Recent posts

#1
Virtual private networks / Tips on Reliable IPsec Configu...
Last post by jambandfan_1996 - August 02, 2026, 11:54:08 PM
I'm new to the OPNsense community and recently tested a couple devices running 26.1 in GNS3, before I plan to deploy into our ecosystem later this month. I have the need for a reliable always on type route based IPsec tunnel.

I found the tutorial presented at https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-route.html to be easy to follow, although what I was left with initially following the tutorial were tunnels that exhibited some unreliable behavior. Notably tunnels not reconnecting following device restarts, requiring manual intervention, and tunnels that needed traffic initiated from both sides of the tunnel before allowing traffic across.

I'm far from a networking expert, so it took me about a day to get the connections working to my liking. I figured I would share what I learned to save any other newcomers some time.

Tunnels not passing traffic until something is initiated from both sides

Issue: For whatever reason, my tunnels would not send traffic routed to a vti across the ipsec link until a host on both sides of the link initiated a connection. For example, a host at 1 site could sit and ping a host across the tunnel all day and not get a response, until a host on the other side also tried to reach out to a host on the first side.

Resolution: I have no idea why this behavior happens, however I resolved it by making sure gateway monitoring on my vti interfaces is enabled. With the gateway monitoring option enabled on these interfaces, they are constantly pinging each other to check link health. As a result, the tunnels are able to pass traffic as soon as the link is established. I also set "Start action" to "start" and "dpd action" to "start" on the child configuration of the tunnel, but I'm not sure if that had much of an effect.

Links not connecting automatically following device restarts

Issue:Following the restart of one or more firewalls, the phase 1 connection would sometimes fail, and I would have to manually start the connection from the "status overview" page after the firewalls were up for a minute.

Resolution: After some research I found the "keyingtries" option under vpn-ipsec-connections-[connection]-advanced apparently defines how many times the device will try to establish the connection before giving up. I'm not sure what this defaults to but if you set to 0, that basically has it try forever. I also set the "version" option from the default to "IKEv2", but I'm not sure if that had any effect.

Hope someone can find this info useful!

#2
German - Deutsch / Re: BIOS Einstellungen - Harde...
Last post by nero355 - August 02, 2026, 11:26:05 PM
Quote from: johnydo on August 02, 2026, 10:09:09 AMAdvanced – Trusted Computing
TPM Support > Aktivieren
AUS !!! mit die TCPA/Palladium scheiBe bitte !!!


/The best German that I could do... LOL! ;)
#3
26.7 Series / Re: Upgrade to 26.7 from 26.1....
Last post by nero355 - August 02, 2026, 11:20:13 PM
You seem to have multiple issues :
- Some RealTek NICs no longer work in FreeBSD 15.x a.k.a. OPNsense 26.7 !!
- You might have the Intel/AMD microcode plug-in issue too : You need to uninstall it before upgrading to 26.7 !!
- And then you need to upgrade the FreeBSD Bootloader from the old version to the most recent FreeBSD 15.x version !!
- Then Enable the Intel/AMD microcode plug-in again if you want to keep using it.

But if your NICs are no longer supported then it's time to consider a hardware upgrade first and simply do a fresh install and configuration... :(


Good luck! :)
#4
26.7 Series / Re: VLAN devices are on LAN IP...
Last post by nero355 - August 02, 2026, 11:13:51 PM
Quote from: tonys on August 02, 2026, 09:45:45 PMThe untagged LAN + both tagged VLANs are on igc0 (port 1 of the Protecli) and go ONLY to the Unifi AP.
If you need the VLAN 1 stuff for Ubiquiti UniFi equipment then this would be the right setup :

OPNsense :
- NIC #1 = LAN Untagged
- NIC #2 = Additional Tagged VLANs

Add a Switch between OPNsense and the UniFi UAP :
- Switch Port #1 = Untagged and connected to OPNsense NIC #1
- Switch Port #2 = Tagged and connected to OPNsense NIC #2

- Switch Port #3 that has PoE or PoE+ Output and carries :
Untagged LAN network from OPNsense NIC #1 coming from Switch Port #1
Tagged Additional VLANs from OPNsense NIC #2 coming from Switch Port #2

UniFi UAP :
- Connected to Switch Port #3 that has PoE or PoE+ Output and is then reachable via VLAN 1 which will be the OPNsense LAN network from NIC #1.
- The WiFi SSIDs will then use all the Tagged Additional VLANs from OPNsense NIC #2.


I hope the above is clear enough and if you have questions then let me know :)
#5
26.7 Series / Re: 26.7 NAT port map trouble
Last post by meyergru - August 02, 2026, 10:54:58 PM
Correct, the source address is NOT your WAN address. And if you want to rule out further errors in the firewall rules, use "pass" before you try something more difficult.
#6
26.7 Series / Re: Multiple VLANs - sometimes...
Last post by nero355 - August 02, 2026, 10:54:17 PM
Quote from: danman on August 02, 2026, 05:59:10 AMI hope so :D
I am confused by the following :
QuoteI watched a video last night that you should suppose to set the VLAN PVID only on untagged ports but how does opnsense know which VLAN to handle the switch with then? And I always changed the PVID to work with OpenWrt and this works fine for years that way.
&
QuoteSo that basically means to me, that I probably should set up on opnsense igc1 port with the right IP range (25)?

