Topics

Hi everyone,

I have a question regarding the IDS configuration in OPNsense when using IPv6 with dynamic prefix delegation from the ISP.

Under:

Services → Intrusion Detection → Administration

there is the setting:

Home networks

Current default value:

192.168.0.0/16
10.0.0.0/8
172.16.0.0/12

The hint says:

"Networks to interpret as local"

For IPv4 this is straightforward, but I am unsure how this should properly be configured for IPv6 when the ISP delegated prefix changes dynamically.

Example:

LAN currently receives a delegated /64
Prefix may change after reconnect/reboot

Questions:

Should the current delegated IPv6 LAN subnet be manually added here?
Is there a recommended way to handle dynamic IPv6 prefixes?
Can interface macros/variables like $LAN_NET be used in this field?
What is the recommended best practice for IDS Home Networks with IPv6 PD?

I would appreciate clarification on the intended/recommended configuration.

Thanks!

Hi everyone,

I recently configured a cron job to reboot my OPNsense firewall every 3 days.

After this morning's reboot, I noticed I had no internet connectivity. The DNSCrypt service had a red icon and wasn't running. I had to manually start DNSCrypt and then restart Unbound to restore DNS resolution.

I suspect the issue may have been related to IP assignment: the firewall might not have received an IPv6 address (or even an IPv4 address) immediately after reboot, which could have caused DNSCrypt to fail or exit. However, I couldn't find any logs indicating the process was killed or why it didn't start automatically.

My setup:

Destination NAT redirecting all LAN DNS traffic to Unbound
Unbound configured to forward queries to DNSCrypt

Questions:

Should DNSCrypt normally start automatically after reboot?
Is additional configuration needed to ensure the proper startup order?
Could this have been a one-time startup failure?
Is there a recommended way to ensure Unbound waits for DNSCrypt before starting?

Any tips or troubleshooting suggestions would be greatly appreciated.

Note: I've attached the relevant logs for reference. For some reason, the attachments are only visible when you are logged in. The reboot occurred at 4:00 AM, and I manually fixed the issue by restarting DNSCrypt and Unbound around 8:20 AM.

Service start order:

DNSCrypt starts at 04:01:23
Unbound starts at 04:01:24
Then Unbound starts again at 04:01:41

DNSCrypt wasn't fully ready when Unbound started:
Unbound depends on DNSCrypt upstream
Large DNSBL list load:
DNSBL module has 968,522 entries.

Hi everyone,

I'm trying to force all DNS traffic through my Unbound resolver on OPNsense for both IPv4 and IPv6. Here's what I have configured:


Two Destination NAT Rules one IPv4 an IPv6 (Redirect DNS 53 to Unbound)

Sequence: 100
Description: Reroute Port 53
Interface: LAN
Version: IPv4
Protocol: TCP/UDP

Source:

(Advanced) Invert Destination: ✔ checked

Destination:

Destination Address: LAN address
Destination Port: 53 (single port)

Translation:

Redirect Target IP: Loopback network
Redirect Target Port: 53 (single port)
Pool Options: Default

Options:

No RDR (NOT): unchecked
Log: unchecked
No XMLRPC Sync: unchecked
NAT Reflection: Disabled
Set Tag / Match Tag: empty
Firewall Rule: Pass

LAN Firewall Rule (Block Outgoing DNS 53)

Quick: ✔ checked
Action: Block
Interface: LAN
Protocol: TCP/UDP
Direction: Out
Version: IPv4+IPv6
Source: Any
Destination: Any
Destination Port: 53


Destination NAT rule: Redirect all port 53 traffic (TCP/UDP) from LAN to Unbound (loopback).
LAN firewall rule: Block all outgoing port 53 (to force clients to use Unbound).

The problem:

With these three rules enabled, my Chromecast cannot connect to Wi-Fi.
If I disable both rules inclsuive the LAN block rule, Chromecast works fine.
I also tried setting Google DNS (8.8.8.8 / 8.8.4.4) in Unbound with no block rules, but it still doesn't work.

I'm not sure why blocking port 53 + NAT is breaking Chromecast.

