Recent posts

#1

26.7, 26.10 Series / Re: PPPoE over an unassigned V...

Last post by johndoeuser - Today at 10:35:46 PM

I want to chime in to this thread. I seem to have exactly the same issue as OP. A (Dutch) KPN fiber connection. PPPoE configured over vlan6 tagged interface. PPPoE works flawlessly up to version OPNsense 26.7.1_1-amd64. At the moment I have a cold stand-by with a clean install and upgraded to OPNsense 26.7.8_2-amd64. I only configured PPPoE which still doesn't want to start working. Help?! ;-)

#2

26.7, 26.10 Series / Re: cve-2026-98432 (linux behi...

Last post by nero355 - Today at 09:40:05 PM

PF has an allow-opts filter-rule modifier. By default, PF blocks packets containing IPv4 options. A pass rule needs allow-opts to permit them.

If you check your ruleset in /tmp/rules.debug you can grep if your ruleset contains rules with allow-opts.

Also if its on a non quick automatic rule that would allow-opts, you can create a quick rule in the same direction that blocks options.

So as long as you haven't created any Manual Firewall Rules that Allow TCP traffic to have 'allow-opts' included then even outdated Linux based devices are completely safe behind your OPNsense/FreeBSD based Firewall ?

If so : VERY COOL! :)

#3

26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...

Last post by danmac - Today at 08:18:33 PM

LOL! ^_^

haha I'm glad I amused someone :)

here's how I fixed (?) this problem on my setup, now I can just click update on the Web UI, I tested it upgrading from 26.7.7 to 26.7.8 worked first time whereas before it would fail repeatedly

either that or this is all bullshit and I just got extraordinarily lucky, I'll post it anyway

ssh to your firewall as root
# ee /usr/local/sbin/opnsense-update
(or use your preferred editor that isn't nano as we don't have that :P)
search (CTRL-Y) for STAGE1 or go to line 906
behold the two opnsense-fetch command lines
where the two lines say "-T 30 -q" change these to "-T 120 -a -q"
(you could probably get away with just the STAGE2 line but fuck it since we're here anyway)
save the file with ESC (wait) ENTER ENTER

now hit the web UI and do your update

the changes persisted after my upgrade and reboot, but I expect they will be wiped out at some point

for those who are sensitive to such topics this post is 100% grass fed medium rare non AI, I didn't even fire it up, just looked at opnsense-update & fetch on github then the args for fetch, then fucked about in SSH weeeeeee

if it still doesn't work for you, maybe try the Kent mirror as that's what I'm using

have fun chaps, happy Sunday o7

#4

General Discussion / Re: Learn firewall, NAT, routi...

Last post by Seimus - Today at 07:04:34 PM

I'd start with Cisco CCNA textbooks or Rich Stevens' "TCP/IP Illustrated, Volume I". Also recommended: Radia Perlman, "Interconnections - Bridges and Routers".

This! I read those CCNA books several times, and they are really great.

If you want a video format or a listening format I advice Keith Barker.
Keith Barker CCNA

But overall nothing beats those books.

Regards,
S.

#5

26.7, 26.10 Series / Re: [26.7.8_2] Unable to Displ...

Last post by MoonbeamFrame - Today at 05:50:38 PM

Deleted.

#6

General Discussion / Re: Learn firewall, NAT, routi...

Last post by Patrick M. Hausen - Today at 05:28:33 PM

I'd start with Cisco CCNA textbooks or Rich Stevens' "TCP/IP Illustrated, Volume I". Also recommended: Radia Perlman, "Interconnections - Bridges and Routers".

#7

German - Deutsch / Re: Caddy Logs per Wazuh Agent...

Last post by marcquark - Today at 05:18:41 PM

Ich weiß nicht, wie Wazuh funktioniert, aber die Access Logs von Caddy landen in /var/log/caddy/access/*, nicht in /var/ossec/logs/opnsense_syslog.log.

Mittlerweile bin ich da aufgeklärt (aka hab' den Mittag mit Code Durchwühlen verbracht). Das Wazuh Agent Plugin klinkt sich in syslog-ng ein und muss dann aber alles, was zu Wazuh soll, noch mal in ein lokales File schreiben, damit der Wazuh Agent sie auslesen kann. Das ist die /var/ossec/logs/opnsense_syslog.log. Eine Pipe geht wohl derzeit seitens Wazuh nicht.


Dass die Caddy Logs nicht mit kommen ist ein Bug, der sich wiederum aus der Caddy Syslog Integration ergibt. Lösungsansätze gibt's mehrere, ich hoffe mir antwortet einer der Maintainer was bevorzugt wäre :) https://github.com/opnsense/plugins/issues/5859

#8

26.7, 26.10 Series / Does ISC’s KEA support Dynamic...

Last post by loaderladdy - Today at 05:15:26 PM

KEA's documentation on integration with AD DNS, found here GSS-TSIG Integration with External Systems states the following:

Kea provides support for DNS updates, which can be protected using Transaction Signatures (or TSIG). This protection is often adequate. However, some systems, in particular Active Directory (AD) on Microsoft Windows servers, have chosen to adopt a more complex GSS-TSIG approach that offers additional capabilities, such as using negotiated dynamic keys.

