Messages

[very glad and so thankful]

Also note that if someone is already using your plugin and wants to switch, they should save their existing config.yml somewhere else first, so they can then import it later if they want to.

Didn't mean to rain on your parade, but it seemed an opportunity to get involved. I'm hoping to add other plugins (not necessarily any you already have!).

I am very glad and so thankful that someone (and you are a lot smarter) has taken on the plugin project and made it into something that I could only aspire to.

Please continue the good work. Much appreciated.

Thank you so much, would much appreciate if you could convert all my plugins.

You may look at AdGuardHome differently, as it already has its own well developed GUI.
However, some ideas to enhance the AGH plugin):
- a button within OPNSense to launch the AGH GUI would be a nice addition.
- an option within AGH plugin to install either the stable, beta or nightly edition.
- an option to save and restore the AdGuardHome.yaml file.

Partly as a project to get into OPNsense plugin development, and partly to address some of the enhancement requests I have seen in this thread, I've created my own Blocky plugin.

It has all settings in the OPNsense UI, with data validation, as well as a log viewer and a config.yml importer.

See my website.

Hope it proves useful. :)

Awesome... 🙏🏼

Nope. Its all default. No additional packages, no tuneables.

Thanks.. 👍
What is your WAN connection type? PPoE or other?

Im running opnsense on Protectli Vault FW6E with core boot bios. Since i upgraded to 26.7 i noticed much lower CPU temperatures on all cores. On 26.1 unit was sitting at 55C on idle, and  70C in full load. Its now sitting at 44C at idle and its hitting 66C at full load. To make this even more interesting, its much hotter outside today than it was before. Device is sitting in a small closed rack in a room with no AC. Did anyone else noticed lower temps on passively cooled devices ? Is this because of FreeBSD 15.1 ?

Great job Franco and the gang.

Do you have any tuneables set? Prior or after the upgrade.
Would you mind sharing your tunables settings?

I also have a Protectli (V1210) setup; and it used to run at around 45C on 25.x; but since upgrade to 26.1 (earlier this year) - it started to hover around 55 instead.
I have not yet migrated to 26.7 (thinking of a clean install over the weekend) - so it is good news if the temps are lower.

Would be keen to see your tunables...

Something seems broken with the latest update, blocky cannot be installed anymore.
I removed my blocky 0.28 version, updated via pkg update and tried installing 0.33 version.
After installing via "pkg install os-blocky-guru" or via "System -> Firmware -> Plugins -> os-blocky-guru" it doesn't get installed.
No error message or hint what might be wrong, could you check if it is the same on your system?

I have released an updated version, also for OPNsense 26.7

Please check...

Hi gspannu, thanks for creating the repo but Blocky is outdated by many versions now.
What do you think about an Autobuilder script that creates a FreeBSD package for Blocky automatically when an update is released by the official project?

I have updated the repo for now... with the latest version of Blocky; but I will look at automating this.

i gave adguard a try and i am currently using that and working on adguard plugin, the 3rd party repo adguard home plugin doesn't really have a native interface...

That is some effort that you are putting in... AGH has a ton of options and to capture them all into an OPNsense GUI and then ensure that future updates also work.... Hats off to your effort.

I very much look forward to your plugin... Is there a GitHub link for it?

[that hard to simply check your Pi-Hole Query Log (or the same in AdGuard) and figure out what is being blocked]

To be honest : People should really avoid needing such a feature!

Is it really that hard to simply check your Pi-Hole Query Log (or the same in AdGuard) and figure out what is being blocked and solve the issue once and for all ?!
_{Nothing personal by the way. Talking about people in general!}

And in the worst case you even have the option to use some kind of DoH/DoT feature in Mozilla Firefox for example to check if your adblocker is the issue at all :)

It is not about whether I can analyse and check what websites are being blocked and then whitelist these permanently, its about other users in the home who are not that tech-savvy... and for the times that I am not available to do the same.

Hence, my request for a API call (I know that it exists, as the OPNsense API documentation does refer to adblocking... I just haven't been able to get my head around it to make it work !) - if anyone who understands API can help; then it would be much appreciated.

May I suggest considering to use AdGuard Home instead for DNS blocking? There are nice mobile apps that let you disable filtering with a single tap - for 1 minute, 5 minutes, 1 hour ... etc.

I have been using AGH for a long time, but was keen to start using Unbound and remove all (non-native components from OPNsense). hence, the query...

[Help needed....]

Help needed....

Does anyone know as to how to use the API to enable & disable Unbound Blocklists using an API?

I have Unbound setup with a few blocklists and combination of source nets; so most of the time Unbound Blocklists can keep running.

However, there are times when other family members use laptops/machines (that are a part of the blocklists) but just need Ad-Unblocking for a short duration. Expecting them to login into the GUI in OPNsense to disable this is a bridge too far.


Q: Is there a global API (or some mechanism without having to log into OPNsense GUI) to temporarily disable all blocklists and then enable them later.

Q: Is there a quick way to do this via a simple curl command that can execute a preformed API call?  I can then create a shortcut on these machines that can be used to turn on/off Unbound blocking.

I have tried reading into the API docs, but unable to figure it out...

If they are meant to cascade, is there a way to make the policies work like pf 'quick' rules, on first match?  Alternatively, can anyone think of a creative hack to make this scheme work as intended and still support dynamic prefixes? :)

I am looking for the same info.... It would be great if the Blocklists rules worked like firewall, the first match wins. Also would be great if dynamic prefixes could be used as source lists.

Thanks for the help, everyone.  I guess we'll wait and see....

I guess it may have been implemented in 26.1, I haven't had chance to read the changes notes (or install 26.1 yet), but I have an inclination, it has been included...

I have created a #5170 feature request on Github for the same.

I use Verizon 5G Home Internet and their XCI55AX cell router. My journey to OPNsense started when I decided I wanted to use Pi-hole but the XCI55AX router will not allow the end user to change the DNS settings, so what I must do is put their router in passthrough mode and use my own router instead.

If anyone has already done this, I would appreciate whatever you are willing to share regarding the appropriate configuration settings. I've gotten as far as installing OPNsense VM on my Proxmox installed mini-pc (a Beelink SER5 Ryzen 7 5825U) and poking around a bit to get oriented.

Any and all advice/pointers will be appreciated.

Install another VM on Proxmox, either Alpine Linux or Debian. Install PiHole in this VM. Make sure this VM gets assigned a static IP.
Now in OPNsense, assign the PiHole IP as your DNS.

This is good info.

I have been running OPNSense as a guest under Proxmox on a small server that has one other VM on it (basic linux install for pihole) but I have found that WireGuard requires WAY more CPU than I expected at gigabit speeds, so I am considering doing away with Proxmox, running OPN Sense bare metal, and moving the pihole VM into bhyve on OPNSense instead to make sure OPNSense can talk straight to the hardware and be more efficient.

In my config the one VM would not be externally exposed, but instead get its own entirely virtual local network on the LAN side of the OPNSense firewall, so I am not terribly concerned about security, but I'll port scan it from the WAN side just to make sure.

I probably won't get around to this right away, but when I do I'll definitely post back here.

Thanks for sharing.

I intend to run a similar setup (a PiHole running on Alpine Linux in a VM under bhyve).

Did you ever manage to get this setup working properly? Can you share your complete/ detailed instruction set.. would be much appreciated.

Thanks.