Messages

I posted the ENTIRE config, and NOTHING passes OUT. says blocked by default deny rule.

um this is a standard routing thing, with globally routable IP's. 

NOTE: If I just turn PF off, it routes JUST FINE.

I've been doing IPv4 networking for >30 years, and I've tried a thousand(estimate) things.

with PF enabled it doesn't work, with PF disabled it routes like it's supposed to.

I have that set, and it does NOT pass traffic.

I need NO-NAT, but the ability to have firewall rules.  I've looked at past posts, and BELIEVE I've done everything right, but if pf is enabled, it does NOT pass traffic.  If I disable pf it works fine.

HELP.

attached is the current state

another user suggested setting the IPv4 preferred over IPv6 and running the updates, which DID upgrade more code.

Now that it's on:
OPNsense 22.1.r1-amd64

and removing the 4 over 6 preference it's still working, and my IPv6 issue is GONE.

setting the prefer IPv4 over IPv6 checkbox allowed it to update to:
OPNsense 22.1.r1-amd64


so, I guess my pkg -4 updates didn't do the whole thing.

And now that it's on that code, removing the preference still allows updates etc to work without hanging.

y'all can ignore this thread.

Thanks for that hint, I did the prefer 4 over 6 and it updated to:
OPNsense 22.1.r1-amd64


from r_3.  So, yes, there were changes.

Now I've turned off the preference, and update checks, etc all work.

Interesting.

Thanks for the hint.

I was able to get around this problem by doing:

pkg -4 update
pkg -4 upgrade

and rebooting.

I wonder if there is a way to force pkg -4 ?

per private email, it was worth a try, and:

SUCCESS

it's working, modulo the fact that pkg update doesn't like to talk to the IPv6 repos.
(Other IPv6 works fine).

I wonder if there's a way to force pkg -4 for the OPNSense / SunnyValley stuff?

How can I force pkg -4 for the updates?

Are there changes in 22.1 (Either OPNSense or Zenarmor) that would possibly affect this issue?

IIRC 22.1 is NOT ready for SunnyValley, so no.

@SunnyValley: Is this now a dead ticket, and I need to cancel my subscription and remove the software? 

As I said, even with the offload stuff OFF, it still blocks IPv6 traversing the Firewall.

even with all the offload stuff turned off, I still can't get IPv6 packets to traverse the firewall