Messages

I wanted to raise awareness about a potential issue with the Abuse.ch ThreatFox IOC Unbound DNS blocklist, which is currently referenced in OPNsense.

Current configuration: The Unbound blocklists.conf points to this URL:
https://threatfox.abuse.ch/downloads/hostfile

The issue: Visiting threatfox.abuse.ch/export reveals that Abuse.ch now requires users to register and obtain an Auth-Key before being able to download the host file (domains-only version). This represents a change in how their feeds are distributed.

Timeline: Based on the Internet Archive, this change appears to have occurred sometime between January and February 2026. You can verify this here: https://web.archive.org/web/20260107104855/https://threatfox.abuse.ch/export/

Impact & Next Steps: This change means that automated OPNsense blocklist updates may soon fail. It would be helpful to know if the maintainers are aware of this and if they are planning to transition to authenticated access.

If anyone has any additional information that I might have missed, please share it 🙂

I noticed that the link to the Suricata documentation under "Choosing an Interface" is outdated.

It would be beneficial to implement an automated process that ensures the link always reflects the current version used in OPNsense. This would prevent future linking issues and maintain consistent documentation.

Reference: https://docs.opnsense.org/manual/ips.html#:~:text=better%20in%20doing-,that,-)%2C%20a%20small%20example

As a test, I enabled the Statistics option for a URL table alias that has a blocking rule set for outbound traffic.

So I simply pinged one of these blocked addresses, which was blocked as shown in Firewall Live View.
However, when I go to Firewall --> Diagnostics --> Aliases, neither the packet nor the byte counters for that address have increased.

IP address range from alias: 1.10.16.0/20
IP address pinged: 1.10.16.1

So, what could the Statistics option be useful for? I asked AI about it, and now I think I understand that the counters simply keep track of how many times packets were passed or blocked using the alias where the Statistics option is enabled.

Do you perhaps have a correction or a better explanation for this?

I noticed an inconsistency between the documentation (https://docs.opnsense.org/manual/interfaces_settings.html#allow-ipv6) and the current GUI. In OPNsense 26.7, the checkbox now reads "Turn off IPv6" instead of "Allow IPv6," which flips the function of the checkbox. I'm not sure in which version this change was made; it could have been before 26.7.

Suggestion: Update the documentation to reflect the new wording.

Hey MeyerGru,

Thanks for your answer 🙂

It bothered me because I read somewhere that you would have to manually set an update task as a cron job, but I couldn't find any more information about that. On top of that, I wanted to know if there's a way to get more control over the GeoIP updates, but I guess this isn't possible for now.

Would it make sense to perhaps add a note to the documentation stating that the GeoIP data is automatically updated approximately every 24 hours?

Unfortunately, I haven't found an answer to my question yet, even though I've looked over the source code again. Of course, I hope that the update occurs automatically at least every 24 hours, or that there is a mechanism that automatically detects when the GeoIP data has been updated and then triggers an update without further delay.

I'm using a GeoIP alias that gets used in firewall rules to only allow traffic to some countries (whitelist principle).

What does the 'Statistics' option, which has the description 'Maintain a set of counters for each table entry', actually do? Which counters is it referencing?

I can't see any change in Diagnostics > Aliases when I activate this option for an alias.
The following is the only documentation I could find about it: https://docs.opnsense.org/manual/diagnostics_firewall.html#aliases

How are updates for the GeoIP data currently retrieved? Is this a time-based process, or is it controlled by some other trigger?
I've already tried checking the source code, but I didn't really find what I was looking for.

The documentation also doesn't provide any information on this yet: https://docs.opnsense.org/manual/aliases.html#geoip

Could we perhaps add a description of how this update process works to the documentation if we find an answer here?

Hey everyone!

First of all, thanks for the reply, @viragomann. I'll try to put your advice into practice as soon as I have some free time.

I'd like to clarify that my posts are not LLM-generated content. I wrote the text myself, though it took a little less effort as I'd already asked a similar question before. Writing such long texts is not really fun, especially since it takes a tremendous amount of effort 😐
In my first forum post, I added the following comment. I don't think an LLM would ask about more efficient formatting methods though 😆:

Off-topic: Manually converting this text, which was originally written in Markdown, was quite a hassle. Are there any better tools I could use for this?

I adopted this writing style when I became active on the Ubuntu Community Hub, where a similar format was specified.
In my view, this style has the advantage of providing the full range of information right away, reducing the need for follow-up questions. In addition, this makes it easier for other people who might come across this post in the future to understand the circumstances under which this question arose.

