Messages

You will of course need a firewall rule on lan2, similar to the main LAN. Per default all traffic is blocked.

I usually clone the main LAN rule, edit the clone and change the interface to the new network (lan2 in your case).

I added 77.**.**.49 as a Gatewa

You set that gateway in the WAN interface settings, in the field "IPv4 gateway rules"? If yes, then I don't know, works for me.

ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28

If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.

Zenarmor is not yet ready for 26.7, read official statement here https://forum.opnsense.org/index.php?topic=52376.0, and more about in the Zenarmor category.

Are you sure the OPNsense forum is the ideal place to ask that question? I for one have never setup Wireguard using NetworkManager, only using wg-quick.

Best to ask in either the forum of the Linux distribution you are using or NetworkManager forum.

Now I have to find why my Asus router dont get enternet from port 3, whereas PC getting enternet thru port 2.

Is the Asus AP on port 3 on it's own network or on the same LAN the PC? If on the same LAN as the PC, did you createa bridge in OPNsense?

Protocol tcp
Port range : 80 to 443

You set that for the destination port range, not the source. But as @viragomann writes, better to create an alias and use that. Or allow all access to destination 'This Firewall', not sure you want to be restricted in an case of emergency.

Did any interfaces change between the backup and when you restored it? Did you reboot after the restore?

Thanks for trying to help, seriously!
But in this case, I fear it's pointless.

Ok, noted :)

can you give me the exact link to the fetch -o .... for the 25.7.....

To get the fingerprint, does the Github link he posted not help you? There yout get the exact URL to the file. Or the help text on https://opnsense-update.walker.earth and adapt it for 25.7 with the file name visible in the GH link? Like this:

# fetch -o /usr/local/etc/pkg/fingerprints/OPNsense/trusted https://github.com/maurice-w/opnsense-core/blob/stable/25.7/src/etc/pkg/fingerprints/OPNsense/trusted/opnsense-update.walker.earth.20250717

The rest is simply using vi. For example pressing "i" for "insert" mode and making my changes.

Oh, I see, I misunderstood. I thought you are talking about vi mode of the shell, like with bash you can set vi mode and that let you work with the command line and history with vi keys.

Not sure about Ctrl^A, you press them all together? What is it supposed to do; in control mode jump to the beginning of the line (to the left) and change to insert mode?

How are you getting a vi mode? The shell used on OPNsense is not bash or ksh or sh, at least it doesn't understand 'set -o vi'.

Just to confirm, that lo0 has netmask of 0x0 on my RC2, too. A fresh installed VM with FreeBSD 15.1 doas have the regular netmask of 0xff000000. It's already fixed, thanks @franco

Well that's the kicker: not everyone will have migrated to the new rules before upgrading to 26.7 and not everyone will have Automatic in SNAT.

You are right, yes. But as long as I can't show steps on how to reproduce it, the devs won't be able to fix it.

I did read through your post but I didn't take the time to build a system with a WG tunnel. In your case it could be NAT or something else.
What outgoing NAT rules did you create? For what you wrote it seems that all necessary rules should have been automatic rule, no?

he SNAT automatic issue should be fixed via

# opnsense-patch https://github.com/opnsense/core/commit/aa2a54a5a8

Works like a charm now, excellent and thank you.