Hello everyone,

I'm encountering an issue with my OPNsense setup. During the execution of the script sensor_info.py located at /usr/local/opnsense/scripts/etpro_telemetry/, I am getting the following error:

Error
configd.py

[9012173e-136c-437f-a308-a85a12274648] Script action failed with Command '/usr/local/opnsense/scripts/etpro_telemetry/sensor_info.py ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 89, in execute subprocess.run(script_command, env=self.config_environment, shell=True, File "/usr/local/lib/python3.11/subprocess.py", line 571, in run raise CalledProcessError(retcode, process.args, subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/etpro_telemetry/sensor_info.py ' returned non-zero exit status 1.

Has anyone else encountered this issue or can point me in the right direction to resolve it?

Type: opnsense-business    
Version: 25.10_2    
Architecture: amd64    
Commit: 89445f333    
Repositories: OPNsense (Priority: 11)    
Updated on: Thu Oct 23 18:59:03 CEST 2025


Hi,

I'm encountering an error in OPNsense related to Suricata, and I'm unsure where to report it or how to resolve it.
The error message I'm seeing is as follows:

 [109203] <Error> -- error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ETPRO MALWARE TA399/Sidewinder StealerBot CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/MoFA/"; startswith; fast_pattern; pcre:"/^[a-f0-9]{8}(?:\x3fe\x3d.*p\x3d.*\xw\x3d)?/R"; http.header_names; content:!"|0d 0a|user-agent|0d 0a|"; nocase; reference:md5,b55f692ccc11496e2772705060f3d9d2; classtype:trojan-activity; sid:2864929; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_and_Server, tls_state TLSDecrypt, created_at 2025_10_17, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag TA399, updated_at 2025_10_17, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name exfiltration_over_C2_channel;)" from file /usr/local/etc/suricata/opnsense.rules/emerging-malware.rules at line 6545


also this error was logged too:

suricata
[109203] <Error> -- pcre2 compile of "/^[a-f0-9]{8}(?:\x3fe\x3d.*p\x3d.*\xw\x3d)?/R" failed at offset 35: digits missing after \x or in \x{} or \o{} or \N{U+}

This seems to be related to an issue with the parsing of a signature in the "emerging-malware.rules" file, specifically around the "Sidewinder StealerBot" CnC checkin detection.

Could anyone suggest where I should report this issue or if there's a specific fix I should apply? Is this a known problem with Suricata's signature parsing or OPNsense's Suricata implementation?

Thanks in advance for any help!

Hi everyone,

I'm trying to set up my network in a way that forces all NTP (Network Time Protocol) traffic to go through my OPNsense firewall so it can handle time synchronization via Chrony. Here's what I have so far:

I have Chrony installed and running on my OPNsense firewall.

Some of my devices on the network use Chrony as their NTP client with NTS.

I want to redirect all outgoing NTP requests from these devices to OPNsense, essentially forcing them to sync time through OPNsense.

I'm considering using NAT redirection and firewall rules similar to how DNS requests are handled, but I'm not sure if NTP traffic can be redirected in the same way.

Specifically, I have a few questions:

1. Is it possible to redirect NTP traffic (UDP port 123) to OPNsense using firewall rules and NAT?

2. Can OPNsense act as the sole time server for all devices in my network, and how would I set that up?

3. Since some of my devices use Chrony with NTS, will OPNsense be able to handle these requests, or do I need additional configuration?

Ideally, I'd like to accomplish this with something similar to the way DNS redirection works using firewall rules and NAT redirection to force all NTP traffic to go through OPNsense.

When attempting to enable OTP for my administrator account, I received an error indicating that the username cannot be changed, even though I didn't modify it only attempted to add OTP.

Why is it happening? and how can i fix that?

