Topics

Idiotic UX UI failure, why can't I rename my gateway?  What a complete waste of time, thanks for forcing me to delete all kinds of work just to appease a stupid name change

Hi there, I have my cellphone assigned to 192.168.1.6 and it normally works fine

To my shock today I plugged in a new device for the first time, an Android TV device which uses DHCP as anything else to get an IP, and it apparently was given 192.168.1.6 as an IP address even though it's MAC address is completely unique and not even remotely similar by a single digit.

What is going on here? thanks!

Dunno what Unbound's problem is, I have a fairly straightforward setup

In Services > Unbound > Query Forwarding, I have 192.168.1.24 port 5353 enabled which is my DNS resolver.

Randomly today I could not get onto aliexpress.com, my browser said it couldn't resolve the address.  I opened my terminal, and 'nslookup' also failed with SERVFAIL.  However I then typed dig address.com @192.168.1.24 -p5353 and it worked INSTANTLY. 

Tried dig @192.168.1.1 and it failed.

Where is the massive desynchronization going on here?  Why is OPNsense and Unbound reporting SERVFAIL when it very clearly is working just fine via dig?

Why not?

Terrible design choice, what do you expect people to do, constantly be deleting and recreating their gateways as needed?

I have to constantly re-do and update the gateways as I change tunnel endpoints, there's no reason I should not have permission when I am root

Hello, novice user here, using Bell Fiber internet in Canada.  I use OPNsense of course, completely up to date, and have think I've narrowed down my Dynamic DNS updating woes to the fact OPNsense is detecting the wrong IP address as my WAN IP!

What I mean is this

You cannot view this attachment.

If you see here, the IP is being reported as a 142.x.x.x address, which is being passed on to my Dynamic DNS client, and is unconnectable.
But when I open a terminal and do a 'curl ipinfo.io' for example, it displays my true IP which is a 78.x.x.x IP address

So I guess my question is, why?  And how do I fix it?

I need to pass on the 78.x.x.x IP to the Dynamic DNS updater, and simply choosing WAN isn't working

Thanks so much!

Hi there

OPNsense 25.1-amd64
FreeBSD 14.2-RELEASE
OpenSSL 3.0.15

Every day, several times a day, I have to re-enter my login credentials to OPNsense (192.168.1.1).  It absolutely refuses to keep me logged in and I'm not sure how to change this as it's persisted across both Brave and Edge now!

Furthermore it always flips back to 7 rows in the view and I need it to stay on ALL!  So I can see more than 7 small results at a time!

Thanks so much for any help

Hi there

OPNsense 24.7.12_4-amd64
FreeBSD 14.1-RELEASE-p6
OpenSSL 3.0.15

Every time I go into Aliases or tunnels or anything at all really, OPNsense is defaulting to a piddly 7 results at a time. 

I have to stop what I'm doing and go into the top right corner and change the 7 to "ALL" which wouldn't be so bad if it remembered, but it doesn't remember :(

I followed the guide in the OPNsense documents for Selective Routing to External VPN.  The tunnel is up with no problems, and connectivity works, yet my dashboard is showing the Gateway is offline, and in the interfaces, appears red with 100% packet loss:

You cannot view this attachment.

And to make things even more ridiculous, the gateway address listed IS pingable!  From right within the tunnel itself!  It's just OPNsense having problems for some reason?

And I obtained the gateway the exact way the guide says -- I connected the tunnel, did a traceroute, and that IP is the first hop after 10.2.0.1

Thanks kindly for any help!

I am in absolute hell right now.

Tried following the WireGuard Selective Routing to External VPN Endpoint tutorials and now I notice in the dashboard the wheel is filled up with state violations.  When I click the pie chart, it shows non-stop scrolling of state violation rules

I am in literal hell right now, and all I wanted to do was connect to my VPN's with OPNsense.

I hate this so much.  The guide I followed doesn't seem to work either, my DNS is leaking

Hi there, I have been following the WireGuard Selective Routing to External VPN Endpoint guide and inevitably have DNS leaks now at the end of it, even when clients are successfully using the VPN, it fails all the DNS leak tests online which expose my home IP, and will be totally useless as a result

I run Unbound and it has all the ad-blocking stuff enabled so I am hoping to continue using it, only maybe make the DNS queries go over VPN instead of WAN?

