"Recent posts
#1
26.7 Series / Re: SSH to opnsense fails afte...
Last post by newsense - Today at 03:43:19 AM> Breakdown of the rule:
-- Interface: ZN_WAN (group with WAN1 and WAN2 interfaces)
-- Version: IPv4+IPv6
-- Protocol: TCP
-- Destination Address: This firewall
-- Destination Port: TCP/22
-- Redirect Target IP: Git server
This rule won't ever match
-- Interface: ZN_WAN (group with WAN1 and WAN2 interfaces)
-- Version: IPv4+IPv6
-- Protocol: TCP
-- Destination Address: This firewall
-- Destination Port: TCP/22
-- Redirect Target IP: Git server
This rule won't ever match
#2
26.7 Series / Re: Installed 26.7 - Trying to...
Last post by newsense - Today at 03:04:58 AM> Installation out of date. The update to opnsense-26.7.2_2 is required.
To solve this conundrum the following steps must be followed:
1- Learn how to read and follow instructions
2- Update OPNsense to the latest stable version
3- Install and configure plugins
4- Forget about Development versions. There be Dragons and reading is a mandatory skill.
To solve this conundrum the following steps must be followed:
1- Learn how to read and follow instructions
2- Update OPNsense to the latest stable version
3- Install and configure plugins
4- Forget about Development versions. There be Dragons and reading is a mandatory skill.
#3
German - Deutsch / Re: Netzwerkproblem
Last post by knebb - Today at 02:47:28 AMMoin,
an dem Setup ist nichts falsch- fast keiner der bisherigen Antwortenden hat das erkannt.
1. Die Regel erlaubt nur TCP. `tcpdump` ist aber UDP. Und `ping` ist ICMP. Kann nicht gehen, werden beide auf dem Hinweg blockiert.
2. Der erste `tcpdump` auf das LANGw der OpnSense ist erfolgreich, weil die Sense das Paket zuerst einmal als "eingehend" erkennt (und nicht als weiteleiten an LAN) und bereits antwortet, bevor die Regeln angewendet werden. Das liegt daran, dass sie selbst ja das LLAN-Gateway ist und damit ist ihr auch egal, in welchem Netz das LAN-Gw hängt. DEshalb antwortet sie auch mit ihrer LAN-IP. ISt also auch richtig soweit.
3. Die IP-Ranges (/24er Maske angenommen) passen, auch wenn das LAN das normalerweise verwendete LAN der Fritz! ist. Sofern das sauber durchkonfiguriert ist, gibt es keinen Grund, das nicht zu werwenden.
Also: Regel um TCP&ICMP ergänzen, dan nerneut testen. Sollte eigentlich danach schon funktionieren.
an dem Setup ist nichts falsch- fast keiner der bisherigen Antwortenden hat das erkannt.
1. Die Regel erlaubt nur TCP. `tcpdump` ist aber UDP. Und `ping` ist ICMP. Kann nicht gehen, werden beide auf dem Hinweg blockiert.
2. Der erste `tcpdump` auf das LANGw der OpnSense ist erfolgreich, weil die Sense das Paket zuerst einmal als "eingehend" erkennt (und nicht als weiteleiten an LAN) und bereits antwortet, bevor die Regeln angewendet werden. Das liegt daran, dass sie selbst ja das LLAN-Gateway ist und damit ist ihr auch egal, in welchem Netz das LAN-Gw hängt. DEshalb antwortet sie auch mit ihrer LAN-IP. ISt also auch richtig soweit.
3. Die IP-Ranges (/24er Maske angenommen) passen, auch wenn das LAN das normalerweise verwendete LAN der Fritz! ist. Sofern das sauber durchkonfiguriert ist, gibt es keinen Grund, das nicht zu werwenden.
Also: Regel um TCP&ICMP ergänzen, dan nerneut testen. Sollte eigentlich danach schon funktionieren.
#4
Tutorials and FAQs / Re: OPNsense does not recogniz...
Last post by Ice21 - Today at 02:11:00 AMI have a question though. I bridged the Netgear router to OPT1 and the network switch to OPT2. With my laptop connected via ethernet to the switch, how do I connect to the Netgear router to change its settings. I check my router IP settings but it's not registering. I'm now considering having the Netgear router itself as the sole LAN connection to the OPNsense router and just stem the network switch off of that.
#5
26.7 Series / Re: os-upnp plugin not working...
Last post by Cljackhammer - Today at 12:26:56 AMI'm experiencing the same issue. Is this plugin still supported?
#6
General Discussion / Re: Settings tab position in A...
