Recent posts

#1

26.1, 26,4 Series / Re: Issues with Reboot / Power...

Last post by wincent - Today at 02:58:09 AM

Has your OPNsense installed the os-vmware plugin?

#2

General Discussion / Re: TUI for viewing and analys...

Last post by lmoore - Today at 02:50:08 AM

/conf/config.xml has descriptions of rules you've added manually, but default rules aren't there. The rules in there are also referenced by a uuid, not by the rule id from the log. I don't know of any other place that has the rule id and the description (of all rules).

Before posting the other day, I searched my firewall for another file containing the rule UUID and Description fields. The only other file I located on the system which contains the information, and is current, is /tmp/rules.debug. The GUI Live View is obtaining the information from somewhere.

Unless someone can advise where Live View obtains the information, perhaps creating and using a database reference file from either /tmp/rules.debug or the API, and regenerating it when a time-stamp changes.

On a side note, last Saturday I added a new VLAN interface to my system and enabled a DHCP server on it then included it to an existing Firewall Group. Later in the day I noticed some unexpected entries in Live View where a rule logs the allowed connection and then another line logged immediately after, which references an unrelated block rule. These entries also appeared in opnsense-filterlog. To overcome the problem OPNsense was rebooted.

#3

General Discussion / Re: AmneziaWG on OPNsense and ...

Last post by frozen - Today at 01:48:08 AM

hi! i'm in canada and want this simply for assisting in getting past increasingly strict wg restrictions in public places.  definitely not a bot, and not my first time here -- i found this thread as a top result on google and was looking for updates.  i do appreciate the concern & need to be extremely cautious in vetting such things, though..

hoping for an update, thanks lads!

#4

26.1, 26,4 Series / Re: [SOLVED-ish] Degraded Spee...

Last post by cookiemonster - Today at 12:20:30 AM

My suggestion will be to test with a non-*bsd-based router. A Linux one instead.
user friendlies were dd-wrt and open-wrt. It's been a while since I looked, it might have changed.
The reason to suggest it is that you likely eliminate any possible tuning required under freeBSD for your connection. Linux tends to have more hardware support for NICs as well. Yes you are using well supported nics in freebsd but tunables could be a factor.
Additionally it might be possible to put some additional logging in place to support your case with the ISP.

#5

26.1, 26,4 Series / Re: [SOLVED-ish] Degraded Spee...

Last post by juicemain - June 22, 2026, 11:59:35 PM

Thank you, I will give that a go.  But they are literally giving me pushback trying to say that it could still be something "local."  I even just recorded a video capturing an instance of one machine displaying the behavior when connected directly to the ONT, and another instance in the same video of two machines connected directly to the ISP router displaying the same behavior.  That has to completely rule out anything in the home right?

#6

26.1, 26,4 Series / Re: Unbound DNS log

Last post by OPNenthu - June 22, 2026, 11:43:22 PM

You could try enabling query logs in Unbound itself (Advanced->Logging Settings->Log Queries) which I guess would show them in the service logs (Unbound->Log File), but it comes with a performance impact warning:

You cannot view this attachment.

No idea if/how the OPNsense reports can be extended but would also be interested in that...

#7

26.1, 26,4 Series / Re: [SOLVED-ish] Degraded Spee...

Last post by nero355 - June 22, 2026, 11:14:21 PM

Sent a detailed email to my ISP explaining the situation and telling them that I observed the behavior when directly connected to the ONT, and they literally responded with an email only saying "it's a poor idea to run directly connected to an ONT." -_-

Typical large companies bullshit these days sadly -_-

Sorry to hear you are experiencing that kind of nonsense...


A short search shows it's a GPON ONT while most ISPs are migrating to XGS-PON equipment the last couple of years so maybe ask them to move you over if that's possible ?!

#8

German - Deutsch / Re: HAproxy mTLS einrichten

Last post by viragomann - June 22, 2026, 10:38:29 PM

Hallo,

ich verwende Zertifikats-Authentifizierung selbst nicht und kann daher nicht mit Erfahrung dienen. Doch würde ich annehmen, dass, wenn die Client Authentifizierung im Frontend aktiviert ist, diese für alle Zugriffe gilt.

Wie sehen die Regeln aus, dass du dir davon einen Bypass versprichst?
Mit der Einstellung "optional" würde ich mir allerdings erwarten, dass auch Verbindungen ohne Client-Zertifikat akzeptiert werden, aber dennoch wird schickt der Server erst mal einen Zertifikats-Request, und möglicherweise mag das dein Client nicht.

Ist eine IP-basierte Authentifizierung nicht umsetzbar?
Wenn die Zugriffe von externen dynamischen IPs kommen, geht das natürlich nicht.

Soweit ich HAproxy kenne, würde dein Vorhaben nur mit TCP Frontends möglich sein. Da könntest du die Clients per SNI auf das richtige Frontend leiten und auf dem für xx.meinedomain.tld die Zertifikats-Auth aktivieren.

Deine Darstellung lässt aber vermuten, dass das auch schon alles ist, was du von HAproxy in deinem Setup erwartest. Meine Empfehlung wäre dann, auf Caddy zu wechseln. Der kann das und ist insgesamt sehr einfach zu konfigurieren.

Da kannst du die beiden Domains anlegen (Frontends) und direkt da auch eine oder mehrere in OPNsense eingerichtete CAs für die Client Authentifizierung auswählen.
Wenn du ein eingefleischter HAproxy Nutzer bist, ist die Caddy Konfiguration anfangs etwas gewöhnungsbedürftig, weil das Ding vieles automatisch macht und so die Einstellungsmöglichkeiten auf die nötigsten reduziert sind. Man möchte meinen,dasss Funktionen fehlen, doch für mein Heimnetz reicht es voll und ganz aus.

Grüße

#9

26.1, 26,4 Series / Re: [SOLVED-ish] Degraded Spee...

Last post by juicemain - June 22, 2026, 09:37:20 PM

Okay, sorry to post again.  But the ISP just told me that the ONT does NOT have logs.  AI LLM says otherwise.  I am unable to find that information for myself.  Does anyone know for sure whether or not the Calix GigaPoint 803G Model No: 100-04255 11 should have logs accessible by the ISP?  Thanks.

#10

26.1, 26,4 Series / Re: Issues with Reboot / Power...

Last post by mrzaz - June 22, 2026, 09:36:50 PM

Is ACPI enabled for your VM?

I think so, but will doublecheck.

However, as I mentioned, it is not that it hangs anywhere in the shutdown, but rather that it does not indicating anything in the console that a shutdown has been initiated and it just stays forever (when selected from webGUI). WebGUI says shutdown in progress, but console says nothing.

BUT, if I select shutdown from the console it immediately starts showing that a shutdown sequence has started and stopping everything and finally shuts down/ powers off.

I do have some issues with Suricata PID takes forever to die but that is a separate topic. 🙂

Best regards
Dan Lundqvist