"Recent posts
#1
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by really_lost - Today at 12:02:53 AMInstalling the legacy firewall plug-in, performing the migration I missed on NAT, and uninstalling the legacy plugin worked.
#2
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by Manfred.Knick - November 02, 2026, 11:51:59 PMC.f. Migration Notes:
(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.
AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.
Having migrated early, I can't test if the plugin is necessary for the Migration assistant.
Hth.
(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.
AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.
Having migrated early, I can't test if the plugin is necessary for the Migration assistant.
Hth.
#3
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by viragomann - November 02, 2026, 10:09:36 PMQuote from: really_lost on November 02, 2026, 08:54:20 PMThat's why I was wondering if it is as simple as installing the old rule plugin and then proceeding.This worked for me on 26.7.8.
Installed the legacy rules plugin, exported the outbound NAT rules and imported the file on the source NAT page and deleted the old rules finally.
After this was done, I removed the plugin again.
#4
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - November 02, 2026, 10:05:23 PMHi,
Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:
1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.
To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?
Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.
Sergio
Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:
1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.
To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?
Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.
Sergio
#5
High availability / Re: Aliases to support "No XML...
Last post by BoNetTech - November 02, 2026, 10:02:05 PMThanks Franco. Ticket opened: https://github.com/opnsense/core/issues/11142
#6
Tutorials and FAQs / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - November 02, 2026, 09:52:28 PMHi thanks for the reply.. I copied from notepad just written out. I'm trying to get OpnSense working in general with Wireguard and the vlans.
I have a modem in bridge mode provided by my isp to the (WAN) of The mini PC. It is OK and working I have 2 NICs 128ssd 4gb ram. I installed the Zfs with no other partitions, wiped fresh.
From mini PC (LAN) to switch port 1. I guess that's the trunk? I have 8 port Tp link TLSG108E managed.
I wanted to do the installation and setup offline until the end to test the VPN and kill switch. I want all vlans to go through wireguard VPN no fallback on ISP. I want to have the management local only through wired offline connection.
I did have this working somewhat with no loss to web ui but I changed something while doing DNS and it lost access..
I have 4 vlans set up,
Port1- Trunk
Port2,6- Vlan20 for PC
Ports3,4,5 - Vlan10 for consoles
Port7 - Vlan30 Guest (WiFi ap later)
Port8 - Vlan99 Management
I think everything is setup correctly up until I started doing dnsmasq and dhcp. I don't understand these and used chatgpt but got locked out of the web ui.
I can access when I hook a keyboard up to the mini pc and enter shell, then pfctl -d, that let's me access again from My management vlan99 on port 8.
Then once I log in on PC, I enter pfctl -e in shell to activate it again.
I can change whatever and log out log in but as soon as I close the broswer it wipes the data on there and I can't get back in whereas before I could after clearing cookies and data.
I've got a handshake from wireguard but I can't access the internet from anything so I searched what it could be, suggestions were dns, firewall rules, dhcp, I've never fully went to a website or anything online yet.
I started to attempt to fix that, but lost access now I have multiple problems and I'm not much of a tech person, I do know a little bit I'm trying to learn as much as I can.
The bit about the tutorials is for the killswitch floating rule.
The tutorial says to make a floating rule for the WAN to interface with matching tag to block ISP fall back if connection is lost, but when I click apply on that rule it disappears from floating rules and ends up under WAN rules instead. Its confusing for me to understand when I don't know the basic all that well, this seems for far more advanced people than for my level 😅
I used chatgpt for this whole setup guide so far I told it to use opnsense.org documentation for any reference and no guessing if that helps any.. I dont want to come into a space im still learning about by using ai to do it for me i want to actually learn how to get this running.
I hope that can give a better picture of what I have going on. I don't know what you need to know for my settings but just let me know.
I have a modem in bridge mode provided by my isp to the (WAN) of The mini PC. It is OK and working I have 2 NICs 128ssd 4gb ram. I installed the Zfs with no other partitions, wiped fresh.
From mini PC (LAN) to switch port 1. I guess that's the trunk? I have 8 port Tp link TLSG108E managed.
I wanted to do the installation and setup offline until the end to test the VPN and kill switch. I want all vlans to go through wireguard VPN no fallback on ISP. I want to have the management local only through wired offline connection.
I did have this working somewhat with no loss to web ui but I changed something while doing DNS and it lost access..
I have 4 vlans set up,
Port1- Trunk
Port2,6- Vlan20 for PC
Ports3,4,5 - Vlan10 for consoles
Port7 - Vlan30 Guest (WiFi ap later)
Port8 - Vlan99 Management
I think everything is setup correctly up until I started doing dnsmasq and dhcp. I don't understand these and used chatgpt but got locked out of the web ui.
I can access when I hook a keyboard up to the mini pc and enter shell, then pfctl -d, that let's me access again from My management vlan99 on port 8.
Then once I log in on PC, I enter pfctl -e in shell to activate it again.
I can change whatever and log out log in but as soon as I close the broswer it wipes the data on there and I can't get back in whereas before I could after clearing cookies and data.
I've got a handshake from wireguard but I can't access the internet from anything so I searched what it could be, suggestions were dns, firewall rules, dhcp, I've never fully went to a website or anything online yet.