I'm trying to set the switch on VLAN ID 25 same for the openwrt but it always gets 80 and sometimes 60.
If I set a static ip for the switch that would work too but as I mentioned there are coming a few more devices with TAGGED ports and I dont wanna play that game.
&
QuoteSo if I can't use PVID 25 for Port 4 & 5 to tell OPNsense in which DHCP/IP range it should put those devices how can I change it on opnsense side and not setting up static IPs?
&
Quote from: danman on August 02, 2026, 01:24:57 PMI need to somehow tell the switch to connect to the specific VLAN ID 25 which would mean, whenever I use a device to trunk VLANs I'll need to set a static IP  for that particular device as well.
Because I've a few devices/VMs I would like to avoid that :D
&
QuoteThe issue is here how can I tell opnsense that the switch I use to trunk the VLANs to to put this switch in IP range 25 (VLAN ID 25) without static IP and without PVID?
What are you trying to achieve ?!

- Setting the correct Management IP Address for the webGUI of the Switch ?
- Getting the right subnet to specific Clients connected to the Switch ?

In general there are the following options when connecting things :

- Router <---> Switch = Always Tagged.
- Switch <---> Switch = Always Tagged.
- Switch <---> Accesspoint = Always Tagged.
- Switch <---> Wired Clients = Untagged.
- Accesspoint <---> Wireless Clients = Tagged VLAN in the SSID Settings and once the Wireless Clients connect they get an Untagged connection.

However... in some cases... you need to also add one Untagged VLAN in order to have a Management IP Address for Switches and Accesspoints and this subnet comes from a seperate Untagged NIC in the case of OPNsense as I was trying to explain to your earlier on !!

Quote from: danman on August 02, 2026, 01:59:28 PMOPNsense
  • all VLANs are running on Port 1 (igc1)
  • IP set
  • DHCP set
Can we assume that each VLAN Interface has it's own Subnet and active DHCP Server + the right Firewall Rules ?

In other words : You are not trying to spread one Subnet and DHCP Server across multiple VLANs ?

/Just checking!

Quoteswitch on port 5
  • all tagged, nothing untagged on port 5
  • PVID doesn't matter
  • for now only static IP works
If you don't get any DHCP IP Address then there is an error in your configuration => See my previous questions !!

Quoteopenwrt AP
  • all tagged from switch port 4 to WAN port
  • VLANs created
  • WiFi 2.4 for VLAN ID 80 and wifi 5 for VLAN 50 (but it connects to ID 60/80 or whatever)
Looks like another configuration error! Possibly between the Switch and the Accesspoint ?!

QuoteI just hooked the switch and the openwrt AP device onto my current set up with the main openwrt router. VLAN configs are the exact same for the AP and switch like I try to use with the opnsense router.
That works very good. Thats not helpful :D
Then you need to fix your OPNsense configuration :P

Please read as much as related information possible @ https://docs.opnsense.org/ and double check your settings !!
#7
26.7 Series / Re: 26.7 NAT port map trouble
Last post by dseven - August 02, 2026, 10:51:09 PM
The source address will not be your WAN address - it'll be that of the client making the connection. You probably don't want to set that at all (unless you want to restrict access to just that source)
#8
German - Deutsch / Re: Hardware für 10gbit
Last post by MarroniJohny - August 02, 2026, 10:37:46 PM
Da muss man halt auch differenzieren. Ein einzelner TCP Stream ≠ mehrere UDP Streams. Wenn Gesamtdurchsatz mit 10 Gbit beworben ist, kann es gut sein, dass da auch ohne IDS oder VPN bei weitem nicht in jeder Lebenslage wirklich 10 Gbit/s durchgehen. Hab das mit der Sense noch nicht wirklich getestet, aber bin bei meiner Uraltgurke immer ganz amüsiert, wenn da 8 Gbit im Speedtest auf der Uhr stehen. Und die drei X540 laufen hinter einem PLX Chip an PCIe 3.0. Aber ein einzelner TCP Download macht halt gerade mal 1 Gbit/s. Kann aber auch an meinen uralt Servern dahinter liegen, da liegt alles auf DC-SATA und SAS Platten.

Wie hast Du denn gemessen? Speedtest? iPerf? Beim Speedtest auch darauf achten, die CLI Version zu nehmen. Sonst kann es sein, dass schlicht die blöde App limitiert.

Und der TE will sich mal ein Homelab mit 10 Gbit/s aufbauen. Da sollte man die Kirche vielleicht im Dorf lassen, und erst mal seine Anforderungen abklopfen, bevor da von einer Hardware abgeraten wird. Die 10 Gbit/s musst Du erst mal bedienen können, und damit meine ich Down- und Upload.

