Recent posts

#1

26.7 Series / Re: Internet Connectivity Issu...

Last post by (MARLOO) - Today at 05:16:56 AM

this is most likely related to PF rule reloading  or the gateway/default route becoming invalid after an alias change.


 

Is there a recommended way to troubleshoot and resolve this issue without restarting the firewall?

check

netstat -rn | grep default
pfctl -si
pfctl -sr | head -50
cat /var/log/filter/latest.log



if the default route is missing, disable and re-enable the affected gateway under System → Gateways, then apply changes

#2

Zenarmor (Sensei) / Re: App Control Definition Upd...

Last post by nutty_net - Today at 04:46:23 AM

...Please note that our updates are not limited to adding or removing apps; we are also continuously enhancing existing applications by updating hostnames and IP addresses.

Ohhh, good point and good to know!

...I will share your feedback with the product team to ensure better visibility in the future.

Thanks!

#3

Zenarmor (Sensei) / Re: How to block Firefox VPN

Last post by nutty_net - Today at 04:43:59 AM

Thanks Seimus.  In re-reading, I think I misunderstood: I thought the custom app function itself was broken. 

#4

Zenarmor (Sensei) / Re: How to block Firefox VPN

Last post by Seimus - Today at 02:17:10 AM

At least for my Custom apps I am not aware currently of any FIX.
ZA support and DEV team is aware but currently its in the backlog. They are trying to find a slot to put on active work.

Regards,
S.

#5

26.1, 26,4 Series / os-ndp-proxy says it is forwar...

Last post by really_lost - Today at 01:58:19 AM

Is there a firewall setting that may need tweaking to get ndp-proxy NA's to go through?  They aren't making it to the upstream interface, and I think that will solve my issue.

I'm certain I'm doing something wrong. I'm also certain this is as much a Comcast/XFinity issue as it is an OPNsense one.

I'm using OPNsense 26.4.2p3.  I have a Comcast Business class with static IPs.  I have a /29 for ipv4 and a /56 for ipv6.  Comcast will only permit me to request prefix delegations no larger than /59.  Packet captures show if I request multiple /59 PD's, Comcast says I have them.

However, only ipv6 /64's in the firstly requested /59 fully route.

For those that fail, remote packet captures show the packets making it to my Comcast modem and failing.

Packet captures on my OPNsense box's WAN interface, show Comcast sending a neighbor solicitation packet and not getting a reply.  NOTE: for anything in the first PD requested, Comcast does not send NS requests.  It just sends the packets to OPNsense.

After frequent attempts to set this up and knocking parts of my family's internet out, I am just trying on one isolated test system.

I tried setting up os-ndp-proxy-go to have Comcast as the upstream interface and the downstream interface as the one connected to my test system as the downstream.

In that setup, via packet captures on OPNsense, I see Comcast send an NS to my WAN.  I see OPNsense send an NS to my test system.  I see my test VM send a Neighbor Advertisement.  I do not see an NA go out my WAN interface. 

NDP Proxy debug logs say that it is forwarding the NA to the upstream. 

Custom WAN dhcpv6.conf:

Code Select Expand

interface igb0 {
  send ia-na 0;
  send ia-pd 0;
  send ia-pd 1;
  send ia-pd 2;
  request domain-name-servers;
  request domain-name;
  script "/var/etc/dhcp6c_wan_script.sh";
};
id-assoc na 0 {
};
id-assoc pd 0 {
  prefix 2603:XXXX:XXXX:XX60::/59 infinity;
  prefix-interface igb2 {
    sla-id 26;
    sla-len 5;
    ifid 1;
  };
  prefix-interface igb1 {
    sla-id 0;
    sla-len 5;
  };
  prefix-interface igb3 {
    sla-id 30;
    sla-len 5;
  };
};
id-assoc pd 1 {
  prefix 2603:XXXX:XXXX:XXe0::/59 infinity;
  prefix-interface ix2 {
    sla-id 1;
    sla-len 5;
  };
};
id-assoc pd 2 {
  prefix 2603:XXXX:XXXX:XX20::/59 infinity;
};
NDP Proxy settings:

You cannot view this attachment.

NDP Proxy log saying it is forwarding the NA:

You cannot view this attachment.

#6

General Discussion / Re: Free GeoIP Database to use...

Last post by pfry - Today at 12:18:55 AM

[...]Not sure if this is a permitted use of Internet registry info, though.

I imagine all use it at some level. The RPSL registries might give some useful additional info (mainly origin AS), but even that may not provide useful geolocation. I haven't looked at the RADB in years... not sure what's become of it or other IRRs. The RIRs were generally better maintained... heh. A few BGP tables from various route servers could provide additional data. Might be hard to avoid being a pest while gathering said data, although that says more about the infrastructure than the task itself. Too, things might be different these days.

#7

General Discussion / Re: Free GeoIP Database to use...

Last post by cookiemonster - October 16, 2026, 10:30:59 PM

I see the intended use, thanks Patrick. Indeed is a redistribution.

#8

General Discussion / Re: Free GeoIP Database to use...

Last post by Patrick M. Hausen - October 16, 2026, 10:25:43 PM

They are providing a database that could be used by the builtin functionality. As an alternative to Maxmind or IPinfo.

Not sure if this is a permitted use of Internet registry info, though.

#9

General Discussion / Re: Free GeoIP Database to use...

Last post by cookiemonster - October 16, 2026, 10:19:32 PM

What's wrong with using the built-in functionality https://docs.opnsense.org/manual/aliases.html#geoip ?

#10

General Discussion / Re: opnsense wont boot on APU2...

Last post by robertkwild - October 16, 2026, 09:43:10 PM

Hey nice one viragomann thanks I got them off using msata reader with freebsd laptop