.

I realized that Unbound, in this scenario (without checking the "use name server" button), works intermittently and unpredictably.

Then probably enable:

Services > Unbound DNS > Advanced > Log SERVFAIL

Ok, I can see something as I ran a query:

Then probably enable:

Services > Unbound DNS > Advanced > Log SERVFAIL

Ok, I started seeing something as I ran a query:



Thanks

Look at the Unbound log files for the cause of the SERVFAIL - how often do I need to repeat this?

I looked at both the Unbound log files and the firewall log. There is nothing meaningful. Even no log entries in the Unbound log files. The firewall lets queries PASS.

Thanks

As I wrote: investigate the cause of the SERVFAIL by looking at the log files.

If I set "Use System Nameservers" in the Query Forwarding settings, it works but I don't think Unboud is working properly this way.
Thanks

Probably local resolution fails entirely. You need to investigate the logfiles to find the cause of that SERVFAIL.

Your browsers continue to work because modern browsers implement their own methods of name resolution.

Yes, I found out that I can browser websites via Firefoxr because I had cloudflare DOT activatet on it.
But if I disabled it, I have the same problem. So, there is definitely something wrong with the DNS requests to Unbound.
But what exactly?

Thanks

 Hi,

OPNsense 25.7.8 runs as a VM in my Proxmox machine. I ran across a strange behavior of Unbound: my hosts behind OPNsense still have internet access and get their DNS queries resolved by Unbound if I simply uses the browser, but if I ping a website, say, google.com in the prompt command it doesn't get resolved.

I saw the logs in Reporting: Unbound DNS, and noticed that the requests from the hosts got dropped:



 Could you please help understand why it happens and how to fix it?

Thanks