The information at the very bottom of the guide is extremely confusing and jumbled up all over the place.  I don't want to stop using my local Unbound and switch to the VPN's DNS server..  I don't want to lose local network name resolution either, as I use that as well.

So I don't understand what to do.  The information at the bottom of this guide "Dealing with DNS leaks" is a bunch of vague theories with no information on how to actually accomplish anything..  as a novice user who depends on step by step guides to even get this far, it leaves me super confused and not knowing what to do

- My OPNsense installation is 192.168.1.1
- It's running Unbound+Ad Blocking for my home network
- It is using KEA DHCP reservations to assign hostnames to my local clients, and provide DHCP leases to clients which gives them 192.168.1.1 to use as DNS server
- I have ProtonVPN WireGuard endpoint created and can assign hosts to it through the alias, but the DNS leaks and exposes my home IP
- I don't want to change to an external DNS server nor lose local network hostname resolution

I want my browsing IP to show as the VPN, but also the DNS Leak Test address to show the VPN IP as well.  I still retain using Unbound with ad-blocking for client DNS queries.  Local hostnames are still resolvable

I have asked Google Gemini for some help because I can't really make sense of it all but I'd rather actually get the correct answers here and am willing to donate again once I get this fixed, as it's sort of holding up my entire network setup at the moment

Thanks again in advance for any help, I can provide any additional required details!

Hi there!

I reinstalled OPNsense yesterday and this time used the new KEA instead of ISC, and I can no longer connect to important devices on my network such as 'homeassistant' nor 'proxmox' by hostname which used to work just fine.  I now have to literally type in 192.168.1.x instead

```
Microsoft Windows [Version 10.0.22631.4602]
(c) Microsoft Corporation. All rights reserved.

C:\Users\ice>ping homeassistant
Ping request could not find host homeassistant. Please check the name and try again.

C:\Users\ice>ping homeassistant.
Ping request could not find host homeassistant.. Please check the name and try again.

C:\Users\ice>ping homeassistant.home
Ping request could not find host homeassistant.home. Please check the name and try again.

C:\Users\ice>ping homeassistant.local
Ping request could not find host homeassistant.local. Please check the name and try again.
```

I already have it's entry added under RESERVATIONS in KEA and it picks up it's static IP with no problems, but it refuses to reply by hostname, neither via ping or telnet nor via web browser

thanks for any advice!

Hello, the guide here https://wiki.opnsense.org/manual/how-tos/wireguard-selective-routing.html is really terrible

It completely omits the fact that your downloaded config file from the VPN provider only provides 2 keys, when the whole process requires 4 keys?

Inside the Wireguard -> Peers place, it asks for a Public and Private key

And then inside Instances, it asks the same

Yet my config file only contains 2 keys?

[Interface]
PrivateKey = xxx
Address = 10.0.110.118/32, 2a0e:1c80:1337:1:10:0:110:118/128
DNS = 10.0.0.1, 2a0e:1c80:1337:1:10:0:0:1, 91.231.153.2

[Peer]
PublicKey = yyy
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ca-tor.azirevpn.net:51820

So what gives?

Where do I insert [Peer] PublicKey and where do I insert [Interface] PrivateKey ?

I've tried a bunch of combinations so far and I can't get the handshake

Why does the HOWTO completely omit the fact there's 4 fields required when the config only provides two?

You should be instructing people which key goes where.  This is ridiculous.

I don't understand the logic here

You go to the console, perform a factory reset

The device reboots, and all the garbage is reloaded that defeats the purpose of performing the factory reset

For the love of God, can you just simply make a proper factory reset for heavens sake?

I want EVERYTHING gone when I perform a reset, I don't want it recalling a bunch of plugins that lead me to perform the reset in the first place

Hi there, may I please refer you to this guide I have followed in the official documentation:
https://docs.opnsense.org/manual/how-tos/shaper_limit_per_user.html

I created the Pipes as per the instructions, as well as the Rules, as attached in the screenshots.