System -> Firmware -> Mirror -> Deciso (HTTPS, NL, Commercial)
IPv6 -> disabled
Unbound DNS -> yes
Kea DHCP -> yes


System -> Firmware -> Run an audit -> Connectivity Check:

Code Select Expand

***GOT REQUEST TO AUDIT CONNECTIVITY***
Currently running OPNsense 25.4.1 (amd64) at Sun Jun 22 14:06:02 CEST 2025
Strict TLS 1.3 and CRL checking is enabled.
Checking connectivity for host: opnsense-update.deciso.com -> 89.149.211.205
PING 89.149.211.205 (89.149.211.205): 1500 data bytes
1508 bytes from 89.149.211.205: icmp_seq=0 ttl=55 time=37.200 ms
1508 bytes from 89.149.211.205: icmp_seq=1 ttl=55 time=22.135 ms
1508 bytes from 89.149.211.205: icmp_seq=2 ttl=55 time=23.714 ms
1508 bytes from 89.149.211.205: icmp_seq=3 ttl=55 time=22.244 ms

--- 89.149.211.205 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 22.135/26.323/37.200/6.311 ms
Checking connectivity for repository (IPv4): https://opnsense-update.deciso.com/${SUBSCRIPTION}/FreeBSD:14:amd64/25.4
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries: .......... done
OPNsense repository update completed. 875 packages processed.
All repositories are up to date.
Checking connectivity for host: opnsense-update.deciso.com -> 2001:1af8:4f00:a005:5::
ping: UDP connect: No route to host
Checking connectivity for repository (IPv6): https://opnsense-update.deciso.com/${SUBSCRIPTION}/FreeBSD:14:amd64/25.4
Updating OPNsense repository catalogue...
pkg: https://opnsense-update.deciso.com/${SUBSCRIPTION}/FreeBSD:14:amd64/25.4/latest/meta.txz: Non-recoverable resolver failure
repository OPNsense has no meta file, using default settings
pkg: https://opnsense-update.deciso.com/${SUBSCRIPTION}/FreeBSD:14:amd64/25.4/latest/packagesite.pkg: Non-recoverable resolver failure
pkg: https://opnsense-update.deciso.com/${SUBSCRIPTION}/FreeBSD:14:amd64/25.4/latest/packagesite.txz: Non-recoverable resolver failure
Unable to update repository OPNsense
Error updating repositories!
Checking server certificate for host: opnsense-update.deciso.com
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G3
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = RapidSSL TLS ECC CA G1
verify return:1
depth=0 CN = opnsense-update.deciso.com
verify return:1
DONE
***DONE***


Hey everyone,

I recently enabled Suricata IDS on my setup, and I'm running into a couple of issues that I'm not sure how to properly diagnose or fix.

First off, I'm not seeing any alerts, even though I suspect my network isn't totally clean.

I did enter the et_telemetry.token under Services > Intrusion Detection, and I can confirm Suricata is running.

However, just enabling it doesn't seem to make it actually do anything useful — or at least I'm not getting any alerts/logs that indicate it's catching threats.

Additionally, I'm seeing a bunch of flowbit-related warnings in the logs, like these:

Code Select Expand

2025-06-08T06:36:45 Notice suricata [100780] <Notice> -- Threads created -> W: 16 FM: 1 FR: 1   Engine started.
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.vba-jpg-dl' is checked but not set. Checked in 2814992 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023672 and 1 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.http.binary' is checked but not set. Checked in 2029335 and 1 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.DMTP_Protocol' is checked but not set. Checked in 2858384 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.HTA.Download' is checked but not set. Checked in 2816701 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.http.javaclient' is checked but not set. Checked in 2015657 and 0 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
2025-06-08T06:31:39 Warning suricata [100780] <Warning> -- flowbit 'ET.MSSQL' is checked but not set. Checked in 2020569 and 0 other sigs
2025-06-08T06:30:32 Notice suricata [100780] <Notice> -- Syslog: facility local5, level Info, ident suricata
2025-06-08T06:30:31 Notice suricata [100460] <Notice> -- This is Suricata version 7.0.10 RELEASE running in SYSTEM mode

It looks like certain rules are being loaded that rely on other rules setting flowbits that aren't active?

So I have a few questions I hope someone can help me with:

How can I confirm that Suricata is actively inspecting traffic and generating alerts correctly?
Is there a step-by-step tutorial or test method (e.g. safe malicious payload or simulated attack) I can use?

Do I need to manually enable or add the rules that set these flowbits? Or is this normal?

Is there a known-good ruleset I should be using (e.g. Emerging Threats Open vs. Pro) that avoids this issue?

Would appreciate any help or pointers — just trying to make sure this is actually working and not just burning CPU for no reason 😅

Thanks in advance!