Messages

Try:
https://docs.opnsense.org/manual/how-tos/ips-bypass.html

I just create an instance for surfshark using wireguard, same setup for it.

Create instance and peer (from manual setup file),
Create interface,
Create Source NAT,
Create Gateway, 10.14.0.1

Added in my vpn group as tear1 for test - working well.

The 300s timeout is Postfix's `milter_content_timeout` default, so the chain you describe is plausible — but IPv6 loopback isn't inherently slow, so something is dropping the traffic. Could you check a few things?

1. Is Redis actually listening on `::1`? `sockstat -6 | grep 6379` — and what does `bind` say in your redis.conf?
2. If it isn't listening there, you'd expect an instant connection refused rather than a delay. A delay that grows on retries (roughly 1s, 3s, 7s) is the signature of SYN packets being silently dropped.
3. Do you have any rule blocking IPv6, or any floating rule that isn't scoped away from `lo0`? Try `pfctl -s rules | grep lo0`, and enable logging on your block rules to see whether loopback IPv6 is being dropped.
4. What does `redis-cli -h ::1 -p 6379 --latency` show versus the same on 127.0.0.1?

As a workaround you can pin rspamd to IPv4 with `servers = "127.0.0.1:6379";` in `/usr/local/etc/rspamd/local.d/redis.conf` — there's no GUI option for it. But that's masking the symptom; the firewall rule is worth finding.

https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/

Here, 4 days:

86. opnsense.emergingthreats.net. 

366 (0.13%)

Done:

Code Select Expand

--<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
--
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] WARNING: sysctl vfs.zfs.arc_max is deprecated. Use vfs.zfs.arc.max instead.
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>


I fixed this error editing three firewall rules in my case, while rc1,2 qas released.

In advanced, uncheck:
[ ] Disable reply-to

updated;

The token used before was valid only for the first domain, invalid for the current new account.

A new Cloudflare token fixed the updated.

Hi, all.

I'm trying to add a dyn dns, and an error breaks the update.

On the Dynamic DNS service, after to clone the last created account - 3rd to 4th, a Cloudflare DNS - the log returns:

Code Select Expand

2026-02-20T00:44:39-03:00
Error
ddclient
Account xxxxxxxxxxxx [cloudflare - cloudflare-dns-xxxxx] raised fatal error (list index out of range)

Until the 3rd account it was working, after the clone with a new host values, it failed.

Should I open a bug?
plugin: os-ddclient, 1.30

Thanks for this great Firewall.

Thanks, PS5 unlocked.

IF: WAN
Source: Consoles (alias)
Port: *
Dest: *
Port: *
NAT: WAN_address
Static Port: yes!

Hi.
(Following this thread), to fix this here I reconfigured:

On Master:
- System > High Availability > Settings = Synchronize Config = 10.0.0.2:443  # added the :443, 10.0.0.2 = backup
- System > Settings > Administration = Listen Interfaces: All (recommended)

On Backup:
- System > Settings > Administration = Listen Interfaces: All (recommended)