I started to attempt to fix that, but lost access now I have multiple problems and I'm not much of a tech person, I do know a little bit I'm trying to learn as much as I can.
The bit about the tutorials is for the killswitch floating rule.
The tutorial says to make a floating rule for the WAN to interface with matching tag to block ISP fall back if connection is lost, but when I click apply on that rule it disappears from floating rules and ends up under WAN rules instead. Its confusing for me to understand when I don't know the basic all that well, this seems for far more advanced people than for my level 😅
I used chatgpt for this whole setup guide so far I told it to use opnsense.org documentation for any reference and no guessing if that helps any.. I dont want to come into a space im still learning about by using ai to do it for me i want to actually learn how to get this running.
I hope that can give a better picture of what I have going on. I don't know what you need to know for my settings but just let me know.
#7
26.7, 26.10 Series / Re: Upgrade from 26.7.7 to 26...
Last post by danmac - November 02, 2026, 09:50:05 PMI think your nearest mirror would be LeaseWeb (HTTPS, San Francisco, US) you could try that
your problem looks somewhat familiar, you are by no means the first to battle the updater along similar lines:
https://forum.opnsense.org/index.php?topic=52388.0
although I cannot recommend tinkering off-piste with the update scripts as I've done, given that yours is production gear you can't just reach over to hit with a hammer, plus I haven't checked if those changes even apply to the download that's failing on yours
good luck o7, pmji :)
your problem looks somewhat familiar, you are by no means the first to battle the updater along similar lines:
https://forum.opnsense.org/index.php?topic=52388.0
although I cannot recommend tinkering off-piste with the update scripts as I've done, given that yours is production gear you can't just reach over to hit with a hammer, plus I haven't checked if those changes even apply to the download that's failing on yours
good luck o7, pmji :)
#8
26.7, 26.10 Series / Re: 26.7.7: Lark HTTPS connect...
Last post by pfry - November 02, 2026, 09:37:40 PMQuote from: Brilliant Technologies Lt on November 02, 2026, 05:46:23 PM[...]Live View showed TCP/443 from the affected client to 95.100.110.24 blocked under 'Default deny / state violation rule'. TCP flags and exact correlation with a fresh connection attempt were not captured. Kernel logs also show 'pf: BAD state' and 'pf: loose state match' involving other clients; these are not proven related to this client's Lark failure.[...]
Looks like a failed session setup, i.e. no state = timeout. I'd start with the info (specifically TCP flags) from that state violation - it's easiest to view from the "i" in the Live View; it's also in the session log. A loose match may be normal (it's the default); state mismatches can stem from path inconsistencies (bypassing the firewall). Given the loose state default, bypassing the expected interface is generally less of an issue.
#9
26.7, 26.10 Series / Re: Automated API-driven certi...
Last post by klinebau - November 02, 2026, 09:36:06 PMThank you for posting this!
I've been working on the automation of my certificate renewals and this showed up at a good time. Your script is well thought out and now I am using it for the opnsense renewals.
I've been working on the automation of my certificate renewals and this showed up at a good time. Your script is well thought out and now I am using it for the opnsense renewals.
#10
26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...
Last post by danmac - November 02, 2026, 09:21:55 PMas an aside I left the firewall using fetch without the -a flag downloading aforementioned 20 gig huggingface file for about 10 minutes and it didn't hiccup once
this may go some way to explaining why others have found changing mirrors helps (didn't for me but I only tried 3 - 4 not the whole lot, I remember OPNsense official seemed to break sooner in the xfer than the others)
it has been a little while since i broke out wireshark but clearly there is still a mystery up for grabs, it's just not super tempting right now if im honest, so i can understand how it's even less tempting for anyone else - i set this one up initially like 8+ years ago so it could probably use a reinstall by now (not to mention finally biting the IPv6 bullet lol) meanwhile I can watch a livestream while downloading 20 gig files reliably, and now my firewall updates, too
im happy to have contributed at least an alternate workaround that seems solid in my case, ur welcome, fellow 5G peasants ;)
maybe there is a case to be made for making -a the default (or perhaps for more work, gated behind an optional tickbox in the config with the proviso "your MTU or something is probably goosed if you have to click this and you should feel bad" but that's above my pay grade
o7 :)
this may go some way to explaining why others have found changing mirrors helps (didn't for me but I only tried 3 - 4 not the whole lot, I remember OPNsense official seemed to break sooner in the xfer than the others)
it has been a little while since i broke out wireshark but clearly there is still a mystery up for grabs, it's just not super tempting right now if im honest, so i can understand how it's even less tempting for anyone else - i set this one up initially like 8+ years ago so it could probably use a reinstall by now (not to mention finally biting the IPv6 bullet lol) meanwhile I can watch a livestream while downloading 20 gig files reliably, and now my firewall updates, too
im happy to have contributed at least an alternate workaround that seems solid in my case, ur welcome, fellow 5G peasants ;)
maybe there is a case to be made for making -a the default (or perhaps for more work, gated behind an optional tickbox in the config with the proviso "your MTU or something is probably goosed if you have to click this and you should feel bad" but that's above my pay grade
o7 :)
