Topics

Hello,

Doing a fresh install of OPNsense on 26.1, having used v25 in the past. I noticed two things in the new "Firewall Rules [new]" that I believe are worth calling out for improvement.

• When creating a new rule, it's unclear if "Interface" is actually being parsed for the rule or if it's a display value to help with filtering. If it's a display, I'd expect it to say "(not parsed)" or similar in the help text, like the Description and other not parsed fields. If it is parsed, how is it different than the Source value? I checked the wiki, and this isn't called out clearly: https://docs.opnsense.org/manual/firewall.html#interface-filter. The wiki seems to describe interface filtering on the rules page, not in creating a new rule or the purpose of that value.
• Moving forward under the assumption it's a non-parsed value to be used for filtering, I set the "Invert Interface = true" and Interface = WAN. In Source, I selected all net except my "WAN net". I'm now creating a rule that should apply to all Interfaces except my WAN. However, when I go back to the Rules list and filter by interface, I can't find that rule under any category. It should appear under all interfaces except WAN, but instead, it's only available under "All rules". With anyfilter applied, it's missing.

Let me know if I'm wrong on the above please!

Have a good one!

[Track Interface Error]

Hello,

Version: 23.1.10_1-amd64

Symptom: After extended downtime, IPv6 broke completely. I disabled IPv6 and everything worked. I tried to re-enable IPv6 and OPNsense UI won't let me. DHCPv6 service permanently stoppped.

Details:
I previously had IPv6 working fine. I did some extended maintenance in my network and my modem was unplugged for hours. When everything was restarted, Comcast assigned me a new IPv4 IP, and I assume they assigned me a new IPv6 too, but can't confirm.

After getting everything powered up, IPv6 wouldn't work (ping, requests, everything timed out). I followed this guide to disable IPv6: https://www.thomas-krenn.com/en/wiki/OPNsense_disable_IPv6. Afterwards, everything worked! Great, so I'll just undo everything that I did - Wrong..

Under Interfaces: [LAN], I tried to set "IPv6 Configuration Type" to both "Track Interface" or Static IP (set to ::1/128).

• Track Interface Error: The DHCPv6 Server is active on this interface and it can be used only with a static IPv6 configuration. Please disable the DHCPv6 Server service on this interface first, then change the interface configuration.
• Static IPv6 Error: This IPv6 address is being used by another interface or VIP.

• The DHCPv6 service will no longer start at all.
• The radvd service won't start from GUI, but I can manually start it from CLI with "/usr/local/etc/rc.d/radvd onestart"
• I don't see any updates in /var/log/dhcp/latest.log when I try to start it. Maybe there's a different log for v6?
• Perhaps the loopback interface is claiming ::1/128? "ifconfig" shows for lo0: inet6 ::1 prefixlen 128

Thoughts on how I can undo what I did and re-enable IPv6? I've tried following https://homenetworkguy.com/how-to/configure-ipv6-opnsense-with-isp-such-as-comcast-xfinity/, but obviously fail when I get to setting the IPv6 Config Type.

Hello,

Running the latest 21.1.4. I'm currently logged in as root.

This morning I created a new user and assigned him to the admin group. I couldn't login as that user, so I gave him escalated rights by editing "Effective Privileges" under the user just to test. It seems as soon as I did this, the user became untouchable. I can no longer edit anything, including even adding a name or description.

I logged into the console and removed the user from admins group, but I assume OPNsense isn't reading the OS level groups? "pw groupmod admins -d <user>" and he's no longer an admins user, but the Web UI still shows him in the admins group.

The user has a certificate linked to him, but I can't remove it from certs page, and I can't edit the user to unlink it either.

When I go to the WebUI Groups, I have just the "admins" group, with 2 members (root and this user). I've rebooted, but no change.

I'm wary of messing around too much on the console side, as I don't want to remove him in the OS, but have config files or something that still reference him in OPNsense.

Thoughts on how to make this user editable again? I don't know his password, so I can't login as him to the WebUI or SSH.