"Recent posts
#1
26.7 Series / Re: Asking for Sanity Check be...
Last post by proctor - Today at 07:51:12 AMI see, thank you!
#2
25.7, 25.10 Legacy Series / Re: Unbound Blocklists - How t...
Last post by Billie34 - Today at 04:59:40 AMThe key part of the current documentation is that OPNsense uses the most specific matching source subnet when policies overlap. It explicitly recommends keeping source networks separate to avoid priority issues.
#3
Portuguese - Português / Re: FTP LIST/LS retorna erro 5...
Last post by Billie34 - Today at 04:58:13 AMSe o conteúdo for idêntico após reassembly, mas a segmentação for diferente, você terá uma evidência muito forte para a hipótese levantada.
#4
26.7 Series / Re: VLAN devices are on LAN IP...
Last post by tonys - Today at 04:19:52 AMI found the problem. The Unifi OS configuration had its Default, Guest, and IoT networks set up correctly with the proper tags (20 for Guest, 40 for IoT) but the tags weren't showing up in the network table list. Google Gemini led me to this issue and showed me how to correct it - basically, MANUALLY add the two tags to their respective networks. Why they didn't copy over when I defined those networks remains a mystery (maybe a bug?) but once I manually added the tags, all devices disconnected from the native (LAN) network and reconnected on their proper networks.
Attached is a Unifi OS screenshot after adding these tags. The bottom table is where I originally set up the networks with their tags. The top table was generated by UnifiOS but was missing the VLAN tags so I added the tags manually. FYI, the VLAN definition for the LAN is currently disabled in OPNSense. It seems to be unnecessary to tag the LAN so I'm able to combine untagged LAN with the two VLANs on one port going to the Unifi AP. Hopefully this settles your debate over combining tagged and untagged traffic, LOL.
Thanks for all your help gentlemen. Now it's time to move on to the next problem (LAN stalls requiring using an external VPN to stop LAN blocks to Quad9 encrypted DNS from Apple's Private Relay traffic).
Attached is a Unifi OS screenshot after adding these tags. The bottom table is where I originally set up the networks with their tags. The top table was generated by UnifiOS but was missing the VLAN tags so I added the tags manually. FYI, the VLAN definition for the LAN is currently disabled in OPNSense. It seems to be unnecessary to tag the LAN so I'm able to combine untagged LAN with the two VLANs on one port going to the Unifi AP. Hopefully this settles your debate over combining tagged and untagged traffic, LOL.
Thanks for all your help gentlemen. Now it's time to move on to the next problem (LAN stalls requiring using an external VPN to stop LAN blocks to Quad9 encrypted DNS from Apple's Private Relay traffic).
#5
General Discussion / Minimum Supported Refresh Freq...
Last post by wiring8228 - Today at 02:28:19 AMProblem Description:
When creating a firewall alias on OPNsense 26.7.1 of type "URL Table in JSON format (IPs)," setting the "Refresh Frequency" to fractional values such as 0.5 or 0.01 hours has no observable effect. The alias table does not appear to refresh at the specified interval. It is unclear what the minimum supported value is for this field.
Expected Behavior
The alias table should be fetched and updated at the interval specified by the "Refresh Frequency" field, including fractional values expressed in hours (e.g., 0.5 hours = every 30 minutes, 0.01 hours = approximately every 36 seconds).
Actual Behavior
Reproduction Steps
Navigate to Firewall → Aliases in the OPNsense web interface
Click Add to create a new alias
Configure the alias with the following settings:
Save and apply the alias
Wait beyond the expected refresh interval (30 minutes for 0.5 hours)
Observe that the alias contents have not been updated
Key Question
What is the smallest supported value for the "Refresh Frequency" field when using the "URL Table in JSON format (IPs)" alias type? Are fractional values below 1 hour actually processed by OPNsense, or is the effective minimum 1 hour? If fractional values are not honored, is there an alternative mechanism to achieve more frequent alias table refreshes (e.g., cron jobs or plugin-based solutions)?
When creating a firewall alias on OPNsense 26.7.1 of type "URL Table in JSON format (IPs)," setting the "Refresh Frequency" to fractional values such as 0.5 or 0.01 hours has no observable effect. The alias table does not appear to refresh at the specified interval. It is unclear what the minimum supported value is for this field.
Expected Behavior
The alias table should be fetched and updated at the interval specified by the "Refresh Frequency" field, including fractional values expressed in hours (e.g., 0.5 hours = every 30 minutes, 0.01 hours = approximately every 36 seconds).
Actual Behavior
- With a Refresh Frequency of 0.5 hours: No refresh appears to occur at the expected 30-minute interval
- With a Refresh Frequency of 0.01 hours: No refresh appears to occur at the expected ~36-second interval
- Additionally, values with more than 2 decimal places (e.g., 0.001) are displayed as "0.00" after saving and reopening the alias configuration mask, suggesting the field is truncated or rounded to 2 decimal places on save
Reproduction Steps
Navigate to Firewall → Aliases in the OPNsense web interface
Click Add to create a new alias
Configure the alias with the following settings:
- Name: TestAlias
- Type: URL Table in JSON format (IPs)
- Content: https://www.spamhaus.org/drop/drop_v4.json
- Refresh Frequency (Hours): 0.5
Save and apply the alias
Wait beyond the expected refresh interval (30 minutes for 0.5 hours)
Observe that the alias contents have not been updated
Key Question
What is the smallest supported value for the "Refresh Frequency" field when using the "URL Table in JSON format (IPs)" alias type? Are fractional values below 1 hour actually processed by OPNsense, or is the effective minimum 1 hour? If fractional values are not honored, is there an alternative mechanism to achieve more frequent alias table refreshes (e.g., cron jobs or plugin-based solutions)?
