Messages

Hello OPNsense Team,

I migrated my IPsec tunnels and the firewall rules in new methods and currently I have OPNsense version 26.1.11_10. I was using the legacy IPsec implementation, but I have now migrated to the new IPsec connections.

The migration was successful, and all of my IPsec tunnels are working correctly. However, I have a question regarding firewall rules.

I understand that for Phase 2, I can create firewall rules on the automatically created IPsec virtual interface, and those rules are working as expected. What confuses me is Phase 1. I have searched throughout the OPNsense interface but could not find any firewall rule or setting specifically related to Phase 1.

Since the tunnels establish successfully and traffic is passing normally, I am wondering:

Are there no firewall rules required for IPsec Phase 1 in the new IPsec implementation?
If so, how is IKE (Phase 1) traffic being handled internally?
Is there a dedicated location where Phase 1 rules are managed, or is this behavior expected?

I would appreciate it if someone could clarify how Phase 1 traffic is handled in the new IPsec connections implementation.

Thank you!

I have OPNsense version 26.1.X. I found that when I create a Destination NAT, the Associated rule is created in both the legacy and new rule layouts. Which rule will be used/works?

Hello Franco,

As you mentioned that you(OPNsense Team) are aware of this problem, I trust that it will be addressed in future releases.

Thank you for your assistance.

Hello OPNsense Team,

I recently checked the NTP status under Services > Network Time > Status and noticed that the configured NTP pools are showing as unreachable/pending. I have attached a screenshot of the status page for your reference. Could you please help me identify the issue and guide me on how to resolve it?

Hello OPNsense Team,

I would like to use the Unbound DNS blocklist functionality. My requirement is to block all DNS traffic by default, and then allow only specific domains/sites by adding them to a whitelist so they can pass through the OPNsense firewall. Could you please guide me on how to achieve this setup using Unbound DNS blocklist?

Thanks & Regards
Shivang Pithadiya

Hello OPNsense Team,

The initial issue has been resolved, thank you. However, I am now facing a new problem.

I have removed all entries from the blocklist and also disabled the blocklist feature under Services > Unbound DNS > Blocklist. Despite this, the previously blocked domain is still inaccessible.

Could you please help me understand why the domain remains blocked even after disabling the blocklist and removing all entries?

Looking forward to your guidance.

Best regards,
Shivang Pithadiya

Hello OPNsense Team,

I've OPNsense version 25.1.12

I am new to OPNsense and would like to block certain websites using UnboundDNS. As a test, I added the domain duckduckgo.com under Services > Unbound DNS > Blocklist (screenshot attached). However, the domain is still accessible and not being blocked.

Could you please guide me on the correct steps to configure domain blocking through UnboundDNS so that I can successfully apply it in my environment?

Thank you for your support.

Best regards,
Shivang Pithadiya

Hello Patrick M. Hausen

Thank you for your valuable reply

so that means that is not possible if i made some changes in primary firewall like ubound DNS service or anything else that not reflect automatically in secondary firewall?

i need to use cron if i want frequently sync right?

Hello OPNsense Team,

I have configured two OPNsense firewalls in a high availability (HA) setup — one as the primary and the other as the secondary. The HA setup appears to be working correctly.

However, I noticed that configuration changes made on the primary firewall (e.g., changes to services or settings) are not automatically syncing to the secondary firewall. The synchronization only occurs when I manually click the "Synchronize config to backup" button under System > High Availability > Status.

I would like the configuration to sync automatically without requiring manual intervention. Could you please guide me on how to enable automatic synchronization?

My current OPNsense version is 24.7.12.

Thank you