Before posting texts like this, I consult LLMs, but at the time of writing, they were unable to provide a reliable answer. As I couldn't find any similar questions on the forum either, I decided to post this one. I prefer to exchange ideas with people rather than LLMs, which can only draw on existing knowledge and may generate corresponding hallucinations.

Greetings
A human living on planet Earth 🙃

I would suggest adding a new section to the OPNsense documentation under https://docs.opnsense.org/manual/how-tos/drop.html for the new default firewall rules.

The sections "Step 2 - Firewall Rules Inbound Traffic" and "Step 3 - Firewall Rules Outbound Traffic" currently do not appear to document the new rules that are now included by default (presumably since OPNsense 26.7).

In my case, I have configured it as follows using the new rules:

• Enabled: ✅
• Categories: Threat Intelligence
• Description: Block Spamhaus DROP
• Interface: LAN, WAN
• Quick: ✅
• Action: Block
• Direction: In
• Version: any
• Protocol: any
• Source: Spamhaus_DROPv4, Spamhaus_DROPv6
• Source Port: any
• Destination: any
• Destination port: any

I checked the logs again and saw that the IP lists are being updated:

Code Select Expand

2026-08-08T15:17:02 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v6.json took 0.04s
2026-08-08T15:17:02 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v6.json (bytes: 5915)
2026-08-08T15:07:04 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v4.json took 0.30s
2026-08-08T15:07:03 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v4.json (bytes: 102911)
2026-08-08T14:16:26 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v6.json took 0.03s
2026-08-08T14:16:26 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v6.json (bytes: 5915)
2026-08-08T14:06:57 Notice firewall processing alias url https://www.spamhaus.org/drop/drop_v4.json took 0.23s
2026-08-08T14:06:57 Notice firewall fetch alias url https://www.spamhaus.org/drop/drop_v4.json (bytes: 102911)
However, under Firewall > Aliases, the 'Last updated' column isn't being updated, even though the logs show that the update should have worked.

Is this a bug, or am I misunderstanding something?

[WAN network]

Problem Description:
Internet connectivity works for all LAN clients when using the "Default allow LAN to any rule" in OPNsense.

However, I want to restrict LAN traffic so that clients can access only public Internet IPv4 addresses (e.g. Google) and cannot access the upstream/private networks or other internal VLANs.

I also suspect that the default LAN net → any rule allows LAN clients to access the other VLANs I have configured on OPNsense, which is not desired.

I want the LAN to have Internet access without granting unrestricted access to other internal networks/VLANs.

Expected Behavior:
LAN clients should be able to access all public Internet IPv4 addresses, including services such as Google, while being prevented from accessing private/internal IPv4 networks and other VLANs.

I would also prefer not to rely on multiple explicit block rules for private networks, as this was not necessary in my previous setup with Sophos UTM, where a single rule from LAN to an object like "Internet IPv4" was sufficient to achieve the same behavior.

Actual Behavior:
With the default:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: any
Destination Port: any

LAN clients have full internet access.

However, when changing the configuration to:

Interface: LAN
Action: Pass
Direction: In
Version: IPv4
Protocol: any
Source: LAN network
Source Port: any
Destination: WAN network
Destination Port: any

LAN clients no longer have internet access.

I suspect this is because the destination "WAN network" refers only to the directly connected 192.168.2.0/24 network rather than the public Internet.

Relevant System Information:

OPNsense 26.7.1

Network Topology:
├── Upstream Device: tp-link Archer MR200
│  └── IP: 192.168.2.1
├── OPNsense WAN Interface
│  ├── IP: 192.168.2.2/24 (Static)
│  └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
    └── IP: 192.168.10.1/24

Question:
What is the correct way to configure the OPNsense firewall so that:

• LAN clients can access all public IPv4 addresses on the Internet.
• LAN clients cannot access other private IPv4 networks (in my case VLANs) besides manually specified ones.
• Internet access does not depend on using Destination: any.

Would the recommended approach be to create explicit block rules for the private networks and other VLAN networks, followed by an allow rule for Internet traffic?

Or could Invert Destination be used to achieve this? I don't fully understand how this option works in this context.

For example, would setting:

Destination: WAN network
Invert Destination: enabled

effectively mean "allow traffic to any destination except the WAN network"?

Thank you for your reply.

I was able to resolve the issue by entering "cidr" as the "Path expression" value. Since the first update worked fine without this value, I assumed the update mechanism was already functional, but it seems that doesn't happen until the value to be updated is known.