Last post by camellia - August 23, 2026, 11:54:53 PMI cited "Reporting: Health" and "Reporting: Unbound DNS" as examples of good usability. I don't necessarily look for consistency.
I think it is appropriate to regard functions that operate temporarily such as "DNS Lookup" and "Trace Route" as diagnostic functions. And regarding the diagnostic function, I think it makes sense to display "Settings" first.
However, since "Automatic Discovery" is a function that operates continuously, wouldn't it be appropriate to regard it as a reporting function? And regarding the reporting function, I think it is appropriate to display the report results first from a usability perspective.
I think it is appropriate to regard functions that operate temporarily such as "DNS Lookup" and "Trace Route" as diagnostic functions. And regarding the diagnostic function, I think it makes sense to display "Settings" first.
However, since "Automatic Discovery" is a function that operates continuously, wouldn't it be appropriate to regard it as a reporting function? And regarding the reporting function, I think it is appropriate to display the report results first from a usability perspective.
#7
High availability / Re: Migrating WAN DUID + MAC f...
Last post by Patrick M. Hausen - August 23, 2026, 11:43:20 PMCould you please format this in way so it's readable?
#8
High availability / Re: Migrating WAN DUID + MAC f...
Last post by Wynbr00k - August 23, 2026, 10:53:51 PMThis started with a default install of OPNsense 26.7.1 on both primary (OPNsense-Master) and failover (OPNsense-Backup) firewalls. Identity Association was configured on Master LAN to use the single IPv6 PD from the AT&T BGW320 gateway also with Passthru configured for the public IPv4 address. HA was configured between master & backup. Dnsmasq & Unbound were configured to fully support IPv4 & IPv6. Dnsmasq IPv4 DHCPv4 range, Host reservations and A Ptr records and IPv6 SLAAC, RA-Names, AAAA Ptr records. Unbound configured as forwarder for local domain and associated reverse lookup domains and NSLOOKUP, DNS, PING test for IPv4 & IPv6 forward & reverse local and public lookups. Now I wanted to have this failover cleanly in case of hardware failure or a manual failover for software updates/testing. Couple gothchas known and unknown. I wanted IPv4 & IPv6 to failover correctly, but to do this RA services had to move from Dnsmasq to Services: Router Advertisements for CARP integration/compatibility/trigger. Defined three (3) LAN CARP VIPs (IPv4 addr, IPv6 LL, IPv6 GUA) all based off a vMAC/vDUID combo that would only be live/configured on one (the CARP MASTER) firewall at a time. The vMAC/vDUID preserved the same IPv6 PD prefix handed out by the AT&T BGW and if you also assign the vMAC as the Passthru MAC on the BGW, the public IPv4 address is preserved across failovers. The two IPv6 vhid(s) were used in the RA for source (LL) and RDNSS (GUA). But this entailed turning off the Dnsmasq RA which in turn broke the AAAA 'glean' of IPv6 SLAAC/neighbor IPv6 addresses. turns out you can still config Dnsmasq for slaac, ra-names but set the lifetime to '0' which effectively turns the RA off but still allows Dnsmasq 'gleaning' of AAAA records; win - win. So here's the document detailing a weeks work progress. The CARP syshook for Master & Backup is near the top if you don't want to bother reading. Couple of things to note (it surprised me): no LAN interface configuration necessary, all accomplished by CARP; NOTE: very odd that IPv6 Mode is 'None' on both LAN interfaces all the time but IPv6 is fully functional IPv6 when in CARP MASTER. WAN interface is always IPv4 Mode DHCPv4 and WAN IPv6 Mode is either 'None' (CARP BACKUP) or DHCPv6 (CARP MASTER). That's what the syshook script does fairly cleanly. Hopefully the attachment works.
#9
26.7 Series / Re: Make my backup history saf...
Last post by Patrick M. Hausen - August 23, 2026, 10:41:15 PMAre you using the os-git-backup plugin? Because if you don't I don't quite get what you are talking about. There is no git repo in /conf/backup.
And you cannot undelete a file on UFS, sorry. Neither can you do that on ZFS. ZFS only lets you roll back if you created a snapshot before the delete operation. Manually or automated, but ZFS does not do versioning or history on its own.
And you cannot undelete a file on UFS, sorry. Neither can you do that on ZFS. ZFS only lets you roll back if you created a snapshot before the delete operation. Manually or automated, but ZFS does not do versioning or history on its own.
#10
26.7 Series / Re: SOLVED: interface works fr...
Last post by Patrick M. Hausen - August 23, 2026, 10:36:06 PMIf the interface is not configured up it won't go operationally up when you plug in a cable, either. Configured down is like switched off.
