"Recent posts
#1
Development and Code Review / Re: Go With The Flow - free pl...
Last post by toby - August 25, 2026, 11:51:59 PMQuote from: Monviech (Cedrik) on August 25, 2026, 04:22:41 PMI know I could download the package and extract it but not having the source code browsable (since its in a private repo) is a bit meh.
Once the plugin is more developed and feature rich (and stable), then I'll switch the repo to public. Until then I don't really want to invite code-related comments. For now, focus on the product and whether it offers something useful to you.
#2
26.7 Series / Re: UDP Broadcast Relay – Bloc...
Last post by 8b4df00d - August 25, 2026, 11:11:37 PMThanks for the suggestion! That's definitely a workaround and something I've kept in mind.
Still, I would really prefer a native solution on the OPNsense firewall itself rather than introducing an external host/container to my network.
Still, I would really prefer a native solution on the OPNsense firewall itself rather than introducing an external host/container to my network.
#3
General Discussion / Re: P2P gaming between two com...
Last post by fornax - August 25, 2026, 10:50:15 PMI had set this issue aside while I was dealing with bigger things, but with OPNSense 26.7.2 this is now resolved via Endpoint-independent NAT.
That's it, no UPnP necessary.
- Gaming device IPs added to a firewall alias ("GamingHosts").
- Source NAT set to hybrid mode.
- Add a Source NAT rule:
- Interface: WAN/IPv4/UDP
- Source address: GamingHosts
- Endpoint independent: Checked
- I had previously set up a Static Port rule. Not sure if it's still necessary but I kept it for TCP and just removed UDP to avoid conflict:
- Interface: WAN/IPv4/TCP
- Source address: GamingHosts
- Static-port: Checked
That's it, no UPnP necessary.
#4
26.7 Series / Re: UDP Broadcast Relay – Bloc...
Last post by Patrick M. Hausen - August 25, 2026, 10:45:30 PMYou can run Avahi on a system (VM, Raspi, Docker, ...) in your internal LAN and configure it to announce the static IP address of the printer.
#5
26.7 Series / Re: UDP Broadcast Relay – Bloc...
Last post by 8b4df00d - August 25, 2026, 10:42:11 PMFirst of all, thank you for your support. I would like to clarify a few points regarding your replies:
The UDP Broadcast Relay plugin allows changing the source address. Using the special address 1.1.1.1 instructs the plugin to rewrite the source IP to the respective interface IP. Looking at the Live View, this is working as expected. Regardless of that, the response is sent to port 5353. Shouldn't an outbound rule on that specific interface (blocking Source: any, Destination: any, UDP/5353) prevent these responses from being sent out, or am I missing something here?
This solution unfortunately doesn't work for my use case because I need this for iOS devices. AFAIK iOS requires mDNS service discovery to find printers, as Apple does not allow adding printers manually via IP address or DNS hostname. Therefore, a DNS override doesn't help here.
Quote from: Tinus on August 25, 2026, 05:52:21 PMIf a machine wants to resolve an mDNS name, it sends a multicast message to port 5353. All the other machines see this message, and the ones that want to claim that name respond with a multicast message to port 5353.
What the relay does is simply listen to all these messages and for every message that comes in on one of the configured interfaces, repeat it on all of the other configured interfaces.
So with simple firewall rules you can't really distinguish between the requests and replies and what you want to achieve is not possible. You would have to use a different relay that allows you to be more selective. I don't know if that exists and if the results would be what you want.
The UDP Broadcast Relay plugin allows changing the source address. Using the special address 1.1.1.1 instructs the plugin to rewrite the source IP to the respective interface IP. Looking at the Live View, this is working as expected. Regardless of that, the response is sent to port 5353. Shouldn't an outbound rule on that specific interface (blocking Source: any, Destination: any, UDP/5353) prevent these responses from being sent out, or am I missing something here?
Quote from: Patrick M. Hausen on August 25, 2026, 06:47:13 PMAssign a static IP address to your printer in your Fritzbox and create a DNS override for your internal systems to use instead if mDNS?
