Recent posts

#1

Portuguese - Português / [ TUTORIAL] Como Instalar OPNs...

Last post by beto2p - Today at 02:48:28 AM

Olá, pessoal!

Decidi criar um tutorial passo a passo para ajudar quem está começando e quer testar, estudar ou homologar o OPNsense em um ambiente virtualizado usando o VirtualBox.

Como quebrei muita cabeça no inicio, fiz um passo a passo completo, utilizando a última versão do OPNsense 26.1.6
É um LAB virtual simples, com a seguinte topologia:

Code Select Expand

[Internet / Roteador da sua Casa]
                |
                | (Recebe IP via DHCP do seu roteador)
                v
      +-------------------+
      |   Adaptador WAN   | <-- PLACA EM MODO BRIDGE
      |                   |
      |    VM OPNsense    | (Firewall no VirtualBox)
      |                   |
      |   Adaptador LAN   | <-- REDE INTERNA / intnet
      +-------------------+
                |
                | (Rede isolada protegida pelo OPNsense)
                v
      +-------------------+
      |    VM Windows     | <-- Conectada na "Rede Interna"
      | (Estação Cliente) | (Acesso ao Web GUI e navegação)
      +-------------------+


Aqui está o tutorial completo com o passo a passo detalhado, etapa por etapa inclusive com imagens para facilitar.

https://tecdicas.inf.br/tutorial-opnsense-virtualbox

#2

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by fornax - Today at 02:20:22 AM

Cables?, and what devices are connected to these 226's?

WAN connects to the ISP's modem/router device. LAN connects to a GrandStream GWN7801P switch. Cables are mostly CAT6. I can try swapping the LAN cable.

Here's what the switch has to say about the port:

Code Select Expand

Ethernet1/0/8 is up
  Hardware is Gigabit Ethernet
  Full-duplex, 1000Mb/s, media type is Copper
  flow-control is off
  back-pressure is enabled
  selfloop-detection is disabled
  selfloop-detection running is false
  real time input rate  11986 bits/sec, 4 packets/sec
  real time output rate  10192 bits/sec, 6 packets/sec
     55595737 packets input, 73006841505 bytes, 0 throttles
     Received 35574 broadcasts (69151 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame
     69151 multicast, 0 pause input
     27367707 input packets with dribble condition detected
     32114150 packets output, 9685006492 bytes, 0 underrun
     0 output errors, 0 collisions
     0 babbles, 0 late collision, 0 deferred
     0 PAUSE output

And OPNSense:

Code Select Expand

igc0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: LAN (lan)
        options=48420b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWTSO,HWSTATS,MEXTPG>
        ether 64:62:66:24:f8:27
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        groups: InternalIFs TrustedIFs
        media: Ethernet 1000baseT <full-duplex>
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
igc1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN (wan)
        options=48420b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWTSO,HWSTATS,MEXTPG>
        ether 64:62:66:24:f8:28
        inet 10.0.0.166 netmask 0xffffff00 broadcast 10.0.0.255
        media: Ethernet 1000baseT <full-duplex>
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>


#3

26.1, 26,4 Series / Re: WireGuard gateway intermit...

Last post by gogormonchi - Today at 02:05:40 AM

I can confirm this issue. Been troubleshooting this behaviour in my setup aswell, unfortunately with no luck. The traceroute workaround indeed fixes the issue for some time until "something" breaks it again. With a tcpdump on the wireguard interface I was able to find this:

Code Select Expand

root@vm-opnsense-1:~ # tcpdump -ni wg0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wg0, link-type NULL (BSD loopback), snapshot length 262144 bytes
23:56:57.659028 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 256, seq 576, length 9
23:56:57.675027 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 256, seq 576, length 9          <= Wrong source and destination IP on the response packet

Dpinger sends the icmp packet out correctly but the response packet somehow gets its source and destination IPs transformed and is therefore not correctly matched to the initial process. This transformation is happening somehow on the opnsense itself. In my case this is my WAN facing IP Address (.247) and the regular WAN GW address (.1)

With the traceroute workaround you can see in real time how the behaviour switches to a functional state again.