Documentation says

Note

If you want to limit traffic for a specific IP addresses then just enter the IP addresses in the destination field instead of the full LAN network range.

Which is precisely what I am looking to do, so I entered in the devices IP address as shown 192.168.1.11

Pressed apply on everything, thought I followed the instructions, yet 192.168.1.11 is still downloading at full speed

What went wrong?

Is the guide out of date?

Thanks kindly for any guidance

https://pastebin.com/uqG39eX7

I'm just a novice user, no clue what to do here

It's complaining about something called hass.inc and is crashing literally 5000 times a minute by the look of it?

HASS is a homeassistant plugin which I didn't even remember installing onto OPNsense, but how do I remove HASS?

Hello there, I am trying to learn how to block individual IP addresses and it isn't working for me.  I want to block any DNS servers my Amazon Fire Tablet is using to sneak past my Pi-hole, starting with 8.8.8.8 as a test run.  But it's not working.

I created an Alias, and inserted 8.8.8.8 as the content (reduced this to just 1 IP after noticing my entire list did not work either)

Then, I went to Rules -> Floating and thought I did everything right?  Picture is attached for all settings.

It does not work.  8.8.8.8 is fully reachable, pingable, everything, even after hitting apply.  Why?  And needless to say ads are getting through via 8.8.8.8 which Fire Tablets add as a forced 3rd DNS server

Pics attached of both Alias and Rule

Thanks for any help

I tried changing to Host(s) instead of URL(IPs) with no change, still lets it through

I am still using the default theme

It's very white!

Hello there, I followed both the instructions to set up incoming WireGuard connections while I am not at home (Road Warrior howto) and the WireGuard Selective Routing howto to connect to my ProtonVPN accounts and then add clients under Aliases to have their traffic go through it, and both seem to be working successfully - except I cannot figure out how to make my WireGuard users traffic go through the ProtonVPN endpoint and NOT my exposed WAN ISP address.

When my phone connects to the WireGuard tunnel it's given an address of 10.10.10.2, so I put 10.10.10.2 in the HOSTS section just like I do with all the other home computers on my network, but it does not work - it seems to only apply to local LAN hosts with 192.168.1.x

As you can see in this screenshot, it works great for all my local LAN devices but the single 10.10.10.2 entry under Switzerland just  doesn't seem to do anything.  The phone is still being exposed by the WAN IP, and it's not going through ProtonVPN Switzerland

Please let me know how to fix this, and I will make a donation

Just to summarize - I want to use my phone while I am not at home to connect via wireguard app to my network (working fine) but I want my traffic to go through my already established & configured ProtonVPN connection.  Thus, reaping the benefits of the VPN without needing to connect with their own app, while still having access to my home network.

Thank you

I installed the ddclient plugin and OPNsense is 100% up to date, but the actual configuration is missing documentation.  I have googled with no solutions.

Does anyone know what I need to enter in this screen?  Specifically for freedns.afraid.org

Thank you

Hello everyone!  I have wireguard configuration from 3 different VPN providers.  SurfShark, ProtonVPN, and WindScribe.  WindScribe and Proton are working perfectly with no issues, and I have 4 different gateways running and I am able to remove hosts from one and add to another through using "Aliases" for each of them (I followed the official OPNsense Selective WireGuard Routing Guide) and THOUGHT everything was fine until I tried adding SurfShark..  I can't get their tunnels to work for some reason..  Everything looks like its established and there's no errors anywhere to be found, not in the WireGuard logs even that I've been able to find, and everything is green everywhere in the dashboard etc but when I apply a host to that tunnel, the traffic doesn't go anywhere - everything just stalls

https://imgur.com/a/9ssljys

where it says <key is pre-filled> those values are already included in the config files, I've just followed the WireGuard Selective Routing guide and been copy and pasting

And as mentioned I have multiple established ones all working fine, it's just the surfshark that isnt working..  at a glance the literal only difference I see is that it's using public DNS servers inside the config file and the others are all using internal network..  Is this the reason?  What do I need to change if so?

Big thanks for any help