This solution unfortunately doesn't work for my use case because I need this for iOS devices. AFAIK iOS requires mDNS service discovery to find printers, as Apple does not allow adding printers manually via IP address or DNS hostname. Therefore, a DNS override doesn't help here.
#6
Hardware and Performance / Re: [solved] Intel i226 Firmwa...
Last post by BrandyWine - August 25, 2026, 09:47:44 PMWhat Intel docs describe the EFI Lan driver being in the NVM bin file?
I would put the Linux tools (and the bin files) onto a bootable liunx USB, work it from that angle.
Make sure there's no BIOS settings that prevent writing to PCIe devices.
I would put the Linux tools (and the bin files) onto a bootable liunx USB, work it from that angle.
Make sure there's no BIOS settings that prevent writing to PCIe devices.
#7
Hardware and Performance / Re: which coreboot payload
Last post by BrandyWine - August 25, 2026, 09:40:21 PMLegacy bios from mobo chip?
UEFI is protected by TPM?
UEFI is protected by TPM?
#8
26.7 Series / Re: can't find where to delete...
Last post by RobLatour - August 25, 2026, 08:48:02 PMQuoteIf I'm following that sequence right, it sounds like your broke something (probably your dnsmasq DHCP config) before resetting the ISC DHCP config (and maybe the clients were still clinging onto old leases, or something). Maybe you could try resetting the ISC DHCP config again, and hopefully dnsmasq is still functional from the 2-days-ago snapshot.....
Good news
after following that suggestiong and a reboot, the system came back up with the internet fully working, also the offending entry was now gone
Bad news
I still can not assign 192.168.7.24 to that device
Good news
Originally the range on the interface I am using was 192.168.7.24 - 192.168.7.25 as I only had one device I was using on it at a time.
I thought perhaps OPNSense was doing something / locking / who knows what with that first address and why I was not able to assign it.
In any case, I've now changed the range to 192.168.7.1 - 192.168.7.100 and after that my device got a new dynamic address of 192.168.7.72.
I've now added a static entry to flip it to 192.168.7.24 - but will have to wait for the lease to expire - after which time I'm hoping it will be all good once again.
Also, as an asided, I'm thinking the one potentially non-benign change I had made over the last two days was checking the option 'This interface does not require an intermediate system to act as a gateway' which may have explained some of the issues with restoring from the most recent snapshop - but in any case I don't care as the one from two days ago did the trick - underlining the importance of taking snapshots!
Thanks all very much for your help.
#9
26.7 Series / Re: ACME Client Issues
Last post by tofflock - August 25, 2026, 08:17:28 PMI had a problem with an Acme certificate about 3 years ago. There's a post here HERE about the corruption that I found in my config.xml file.
I've just had a look at my current config.xml to see if it lines up that the 3-year old version. There's a slight change to the certificate block. They now look like :
Otherwise, I'm pretty sure the rest of that post is still accurate.
It's clearly important that the certificate that the web server is using is the new one that the Acme client has received. I never found why my config.xml didn't get updated properly.
HTH (apologies if this isn't your problem)
PeterF
I've just had a look at my current config.xml to see if it lines up that the 3-year old version. There's a slight change to the certificate block. They now look like :
Code Select
<?xml version="1.0"?>
<opnsense>
<version>11.2</version>
.
<cert uuid="3d19c8be-0d2c-4267-bfd2-f322c88a6dcf">
<refid>a1b2c3d4e5f6</refid>
<descr>Text Description</descr>
<caref>a1b2c3d4e5f60</caref>
<crt>[Very long continuous string of the public key of this certificate]</crt>
<csr/>
<prv>[Very long continuous string of the private key of this certificate]</prv>
</cert>Otherwise, I'm pretty sure the rest of that post is still accurate.
It's clearly important that the certificate that the web server is using is the new one that the Acme client has received. I never found why my config.xml didn't get updated properly.
HTH (apologies if this isn't your problem)
PeterF
#10
26.7 Series / Re: can't find where to delete...
Last post by Monviech (Cedrik) - August 25, 2026, 08:12:41 PMI doubt dnsmasq was ever configured correctly and assume the leases are in ISC instead.
