"Recent posts
#1
Virtual private networks / Re: Access of OpenVPN clients ...
Last post by HatalaTitla48 - Today at 01:38:46 AMUf, I already tried this, but I forgot to put openvpn internal route subnet 192.168.202.0/27 to ipsec internal subnets...I need vacation for real.
Thx boss!
Thx boss!
#2
Hardware and Performance / Re: Semi parts bin new build
Last post by pfry - Today at 01:19:34 AMQuote from: Greg_E on October 22, 2026, 10:33:13 PM[...]New 10Gtek quad port is about $125usd.[...]
10GTek is a standard OEM - they usually modify their PC boards and heat sinks (from the Intel references), and their firmware is updateable using Intel's utilities. (YMMV, of course. Intel-based cards only; my experience is with one X550.)
Heh. I haven't seen a quad X710 for $125, though (unless $150 counts).
Edit: It looks like 8257x cards are still available. I'd avoid those for anything other than Linux.
#3
Hardware and Performance / Re: Semi parts bin new build
Last post by opnsenseguy - Today at 01:18:40 AMI do have a Dell Intel 4V7G2 X550-T2 2 port 10Gb that I could use or atleast I've used in the past and can grab from a machine or buy another.
I don't have huge bandwidth needs. This is a residential setting and we don't do any torrents and very little streaming.
Two ports is all I need: one for WAN and one for LAN. I have a L3 switch.
I don't have huge bandwidth needs. This is a residential setting and we don't do any torrents and very little streaming.
Two ports is all I need: one for WAN and one for LAN. I have a L3 switch.
#4
26.7 Series / firmware > status is loading f...
Last post by frju365 - Today at 12:28:37 AMHello,
I did last upgrade. The upgrade was already really slow. And after reboot, status page is just... loading forever. I didn't see anything in logs from the interface. Do you have an idea where the pb could come from ? or perhaps do you have an idea how I can debug it ?
Extension/packages pages are blank.
Thanks in advance for your answer
frju365
UPDATE : I successfully solve it by rebooting firewall and waiting 10min on the page... still thinking there is a problem.
I did last upgrade. The upgrade was already really slow. And after reboot, status page is just... loading forever. I didn't see anything in logs from the interface. Do you have an idea where the pb could come from ? or perhaps do you have an idea how I can debug it ?
Extension/packages pages are blank.
Thanks in advance for your answer
frju365
UPDATE : I successfully solve it by rebooting firewall and waiting 10min on the page... still thinking there is a problem.
#5
Virtual private networks / Re: Access of OpenVPN clients ...
Last post by viragomann - Today at 12:14:04 AMThis assumes, that you administer both sites of the IPSec and that it's in tunnel mode. If so, there is no need for manual SPDs.
On both nodes add an IPSec child for 192.168.202.0/27 <> 172.25.26.0/24.
Ensure that both adds the respective sPDs properly.
In the OpenVPN server settings add 172.25.26.0/24 to the "Local Networks" to push to route to the clients.
On both nodes add an IPSec child for 192.168.202.0/27 <> 172.25.26.0/24.
Ensure that both adds the respective sPDs properly.
In the OpenVPN server settings add 172.25.26.0/24 to the "Local Networks" to push to route to the clients.
#6
Italian - Italiano / Re: Consiglio per aggiornament...
Last post by BoNetTech - October 22, 2026, 11:59:28 PMCiao,
premetto che non ho provato personalmente questo stack di plugin sulla 26.7, quindi non posso dirti se ci sono regressioni su Zenarmor, CrowdSec o Tailscale. Ti scrivo come ragionerei io per un aggiornamento in produzione.
1) Il salto è grande: la 26.7 usa una base FreeBSD diversa dalla tua (FreeBSD 15.1 invece della 14.3) e le note di versione parlano anche di pagine del firewall spostate in un plugin a parte. Leggi con calma le note della serie 26.7 sul sito della documentazione prima di partire.
2) I plugin esterni sono il punto più delicato, perché dipendono dalla base del sistema. Per Zenarmor controlla sul loro sito o sul loro forum se la 26.7 è dichiarata come supportata, e se serve aggiornare prima il pacchetto. Lo stesso vale per CrowdSec e Tailscale: guarda le note dei rispettivi plugin.
3) Meglio non partire dalla versione iniziale della serie: ormai ci sono molte versioni minori successive, e i problemi di aggiornamento segnalati all'inizio sono stati corretti nelle prime.
4) Prima di toccare qualcosa: copia della configurazione (hai già il plugin per il backup via SFTP) e, se il disco è in ZFS, uno snapshot del sistema da cui poter tornare indietro. Scegli un momento in cui un fermo di mezz'ora non crea problemi.
5) Aggiorna prima la 26.1 all'ultima versione minore disponibile, poi fai il salto alla 26.7. Se hai un secondo apparato o una macchina virtuale, prova prima lì con una copia della configurazione.
Se qualcuno ha già fatto questo passaggio con Zenarmor e CrowdSec, la sua esperienza vale più della mia.
Sergio
premetto che non ho provato personalmente questo stack di plugin sulla 26.7, quindi non posso dirti se ci sono regressioni su Zenarmor, CrowdSec o Tailscale. Ti scrivo come ragionerei io per un aggiornamento in produzione.
1) Il salto è grande: la 26.7 usa una base FreeBSD diversa dalla tua (FreeBSD 15.1 invece della 14.3) e le note di versione parlano anche di pagine del firewall spostate in un plugin a parte. Leggi con calma le note della serie 26.7 sul sito della documentazione prima di partire.