Kea supports GSS-TSIG to protect DNS updates sent by the Kea DHCP-DDNS (D2) server in a hook, called libddns_gss_tsig.so.

However, searching my OPNsense filesystem I cannot find Kea's hook file "libddns_gss_tsig.so"

What I want to know is there a way to install the necessary Kea GSS-TSIG file on OPNsense?.

I use my OPNsense device as the front door for my homelab, and as I work with AD my homelab has AD installed, so integrating Kea DDNS with AD DNS would be great.

I know Windows DHCP supports DDNS, but I wanted a rock-solid solution that keeps my household happy, and running Windows DHCP doesn't fit that desired outcome after a power cut.

Any help or advice on this is greatly appreciated.

#9

General Discussion / Re: Learn firewall, NAT, routi...

Last post by nero355 - Today at 05:06:25 PM

With your network plans, first decide what objective you want to accomplish in a conceptual way without regard to OPNsense. Then figure out the generic way to do it, more or less. Finally, figure out how it's done in OPNsense.

Just one thing :

People sometimes want to accomplish things the wrong way or sometimes even the impossible way when they just start learning something so watch out for that "trap" that might come along your way :)


In general I think a nice basic layer of knowledge would be the CISCO CCNA Course when it comes to :
- IP Addressing
- TCP/UDP Protocols
- Routing
- VLANs

On the other hand when you look up information about something these days there is probably also some explanation included about the thing you are about to configure because all those YouTubers need their "viewing time" requirement satisfied each month ;)
And since people read less and less but do watch videos instead : There is your solution! LOL!

[26.7.8_2]

#10

26.7, 26.10 Series / [26.7.8_2] Unable to Display T...

Last post by Ashraaf - Today at 05:03:49 PM

Hello,

I have OpenVPN configured with TOTP-based two-factor authentication (2FA) and allow users to manage their own OTP seeds through the OPNsense web interface.

After updating OPNsense to 26.7.8_2, I noticed that users can no longer display the QR code when requesting a new OTP seed. Instead, the QR code area displays a broken image placeholder.

I'm not sure which version introduced this issue, as I regularly update my OPNsense installation on a weekly basis. I only noticed it today when some of my teammates switched to new mobile phones and attempted to use the "Request new OTP seed" function to configure their authenticator applications.

Current configuration

- OpenVPN users are members of the `OpenVPN` group.
- The following privileges are granted to this group under System → Access → Privileges:
  - `page-openvpn-client-export`
  - `page-system-usermanager-passwordmg`

These privileges are intended to allow users to export their own OpenVPN client configurations and manage their OTP seeds without requiring administrator intervention.

Additional observation

After revisiting the official [OPNsense Two-Factor Authentication Guide](https://docs.opnsense.org/manual/how-tos/two_factor.html#step-4-activate-authenticator-for-this-otp-seed), I found that an administrator (root) can still display the QR code through:

`ui/auth/user` → Edit user (pencil icon) → OTP seed → Show

However, this appears to require administrator access. Does this mean regular users can no longer display their own OTP QR codes, and must rely on an administrator whenever they need to register a new authenticator device?

Browser developer console error

I also checked the browser's F12 Developer Console and found the following Content Security Policy (CSP) error:

```
system_usermanager_passwordmg.php:1 Loading the image
'data:image/gif;base64,<redacted>' violates the following
Content Security Policy directive: "default-src 'self'".

Note that 'img-src' was not explicitly set, so 'default-src'
is used as a fallback. The action has been blocked.
```

Based on this error, could this be related to a CSP restriction preventing the browser from loading the QR code image embedded as a Base64 data URI?

Questions

1. Is this a known issue in OPNsense 26.7.8_2, or is this an intentional security policy change?
2. Should the `page-system-usermanager-passwordmg` privilege still allow regular users to generate and display their own OTP QR codes?
3. If this is a CSP-related regression, could the relevant `img-src` policy be adjusted to allow the required data URI without weakening the overall security policy?

I would appreciate any clarification or suggestions. Ideally, users should be able to manage their own OTP enrollment independently without requiring administrator intervention.

Security context: I understand that allowing users to request a new OTP seed themselves may raise security concerns, particularly in environments where the management interface is publicly accessible. However, my OPNsense deployment is within a closed network, and OpenVPN is used exclusively for internal access to a small number of isolated servers. The intention is simply to provide a convenient self-service OTP enrollment process for authorized internal users without requiring administrator intervention each time they change devices.

That said, I fully understand and respect it if restricting this functionality is an intentional security decision by the OPNsense developers. I am not requesting that the security policy be relaxed; I would just appreciate clarification on whether this behaviour is intentional or an unintended regression. If it is an intentional change, I am perfectly fine with that and will adjust our internal procedures accordingly.

Thank you.