Messages

I would suggest adding a new section to the OPNsense documentation under https://docs.opnsense.org/manual/how-tos/drop.html for the new default firewall rules.

The sections "Step 2 - Firewall Rules Inbound Traffic" and "Step 3 - Firewall Rules Outbound Traffic" currently do not appear to document the new rules that are now included by default (presumably since OPNsense 26.7).

In my case, I have configured it as follows using the new rules:

• Enabled: ✅
• Categories: Threat Intelligence
• Description: Block Spamhaus DROP
• Interface: LAN, WAN
• Quick: ✅
• Action: Block
• Direction: In
• Version: any
• Protocol: any
• Source: Spamhaus_DROPv4, Spamhaus_DROPv6
• Source Port: any
• Destination: any
• Destination port: any

I checked the logs again and saw that the IP lists are being updated:

Code Select Expand

2026-08-08T15:17:02 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v6.json took 0.04s
2026-08-08T15:17:02 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v6.json (bytes: 5915)
2026-08-08T15:07:04 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v4.json took 0.30s
2026-08-08T15:07:03 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v4.json (bytes: 102911)
2026-08-08T14:16:26 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v6.json took 0.03s
2026-08-08T14:16:26 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v6.json (bytes: 5915)
2026-08-08T14:06:57 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v4.json took 0.23s
2026-08-08T14:06:57 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v4.json (bytes: 102911)
However, under Firewall > Aliases, the 'Last updated' column isn't being updated, even though the logs show that the update should have worked.

Is this a bug, or am I misunderstanding something?

[WAN network]

Problem Description:
Internet connectivity works for all LAN clients when using the "Default allow LAN to any rule" in OPNsense.

However, I want to restrict LAN traffic so that clients can access only public Internet IPv4 addresses (e.g. Google) and cannot access the upstream/private networks or other internal VLANs.

I also suspect that the default LAN net → any rule allows LAN clients to access the other VLANs I have configured on OPNsense, which is not desired.

I want the LAN to have Internet access without granting unrestricted access to other internal networks/VLANs.

Expected Behavior:
LAN clients should be able to access all public Internet IPv4 addresses, including services such as Google, while being prevented from accessing private/internal IPv4 networks and other VLANs.

I would also prefer not to rely on multiple explicit block rules for private networks, as this was not necessary in my previous setup with Sophos UTM, where a single rule from LAN to an object like "Internet IPv4" was sufficient to achieve the same behavior.

Actual Behavior:
With the default:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: any
Destination Port: any

LAN clients have full internet access.

However, when changing the configuration to:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: WAN network
Destination Port: any

LAN clients no longer have internet access.

I suspect this is because the destination "WAN network" refers only to the directly connected 192.168.2.0/24 network rather than the public Internet.

Relevant System Information:

OPNsense 26.7.1

Network Topology:
├── Upstream Device: tp-link Archer MR200
│  └── IP: 192.168.2.1
├── OPNsense WAN Interface
│  ├── IP: 192.168.2.2/24 (Static)
│  └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
    └── IP: 192.168.10.1/24

Question:
What is the correct way to configure the OPNsense firewall so that:

• LAN clients can access all public IPv4 addresses on the Internet.
• LAN clients cannot access other private IPv4 networks (in my case VLANs) besides manually specified ones.
• Internet access does not depend on using Destination: any.

Would the recommended approach be to create explicit block rules for the private networks and other VLAN networks, followed by an allow rule for Internet traffic?

Or could Invert Destination be used to achieve this? I don't fully understand how this option works in this context.

For example, would setting:

Destination: WAN network
Invert Destination: enabled

effectively mean "allow traffic to any destination except the WAN network"?

Thank you for your reply.

I was able to resolve the issue by entering "cidr" as the "Path expression" value. Since the first update worked fine without this value, I assumed the update mechanism was already functional, but it seems that doesn't happen until the value to be updated is known.

Problem Description:
When creating a firewall alias on OPNsense 26.7.1 of type "URL Table in JSON format (IPs)," setting the "Refresh Frequency" to fractional values such as 0.5 or 0.01 hours has no observable effect. The alias table does not appear to refresh at the specified interval. It is unclear what the minimum supported value is for this field.

Expected Behavior
The alias table should be fetched and updated at the interval specified by the "Refresh Frequency" field, including fractional values expressed in hours (e.g., 0.5 hours = every 30 minutes, 0.01 hours = approximately every 36 seconds).

Actual Behavior

• With a Refresh Frequency of 0.5 hours: No refresh appears to occur at the expected 30-minute interval
• With a Refresh Frequency of 0.01 hours: No refresh appears to occur at the expected ~36-second interval
• Additionally, values with more than 2 decimal places (e.g., 0.001) are displayed as "0.00" after saving and reopening the alias configuration mask, suggesting the field is truncated or rounded to 2 decimal places on save

Reproduction Steps
Navigate to Firewall → Aliases in the OPNsense web interface
Click Add to create a new alias
Configure the alias with the following settings:

• Name: TestAlias
• Type: URL Table in JSON format (IPs)
• Content: https://www.spamhaus.org/drop/drop_v4.json
• Refresh Frequency (Hours): 0.5

Save and apply the alias
Wait beyond the expected refresh interval (30 minutes for 0.5 hours)
Observe that the alias contents have not been updated


Key Question
What is the smallest supported value for the "Refresh Frequency" field when using the "URL Table in JSON format (IPs)" alias type? Are fractional values below 1 hour actually processed by OPNsense, or is the effective minimum 1 hour? If fractional values are not honored, is there an alternative mechanism to achieve more frequent alias table refreshes (e.g., cron jobs or plugin-based solutions)?