2) I plugin esterni sono il punto più delicato, perché dipendono dalla base del sistema. Per Zenarmor controlla sul loro sito o sul loro forum se la 26.7 è dichiarata come supportata, e se serve aggiornare prima il pacchetto. Lo stesso vale per CrowdSec e Tailscale: guarda le note dei rispettivi plugin.
3) Meglio non partire dalla versione iniziale della serie: ormai ci sono molte versioni minori successive, e i problemi di aggiornamento segnalati all'inizio sono stati corretti nelle prime.
4) Prima di toccare qualcosa: copia della configurazione (hai già il plugin per il backup via SFTP) e, se il disco è in ZFS, uno snapshot del sistema da cui poter tornare indietro. Scegli un momento in cui un fermo di mezz'ora non crea problemi.
5) Aggiorna prima la 26.1 all'ultima versione minore disponibile, poi fai il salto alla 26.7. Se hai un secondo apparato o una macchina virtuale, prova prima lì con una copia della configurazione.
Se qualcuno ha già fatto questo passaggio con Zenarmor e CrowdSec, la sua esperienza vale più della mia.
Sergio
#7
Hardware and Performance / Re: OPNsense on Sophos XGS: dr...
Last post by BoNetTech - October 22, 2026, 11:49:12 PMHi abdelmonem,
Thank you for sharing this, and for being so clear about the alpha status and what the installation involves. A few questions that matter for anyone who would use this in front of real networks:
1) Intrusion detection. If the coprocessor forwards a connection on its own after pf has passed it, I assume Suricata no longer sees the packets of that connection. Is that right? If so, is there a way to keep chosen traffic out of the offload, so it still goes through the IPS, and what happens to a connection that is already offloaded when the rules change?
2) Telemetry. You mention problem reports and a daily count that are scrubbed of anything identifying. Could you describe exactly which fields are sent, where they go, and whether the receiving side is documented? For many users the default matters, and an opt-in would be easier to accept than an opt-out.
3) Trust in the image. Since the image builder runs in the user's own fork and the driver sits in the kernel, how can a user check that the image matches the published source? Signed releases or reproducible builds would help a lot.
I do not own any of these units, so I cannot test, but I wish you good luck with the project.
Sergio
Thank you for sharing this, and for being so clear about the alpha status and what the installation involves. A few questions that matter for anyone who would use this in front of real networks:
1) Intrusion detection. If the coprocessor forwards a connection on its own after pf has passed it, I assume Suricata no longer sees the packets of that connection. Is that right? If so, is there a way to keep chosen traffic out of the offload, so it still goes through the IPS, and what happens to a connection that is already offloaded when the rules change?
2) Telemetry. You mention problem reports and a daily count that are scrubbed of anything identifying. Could you describe exactly which fields are sent, where they go, and whether the receiving side is documented? For many users the default matters, and an opt-in would be easier to accept than an opt-out.
3) Trust in the image. Since the image builder runs in the user's own fork and the driver sits in the kernel, how can a user check that the image matches the published source? Signed releases or reproducible builds would help a lot.
I do not own any of these units, so I cannot test, but I wish you good luck with the project.
Sergio
#8
General Discussion / Re: How to handle firewall hos...
Last post by viragomann - October 22, 2026, 11:39:18 PMQuote from: Bob.Dig on October 22, 2026, 06:26:22 PMI wonder, if I could also do some more rules on such a group like block RFC1918, allow internet and do those as non-quick.Of course you can add all rule, which should be applied to the all group members.
But I have just block rules for other DNS, DoT and NTP servers and a pass rule for ICMP on the group.
And even as mention port forwarding for DNS and NTP.
#9
General Discussion / Re: E-Mail Notify when new Fir...
Last post by passeri - October 22, 2026, 11:33:29 PME-mail notifications for me have been sporadic. I read the forum daily yet my awareness of the PHP patch came about six hours after it might have done. I do not regularly check the Opnsense GUI. Happily, based on comments in the CVE thread, I was not at any evident risk. Nevertheless, I wanted an improvement in timeliness.
Given my time zone, releases usually occur in my evening or through to dawn. I decided on an agent to check the Announcements page then send me a notification through Apple Notifications if there was a relevant change (not routine RC). While I am writing this a local LLM is building the agent, to run about when I rise and an hour before I usually retire. My routine visits to the forum will cover the day.
This is one of the possible solutions.
Given my time zone, releases usually occur in my evening or through to dawn. I decided on an agent to check the Announcements page then send me a notification through Apple Notifications if there was a relevant change (not routine RC). While I am writing this a local LLM is building the agent, to run about when I rise and an hour before I usually retire. My routine visits to the forum will cover the day.
This is one of the possible solutions.
#10
Virtual private networks / Re: Access of OpenVPN clients ...
Last post by HatalaTitla48 - October 22, 2026, 10:54:53 PMThx for reply.
Well situation is given and I cant switch from openvpn for roadwariors to something else. I already have functional IPsec s2s vpn running between boxes and there is not problem with that. Now I just need my openvpn users get to the subnets behind ipsec vpn on boxB(172.25.26.0/24). Iv get to the point of "Manual SPD entries in the IPSec Phase2", but even with this, its not working, I must just misst some crutial next step to get this working...
Well situation is given and I cant switch from openvpn for roadwariors to something else. I already have functional IPsec s2s vpn running between boxes and there is not problem with that. Now I just need my openvpn users get to the subnets behind ipsec vpn on boxB(172.25.26.0/24). Iv get to the point of "Manual SPD entries in the IPSec Phase2", but even with this, its not working, I must just misst some crutial next step to get this working...