Btw. hat letzte Nacht ein init7 User meinen Server gebencht. Mit Windows 7 und *husthust* Internet Explorer. Muss da aber Entwarnung geben, meine Website läuft extern, und ist nur mit 1 Gbit/s angebunden. Zumindest der Grossteil davon. War das einer von euch Spezialisten? Aber macht ruhig, mein Hoster ist sich gewohnt, dass die Seite 2-3 TB Traffic im Monat macht.
#9
26.7 Series / 26.7 NAT port map trouble
Last post by bitdigger - August 02, 2026, 10:37:31 PM
I made a fresh install of 26.7 with the latest upgrades available. I have a VERY basic configuration. All I need is what used to be called "NAT Port foreward" to a local host. TcpV4 only one Port to one host on the lan. Thats it.
The host can access the internet without issues. When trying to connect to the service from the WAN, the requests arrive (in the logs) but are blocked with "Default deny / state violation rule". Yes, sure, but why? I created an alias for the host with its internal IP as well as an alias for the non standard port to be used. Then I created a Destination NAT Rule like this:

Interface WAN, Version IPv4, Protocol TCP, Source Adress WAN Adress, Port any, Destination Adress "WAN Adress", Destination Port "the port alias", Redirect Target IP "the host alias" options "log" and "register firewall rule".

I played around with everything I could think of to no avail. I tried setting up a manual rule, and with manual and registered rule also tried by changeing those settings which are IMHO new in 26.7. Really all I could think of that could make sense but to no avail. I am trying now for several hours. I know, this should be stupid simple, but aparently I am stupid. I am really really frustrated to be honest and would be very happy if someone could point me in the right direction! The fact that 26.7 is so new and internet searches show the good old times where one could simply set up a port foreward does not really help either... Please help me!

TIA Markus
#10
26.7 Series / Upgrade to 26.7 from 26.1.11 f...
Last post by HarveyEllis1 - August 02, 2026, 10:20:22 PM
I have a mini-pc that I use for Opnsense transparent filtering bridge. It has Realtek dual NICs and I use an ethernet to USB interface for management network.


I started upgrade to 26.7
It progressed normally with last successful messages during upgrade:

> [7/279] Extracting  os-realtek-re-1.0: .. done
> Reloading firmware os-realtek-re-1.0 .. done

and then failure messages appeared

> failed waiting for configd (doesn't seem to be running)
> failed waiting for configd (doesn't seem to be running)
> failed waiting for configd (doesn't seem to be running)
> failed waiting for configd (doesn't seem to be running)

Opnsense will boot as 26.1.11, but appears to be a broken upgrade with the following messages received when attempting to restart update:


***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 26.1.11_10 (amd64) at Sun Aug  2 15:53:23 EDT 2026
Fetching changelog information, please wait... done
Updating FreeBSD-ports repository catalogue...
Fetching meta.conf: . done
Fetching data: .......... done
Processing entries: .......... done
FreeBSD-ports repository update completed. 37835 packages processed.
Updating FreeBSD-ports-kmods repository catalogue...
Fetching meta.conf: . done
Fetching data: ..... done
Processing entries: .......... done
FreeBSD-ports-kmods repository update completed. 239 packages processed.
Updating OPNsense-aux repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/meta.txz: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/data.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/data.tzst: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/packagesite.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/packagesite.tzst: Not Found
Unable to update repository OPNsense-aux
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/meta.txz: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.tzst: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.tzst: Not Found
Unable to update repository OPNsense
Error updating repositories!
Upgrading package manager from version '' to ''
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/meta.txz: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.tzst: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.tzst: Not Found
Unable to update repository OPNsense
Error updating repositories!
Updating FreeBSD-ports repository catalogue...
Fetching meta.conf: . done
Fetching data: .......... done
Processing entries: .......... done
FreeBSD-ports repository update completed. 37835 packages processed.
Updating FreeBSD-ports-kmods repository catalogue...
Fetching meta.conf: . done
Fetching data: ..... done
Processing entries: .......... done
FreeBSD-ports-kmods repository update completed. 239 packages processed.
Updating OPNsense-aux repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/meta.txz: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/data.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/data.tzst: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/packagesite.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/aux/packagesite.tzst: Not Found
Unable to update repository OPNsense-aux
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/meta.txz: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/data.tzst: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.pkg: Not Found
pkg: https://pkg.opnsense.org/FreeBSD:15:amd64/26.1/latest/packagesite.tzst: Not Found
Unable to update repository OPNsense
Error updating repositories!
***DONE***


Within the GUI, under Plugins
os-isc-dhcp & os-realtek-re had status of "orphaned" and are now listed as missing.

Looking for suggestions of what to do, since I am unsure how to resolve this issue.
I have tried downloading os-realtek pkg & re-installing this via USB drive, without success correcting the problem.

Thanks!