Thank you both for your help :)

I was able to fix the problem with a Source NAT rule in hybrid mode, for which I used the following settings:

Interface: WAN
Version: IPv4
Protocol: any

Source Address: LAN network

Destination Address: any
Destination port: any

Translate Source IP: WAN address
Translate Source Port: any

I suspect I'll need to create a second rule for IPv6 here, since I can't select both in the same rule. Should I adjust the rule in any other way? I haven't worked much with NAT so far — usually just inbound NAT.

Out of curiosity, I used the wizard to reconfigure the WAN interface to use DHCP and connected the OPNsense to a different network. This network includes several other devices with static IP addresses, which have not experienced any problems so far. As usual, everything works fine when the WAN is set to DHCP. However, when I switched the WAN to static, I encountered the same problem.

As an additional test, I disabled the DoT entries in Unbound, checked the box to use the system nameservers and set them to 1.1.1.1 for testing purposes.

However, this did not resolve the issue. The problem described in the first post persists: OPNsense can access the internet, but the devices on the LAN cannot.

Thanks for the quick reply.

I see two gateways, one named WAN_GW, which is configured as the upstream gateway to IP address 192.168.2.1.

I had already checked that earlier but unfortunately forgot to mention it. I'll add that to the post above right away.

[DHCP]

Problem Description:
Internet connectivity fails for all LAN clients when the OPNsense WAN interface is configured with a static IPv4 address, despite working correctly when set to DHCP.

Expected Behavior:
LAN clients should have full internet access regardless of whether WAN uses DHCP or static IP configuration.

Actual Behavior:

• With WAN on DHCP: LAN clients can browse websites without issues
• With WAN on Static IPv4: LAN clients cannot load any websites (browser shows ERR_TIMED_OUT)

Reproduction Steps:
1. Perform fresh OPNsense 26.7.1 installation
2. Complete the OPNsense Setup Wizard with the following settings:

General Information

• Hostname: OPNsense
• Domain: internal
• Override DNS: ❌ disabled

DNS [Unbound]

• Enable Resolver: ✅
• Enable DNSSEC Support: ✅
• Harden DNSSEC data: ✅

Network [WAN]

• Type: Static
• IP Address: 192.168.2.2/24
• Gateway: 192.168.2.1
• Block RFC1918 Private Networks: ❌ disabled
• Block bogon networks: ✅ enabled

Network [LAN]

• IP Address: 192.168.10.1/24
• Configure DHCP server: ✅ enabled

Deployment type

• Automatic DHCP/DNS registration: ✅ enabled

Post-Wizard Changes

3. Configure Unbound DNS over TLS via Mullvad with the following forwarding servers:

| Server IP | Server Port | Description |
|-----------|-------------|-------------|
| 194.242.2.6 | 853 | Mullvad Family |
| 2a07:e340::6 | 853 | Mullvad Family |

4. From any LAN client, attempt to open a website or ping external addresses → ERR_TIMED_OUT

Relevant System Information:

Network Topology:
├── Upstream Device: tp-link Archer MR200
│  └── IP: 192.168.2.1
├── OPNsense WAN Interface
│  ├── IP: 192.168.2.2/24 (Static)
│  └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
    └── IP: 192.168.10.1/24

OPNsense Diagnostic Results:

• Ping to 192.168.2.1: SUCCESS
• Ping to 1.1.1.1: SUCCESS
• Ping to google.com: SUCCESS

LAN Client Diagnostics:

• Ping to 192.168.10.1: SUCCESS
• Ping to 1.1.1.1: TIME OUT
• Ping to google.com: TIME OUT
• Website access to google.com: ERR_TIMED_OUT

Error Messages:
Browser Error: ERR_TIMED_OUT

Ping Test Failure (LAN Clients): ping 1.1.1.1 → Request timed out

Note: OPNsense itself has full internet access and can reach external hosts. The problem exclusively affects traffic originating from LAN clients.

What I've Tried:
| Setting | Action Taken | Result |
|---------|--------------|--------|
| Source NAT | Changed from Automatic to Hybrid mode | No change |
| Routes | Verified default route exists (Flag UGS active) | Route confirmed correct |
| Interfaces | Switched WAN from Static to DHCP | ✅ Problem resolved - internet access restored fo rall LAN clients |
| Gateways | Verified WAN Gateway (192.168.2.1) is set as upstream gateway | Confirmed correct |

Off-topic: Manually converting this text, which was originally written in Markdown, was quite a hassle. Are there any better tools I could use for this?