Code Select Expand

root@vm-opnsense-1:~ # tcpdump -ni wg0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wg0, link-type NULL (BSD loopback), snapshot length 262144 bytes
01:55:23.671267 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 24, length 9
01:55:23.687559 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 24, length 9
01:55:24.721268 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 25, length 9
01:55:24.737848 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 25, length 9
01:55:25.771371 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 26, length 9
01:55:25.787752 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 26, length 9
01:55:26.821309 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 27, length 9
01:55:26.837408 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 27, length 9
01:55:27.871295 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 28, length 9
01:55:27.887429 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 28, length 9
01:55:28.615346 IP 10.2.0.2.61637 > 10.2.0.1.33435: UDP, length 12                                          <= traceroute
01:55:28.921307 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 29, length 9
01:55:28.937276 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 29, length 9
01:55:29.971368 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 30, length 9
01:55:29.989760 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 30, length 9
01:55:31.021387 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 31, length 9
01:55:31.037842 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 31, length 9
01:55:32.071392 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 32, length 9
01:55:32.086992 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 32, length 9
01:55:33.121416 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 33, length 9
01:55:33.137765 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 33, length 9
01:55:33.671328 IP 10.2.0.2.61637 > 10.2.0.1.33436: UDP, length 12                                          <= traceroute
01:55:34.171394 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 34, length 9
01:55:34.187608 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 34, length 9
01:55:35.221393 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 35, length 9
01:55:35.237311 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 35, length 9
01:55:36.271310 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 36, length 9
01:55:36.287600 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 36, length 9
01:55:37.312655 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 37, length 9
01:55:37.328764 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 37, length 9
01:55:38.371303 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 38, length 9
01:55:38.387665 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 38, length 9
01:55:38.716191 IP 10.2.0.2.61637 > 10.2.0.1.33437: UDP, length 12                                          <= traceroute
01:55:39.384896 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 39, length 9
01:55:39.401338 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 39, length 9
01:55:40.418807 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 40, length 9
01:55:40.434959 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 40, length 9
01:55:41.471452 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 41, length 9
01:55:41.487620 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 41, length 9
01:55:42.521338 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 42, length 9
01:55:42.537770 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 42, length 9
01:55:43.571406 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 43, length 9
01:55:43.587306 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 43, length 9
01:55:43.771858 IP 10.2.0.2.61637 > 10.2.0.1.33438: UDP, length 12                                          <= traceroute
01:55:44.621431 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 44, length 9
01:55:44.637576 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 44, length 9
01:55:45.671337 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 45, length 9
01:55:45.687429 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 45, length 9
01:55:46.721357 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 46, length 9
01:55:46.737577 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 46, length 9
01:55:47.771463 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 47, length 9
01:55:47.787821 IP 192.168.178.1 > 192.168.178.247: ICMP echo reply, id 677, seq 47, length 9
01:55:48.821353 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 48, length 9
01:55:48.821401 IP 10.2.0.2.61637 > 10.2.0.1.33439: UDP, length 12                                          <= traceroute
01:55:48.837608 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 48, length 9                           <= issue self-healed
01:55:49.871494 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 49, length 9
01:55:49.887955 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 49, length 9
01:55:50.921394 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 50, length 9
01:55:50.937420 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 50, length 9
01:55:51.971370 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 51, length 9
01:55:51.989668 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 51, length 9
01:55:53.021438 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 52, length 9
01:55:53.037889 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 52, length 9
01:55:53.871326 IP 10.2.0.2.61637 > 10.2.0.1.33440: UDP, length 12
01:55:54.071318 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 53, length 9
01:55:54.088002 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 53, length 9
01:55:55.121448 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 54, length 9
01:55:55.137603 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 54, length 9
01:55:56.171439 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 55, length 9
01:55:56.187354 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 55, length 9
01:55:57.221381 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 56, length 9
01:55:57.237847 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 56, length 9
01:55:58.271386 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 57, length 9
01:55:58.287646 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 57, length 9
01:55:59.321385 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 58, length 9
01:55:59.337847 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 58, length 9
01:56:00.332408 IP 10.2.0.2 > 10.2.0.1: ICMP echo request, id 677, seq 59, length 9
01:56:00.348297 IP 10.2.0.1 > 10.2.0.2: ICMP echo reply, id 677, seq 59, length 9

I cannot find any reason in my setup why this rewrite would happen. Doesn't seem logical to me either.

#4

26.1, 26,4 Series / Re: Several ports are not open

Last post by amd.64 - Today at 01:41:37 AM

I forgot to add that this system is running 26.1.10 if it matters.

#5

26.1, 26,4 Series / Several ports are not open

Last post by amd.64 - Today at 01:40:04 AM

Can anybody PLEASE tell me if and where I went wrong.

I have three OPNSense routers / firewalls in use, this is the only one I am having trouble getting ports open. Shentel, the ISP says they are not blocking ports. The attached image is of the WAN rules.

Thank You

#6

General Discussion / Re: Periodic NIC issues (?) wi...

Last post by BrandyWine - Today at 01:35:39 AM

Cables?, and what devices are connected to these 226's?

#7

Development and Code Review / Re: Blocky DNS (Alternate to A...

Last post by Firewire - Today at 12:04:37 AM

Something seems broken with the latest update, blocky cannot be installed anymore.
I removed my blocky 0.28 version, updated via pkg update and tried installing 0.33 version.
After installing via "pkg install os-blocky-guru" or via "System -> Firmware -> Plugins -> os-blocky-guru" it doesn't get installed.
No error message or hint what might be wrong, could you check if it is the same on your system?

#8

26.1, 26,4 Series / Re: Help me with assigning a n...

Last post by nero355 - Today at 12:03:36 AM

im still new to this

Then make your life easy by creating a new network and then just clone the Default Allow Any Firewall Rules from LAN to that new network as a start! ;)

#9

Tutorials and FAQs / Re: Help understanding firewal...

Last post by nero355 - July 14, 2026, 11:57:32 PM

You may not have noticed yet, because many browsers do not even use DNS on port 53 any more (doing DoT or DoH instead), such that DNS worked despite port 52 being blocked.

52 = Typo you probably want to fix :)

#10

General Discussion / Re: Unbound DNS keeps crashing...

Last post by nero355 - July 14, 2026, 11:48:39 PM

Perhaps this is what you are thinking of.

I will let you know once I figure out what it was :)