#6
Zenarmor (Sensei) / How to block Firefox VPN
Last post by kkeller - Today at 12:51:07 AMSo Firefox rolled out early this year an integrated free VPN in their browser that bypasses the Zenarmor policies. I have every Proxy in the policy blocked and it still is working. Is there going to be a policy update to block the Firefox VPN?
#7
26.7 Series / Re: nfSensei ( fork pfsense )
Last post by Lucid1010 - Today at 12:19:57 AMwhere is code?
#8
26.7 Series / Re: VLAN devices are on LAN IP...
Last post by tonys - August 07, 2026, 11:38:00 PMQuote from: dseven on August 07, 2026, 09:13:34 AMHave you reboot (opnsense) since eliminating the bridge? There may be some artifact from it lurking somewhere.
Otherwise try this tcpdump to see "what's happening on the wire":Code Selecttcpdump -nnvvei igc0 '(ether host aa:bb:cc:dd:ee:ff and port 67) or (vlan and ether host aa:bb:cc:dd:ee:ff and port 67)'
Substitute the MAC address of a Guest or IoT device (in two places), and make it (re)connect.
Feedback:
- OPNSense router has been rebooted MANY times since removing the bridge
- This wireless device is supposed to be on the IoT VLAN (192.168.40.x). It used to be under v21 and earlier, but now it keeps reconnecting to the LAN. The Roku screen shows it's on the IoT network WITH theTHE IoT password (very different from the LAN password) but it keeps getting a LAN IP. The Unifi wireless AP also shows it on the IoT network which it must be because I gave it the IoT password. Yet it got a LAN IP. ??
tcpdump -nnvvei igc0 '(ether host d4:be:dc:20:de:dd and port 67) or (vlan and ether host d4:be:dc:20:de:dd and port 67)'
tcpdump: listening on igc0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:24:11.301381 d4:be:dc:20:de:dd > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from d4:be:dc:20:de:dd, length 548, xid 0x70cd0629, Flags [none] (0x0000)
Client-Ethernet-Address d4:be:dc:20:de:dd
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Request
Requested-IP (50), length 4: 192.168.1.127
Parameter-Request (55), length 5:
Subnet-Mask (1), Default-Gateway (3), Domain-Name-Server (6), Domain-Name (15)
Hostname (12)
Hostname (12), length 9: "RokuUltra"
16:24:11.301551 64:62:66:22:4c:ab > d4:be:dc:20:de:dd, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.127.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0x70cd0629, Flags [none] (0x0000)
Your-IP 192.168.1.127
Client-Ethernet-Address d4:be:dc:20:de:dd
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: ACK
Server-ID (54), length 4: 192.168.1.1
Lease-Time (51), length 4: 5452
Subnet-Mask (1), length 4: 255.255.255.0
Default-Gateway (3), length 4: 192.168.1.1
Domain-Name-Server (6), length 4: 192.168.1.1
Domain-Name (15), length 8: "home.lan"
#9
German - Deutsch / Re: Hilfe zu VPN Client in OPN...
Last post by diabolo511 - August 07, 2026, 11:20:18 PMOkay für mich war das eigentlich relativ logisch zwecks DNS.
Ich möchte nur, das die VPN Clients den Mullvad DNS nutzen, der Rest geht seinen regulären Weg.
Es sei dazu auch gesagt das ich echt kein Profi bin und auch noch einiges zu lernen hab.
Der Client ist so eingestellt, das der Mullvad DNS über den VPN genutzt werden soll.
Das mit der Gateway Regel muss ich mir selber noch mal anschauen, konnte die Woche über nicht daran arbeiten.
Ich möchte nur, das die VPN Clients den Mullvad DNS nutzen, der Rest geht seinen regulären Weg.
Es sei dazu auch gesagt das ich echt kein Profi bin und auch noch einiges zu lernen hab.
Der Client ist so eingestellt, das der Mullvad DNS über den VPN genutzt werden soll.
Das mit der Gateway Regel muss ich mir selber noch mal anschauen, konnte die Woche über nicht daran arbeiten.
#10
26.7 Series / legacy ipsec settings on 26.7....
Last post by tentpig - August 07, 2026, 11:00:03 PMJust converted from pfSense to Opnsense. Running 26.7.1_1.
have a client with some legacy ipsec gear I need to connect to. They are set up with AES 256 SHA1 DH2.
I cannot see how to configure this in the GUI.
Can someone provide guidance? Googling yields instructions which don't correspond to anything I see on the screen, so I assume they're for an older version of the software.
have a client with some legacy ipsec gear I need to connect to. They are set up with AES 256 SHA1 DH2.
I cannot see how to configure this in the GUI.
Can someone provide guidance? Googling yields instructions which don't correspond to anything I see on the screen, so I assume they're for an older version of the software.
