Topics

In the Migration notes, known issues and limitations section was stated:

"Hyper-V guests may be producing panics on certain hosts with more than one virtual processor assigned.  Make sure to snapshot beforehand and stay on 26.1.x until the situation is clear."

In the release notes of newer versions, I see no link to this problem.

Is this problem resolved?

It started around februari 2025, suddenly, after a reboot of the firewall the NAT rules did not work anymore.
All rules have the logging on, but when I check in the live log, I don't even see any incoming connection, not accepted and not denied.
Other connections work as they should, only NAT doesn't work.

I checked, checked and checked again, removed contraints, recreated the rules, no avail.

But then: after about 4 hours (after the reboot) everything suddenly starts to work again.
Without me doing anything ....

And this is at EVERY reboot of the opnsense firewall.

Somebody? Any suggestions?

I am trying to MAP port 53 and some other ports, only from a specific source, and map it to a specific machine in the LAN.

All other ports work, but for 53, I don't even see the connections in the in the logs.
So, I don't see it even blocked.

Is this something from within OpnSense, or do I have to contact my Internet provider to ask him to open port 53?
Because, as far as I know, all ports should be open ...

I have a few own blacklists, hosted on my own website.
This website is placed behind the OpnSense NGINX plugin.

When I create an alias IP table (on another firewall) with this (https or http, both the same) url, it won't load any ip.
When I create a portmapping on port 81 from the WAN to the website on port 80, bypassing NGINX, everything works as expected.

So it looks like the iptables and NGINX won't play together.

Is there a way to export the certificates from the Acme client?
And if so, can this be done by an API call?

I have 3 OpnSense firewalls running - all on 23.7.5, all as virtual machine in Hyper-V 2019 DC.

This morning one of them suddenly stopped working correctly; there is no internet access anymore from any LAN segment. The live view is not displaying any activity anymore, but strange, all VPN's work flawlessly.

As this physical server (the one where OpnSense is not working anymore) is the only one that got the Windows Updates yesterday, I am in the process of uninstalling these updates now.
I hope this solves the problem, I will share the results.

Is there an https API available for OpnSense?
If so, where can I find the docs?

Specific function I need is to get the backup file.
Reason for this is to automate the configuration backups and to implement an automatic work around for the missing Incoming SNAT.

In the NAT rules, the Outbound Rules and in the Rules (advanced), there are 2 specific fields:
- Set Local Tag
- Match Local Tag

I searched the docs and found almost nothing about this.
The only thing I found is:
Set local tag - Set a tag that other NAT rules and filters can check for.
Match local tag - Check for a tag set by another rule.

I read the ebook, and it's not in it.

Can anyone give me a (real life?) example of how to use these fields?

I use OpnSense now for three months, and generally speaking I am very content with this firewall.
I come from Kerio, which I used for about 25 years.

If I look at the things I encountered, two points need improvement in OpnSense.

1. The Aliases. It works very well , but documentation of a Hosts alias is almost not possible (yes, I know, make an alias for each IP and then one hosts alias - but sorry, too much work and absolutely not workable as the amount of aliasses explodes. I use now URL Table (IPS) as a work around for this problem ....

2. The outbound. As the name says: it won't work for inbound. This really costs me a lot of headaches as a lot of rules I had in Kerio were impossible to implement on OpnSense, because it can not change the source IP for an inbound rule. I finally worked around this by setting up a Windows machine. I do the port forwarding to this machine and in this machine I do the address translation and reroute to the real destination using "netsh interface portproxy". It works like a charm, but it makes things less transparent and shouldn't be neccerary,

Other than those 2 problems, I think you make a really great product.

EDIT, number 3:
Firewall broke for unknown reasons, leaving all LAN segments isolated from the Internet.
The only thing that helped was restoring the Virtual Harddisk from a backup of 4 days ago. I did not restore the virtual hardware, what means that the problem was on the disk.
I never had to restore a firewall before in 25 years, so this sounds like instability in OpnSense.

Edit: restoring the second firewall with the same problem 8 hours later ...

[IP -> WanIP]

I have the following situation:

An Ip (from the internet) connects to the firewall.
IP -> WanIP

This IP is in a specific alias, and therefor a NAT rule is executed, changing it in:
IP -> DestIp

DestIp is located on another server, what means that the traffic is routed through an IPSec tunnel
IP -> IPSecAdapter -> Dest IP

On the other server, I see the traffic coming in:
IPSecAdapter -> DestIP

So far, so good.
But now the way back.

For the destination server, the connection comes from IP, and IP is on the internet.
This means that the routing goes to the WAn op the second server and all replies to IP get lost into the void.

To solve this, I need an Outbound NAT on the same traffic as the PortForward is executed on, changing the traffic flow in:

NATIP -> IPSecAdapter -> Dest IP

But whatever I do, the outbound rule won't execute on the traffic.
I can execute it on the IPSec adapter, but when I do that, no traffic reaches the other server anymore.

How can I solve this?

I have a network adapter for the local network 10.10.20.0/24

Then I add a disabled route: 10.10.20.0/24 -> MyGw
Save - Apply

And then 10.10.20.0/24 is not reachable anymore.

Remove the route - still not reachable

Go to Interfaces, open the interface, press Save and then Apply - and the subnet is reachable again.


As for my understanding - a disabled route should have no effect at all, or am I wrong about that?

I use the new instances for OpenVPN, and it works like a chrm, except for one thing.
As soon as I choose a Certificate Revocation List, no client is able to connect anymore.

[Step 1 - works]

Step 1 - works
I have created a NAT rule on Adapter LAN: from LAN -> destination: myIP -> Redirect target: AnotherIP.

In the logs, I see:
LAN -> myIP Pass
WAN -> myIP Pass
WAN -> AnotherIP Pass

This works 100% as expected, so far, so good.
---------------------------------------------------------------------------------------------------------------

The step 2 - does not work
I have an OpenVPN Server, with a client attached.
The VPN server has the LAN and the network of myIP as local network (LAN is reachable).

I create a new NAT rule on adapter OpenVPN: from OpenVPN -> destination: myIP -> Redirect target: Another IP

In the logs, I see:
LAN -> myIP Pass
WAN -> myIP Pass

The last line (the NAT, WAN -> AnotherIP Pass) is missing what means that the NAT is not performed.

Is there a way to apply a NAT rule on an OpenVPN adapter?

Hello all, this is my first post on this forum.
I am new to OpnSense, worked with Kerio Control for the last 25 years, but as this product starts to be outdates, I am in the process of migrating to OpnSense. And the migration goes well, about 98% of the  previous setup has been migrated.

But now I am stuck at IP mapping - I can't get it to work.

To explain:
In Kerio, I defined the source (192.168.81.0/24) - this is a local subnet.
Then I defined the destination (192.168.80.60/32) - this host is located at the customers office, so a remote host.
After that I defined the services (any)
And last I defined the MAP (a.b.c.d) - this is the router address of the cuistomers office.

The effect of the above was that, when I accessed 192.168.80.60 from the 192.168.81.0/24 subnet, the IP was translated and the traffic was diverted to the customers router - there, a  virtual server configuration made sure that I reached the real 192.168.80.60 machine.

I try to replicate this in OpnSense, but till now without success.

What I did:
I went to Firewall - NAT - Outbound
added a new rule:

interface WAN
TCPIP v4
Protocol any
Source Address 192.168.81.0/24
Sourceport any
Destination Address 192.168.80.60
Destinationport any
Translation target a.b.c.d
Translation port <empty>

But it just won't work.

What am I missing?