Topics

Hi,

I apologize if this has been asked already.  I did a search and didn't find anything that answered my question.

I'm testing the new 26.1.2 release.  As part of the rule migration assistant, the last step is to perform the "Remove all legacy rules" action.

I've imported the rules and compared what's listed under "Rules" vs "Rules [New]" and I don't see anything missing/different.  Beyond that, what other validation checks should I perform before I proceed with the last step of removing legacy rules?  

I assume "Remove all legacy rules" will clear out any rules seen under under Firewall > Rules.

Thanks

Hi,

Since December of last year, I've been troubleshooting what I originally thought was an OPNsense upgrade issue, but I have now instead determined to be a Zen Armor-specific upgrade issue. 

My current OPNsense setup:

• Multiple interfaces - LAN, MGMT, WAN
• Zen Armor has been installed since late summer 2025
• The MGMT network has its own Zen Armor policy assigned to it named MGMT_Policy, which has "Block all internet access" turned ON.
• I manage OPNsense through it's MGMT interface IP - https://192.168.2.251/

I was on Zen Armor version 2.1.1.  If I upgrade to the newest version available, currently 2.3.2, I can no longer reach the OPNsense web URL https://192.168.2.251.  I've included screenshots below which shows the live sessions page, before and after the upgrade.  Before the upgrade, you can see my workstation (192.168.2.99) is able to reach the web URL of .251.  After the upgrade, the workstation is blocked from accessing the same .251 IP.  Besides upgrading Zen Armor, nothing else changed.  I did not make any changes to the policy, the IPs, firewall rules, nothing at all. 
You cannot view this attachment.
You cannot view this attachment.

I don't think this is specific to the latest version of Zen Armor.  I only know that it began with a version after 2.1.1. 

Post-upgrade, if I turn off "Block all internet access" on my MGMT_Policy, my workstation (192.168.2.99) can once again access https://192.168.2.251. 

Can someone provide insight as to why an upgrade to Zen Armor would change the behavior of the policy? 

Thank you

Hi,

Yesterday, I upgraded from OPNsense 25.7.7.2 to 25.7.9.  Each time after it's done upgrading and finished rebooting, the web logon GUI becomes inaccessible.  The IP continues to respond to ping, but the web page doesn't return the login page in the browser.  It also stops accepting connections via SSH, whereas it worked prior to the upgrade. 

Prior to the upgrade, OPNsense was working fine.  I was able to initiate the upgrade through the web GUI portal. 

Troubleshooting steps I've tried to no avail (on top of reverting the OPNsense VM to backup)
-via CLI of the OPNsense VM as root and running 'configctl webgui restart renew' and 'service config restart'
-via CLI, confirming the correct IP is set, and changing it from HTTPS to HTTP
-via CLI, looking at /conf/config.xml, I see <interfaces>opt1</interfaces>, which I think references the interface it listens on for the webgui.  Opt1 is correct. 

Of the dozen times I've performed an upgrade to OPNsense  in the past via the web gui, it's never done this.  What am I missing? 

Looking for advice, thank you. 

I've already enabled real-tiome DNS enrichment in Zen Armor, under Settings > DNS Enrichment.  I've added DNS servers to the list as well.  However, when I look at the Recent Devices section, 99% of them show up as "Other Device" instead of showing its actual hostname.  In my Reports, I see MAC addresses for the vast majority of devices, instead of hostnames. 

To troubleshoot, I SSH'd to the server and performed an nslookup, specifying the DNS servers.  (nslookup <IP address of computer> <DNS server IP>) and it was able to resolve to hostname successfully, so this tells me opnsense can successfully reach the DNS server I had specified and process the lookup.  

Any ideas?

Thank you

Hi everyone,

I work for an organization which is paying $$$$ for their WAN internet connection.  It would be beneficial to generate a report to show the org what their actual usage is.  My needs:

• Peak usage, in megabits/sec
• Avg usage, preferably with an interval that can be defined, eg: avg usage over 24 hours, avg over 5 days, etc
• Be able to specify a start/end date for report to evaluate historical figures
• Identify the src or dest. hostname, IP, or OPNSense interface, to categorize and include/exclude them from the report

This report would help us determine if we're overutilizing/underutilizing the WAN connection, on what dates, by which devices, and their use case. 

I've evaluated the following that's native to OPNSense:
Reporting > Traffic - This shows data only in real time.  There's no reporting option available to look at historical metrics. 
Reporting > Insight - This covers most of my asks, but the biggest downside is that the .csv reports it generates does not show speed in terms of bytes, but in packets.  The 'Details' tab in the web GUI shows bytes, but it's bandwidth usage, not bandwidth speed. 

VnStat plugin - This shows bandwidth speed.  I can see HH/DD/MM/YY stats, which is awesome.  I can't specify exact dates/times, which is fine.  The drawback is it doesn't list the hostname/IP of that traffic, so I don't know what is consuming the data. 

I *think* there's no perfect option that meets my needs, and I'm left to just take all the various reports and try to generate my own report manually.  I hope I'm wrong and someone here can suggest something that can answer my needs?

Thank you very much for your time.