Recent posts

#1

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by saki22 - Today at 04:47:26 PM

Did you type it with the "#"

if yes, do it without

Code Select Expand

opnsense-patch https://github.com/opnsense/core/commit/5b6ccdb592

I did not put in #

[NL]

#2

26.7, 26.10 Series / Re: Fresh 26.10 installation r...

Last post by mooh - Today at 04:05:30 PM

The CRL issue can be resolved by choosing "Deciso (HTTPS,NL,Commercial)" as the mirror instead of "Deciso (HTTPS,Commercial)"

[os-zapret2-restyle]

#3

Development and Code Review / os-zapret2-restyle — Native Za...

Last post by Tolian82 - Today at 04:05:19 PM

Hi everyone!

I'd like to introduce os-zapret2-restyle, an independent, free, open-source OPNsense plugin that integrates Zapret2 with native WebGUI management, flexible DPI bypass strategies, and automated strategy testing.

I've been developing the project since May 2026. It started as a personal experiment and has gradually grown into a much larger project with its own architecture, package repository, and development roadmap.


What is os-zapret2-restyle?

The plugin brings the native dvtws2 engine into OPNsense, allowing users to manage Zapret2, configure traffic profiles, and test DPI bypass strategies directly from the firewall's WebGUI.

One of its main features is Strategy Lab: instead of manually guessing which parameters might work, users can run automated tests against a selected destination using their own ISP connection.

The laboratory verifies candidate strategies and provides results that can be manually transferred to the traffic configuration.

Current Features

• Native OPNsense integration — WebGUI, service management, startup control, upstream Zapret2 installation, and version switching.
• Traffic Strategies — configurable TCP/UDP profiles using native dvtws2 syntax, HOSTLIST, IPSET, custom parameters, and domain exclusions.
• Strategy Lab — automated DPI bypass strategy discovery and verification, including TLS, HTTP, QUIC/HTTP3 and UDP testing, Standard/Extended modes, stability checks, and saved results.
• Voice Transmission — a dedicated configuration page for five UDP/STUN profiles: Telegram, Discord, X (Twitter), SIP (VoIP), and Custom. This functionality is experimental; successful voice calls are not yet guaranteed.
• Additional Lua/BIN Resources — optional installation and removal of supplementary Lua scripts and binary payloads, including dynamic integration into strategy discovery.
• Safe configuration management — transactional Apply, configuration validation, IPFW integration, runtime health checks, and rollback mechanisms.
• Bilingual WebGUI — English and Russian translations for settings, help, diagnostics, and status messages.
• Package management — a dedicated FreeBSD pkg repository with installation and update integration for OPNsense.

Architecture overview

Traffic Strategies and Voice Transmission share a single configuration model, a common Apply/rollback pipeline, managed IPFW rules, and one dvtws2 process.

Strategy Lab uses a separate temporary testing workflow, restores the original service state after testing, and does not automatically modify saved user strategies.

View the architecture diagram in the README


Active Development and Roadmap

The project is actively developed, with several major improvements underway.

Current development — v0.6.1

• Full IPv4/IPv6 dual-stack support — extending IPSET, Traffic Strategies, Voice profiles, IPFW, and Strategy Lab.
• Global Exclude IPSet — centralized IPv4/IPv6 destination exclusions applied to all regular and voice profiles.
• IPv6 Strategy Lab — optional dual-stack testing, independent A/AAAA destination checks, and updated adaptive testing budgets.

The IPv4/IPv6 and Exclude IPSet work has already reached published development builds. Source-level, CI, and selected installed-system tests have passed, but full live WAN/IPv6 validation remains in progress.

Further development and research

• Voice/P2P — researching per-service UDP port ranges, dynamic peer endpoints, STUN, and additional media protocols.
• Strategy Lab — improving candidate selection, testing efficiency, diagnostics, cancellation, saved-job handling, and recovery after interrupted tests.
• Lua/BIN ecosystem — expanding supported resources, improving compatibility detection, and smarter generation of test candidates.
• Reliability — further improvements to service lifecycle management, package upgrades, cleanup, runtime verification, and failure recovery.
• Performance — evaluating additional test parallelism and other optimizations based on real-world results.
• Long-term goals — completing the project toward v1.0.0 and eventually porting it to pfSense.

Development priorities and implementation details are documented in the repository:

Development Roadmap

Architecture and Technical Specifications


Compatibility, Releases and Installation

Latest stable release: v0.6.0
Current testing line: v0.6.1
Target platform: OPNsense 26.7 / FreeBSD 15 amd64
Runtime: bol-van/zapret2 (dvtws2)
License: MIT

Source code:
https://github.com/Tolian82/os-zapret2-restyle

Stable release:
https://github.com/Tolian82/os-zapret2-restyle/releases/tag/v0.6.0

Development/testing releases:
https://github.com/Tolian82/os-zapret2-restyle/releases

Installation instructions:
https://github.com/Tolian82/os-zapret2-restyle#installation-from-the-opnsense-web-gui

The project is currently distributed through an independent, unofficial package repository rather than the official OPNsense plugin repository.

Because it modifies firewall traffic processing and uses privileged services, I recommend reviewing the source code and starting with a test installation.


Acknowledgements

I'd especially like to thank Umurcan Gorur (ugorur), the author of the original os-zapret2 plugin.

His project inspired me to take my first steps into software development with AI assistance.

Although I've worked in IT for 26 years, my professional background is primarily in systems architecture. Software development is a new chapter for me, and this project has become a valuable learning experience.

What began with his original idea has gradually evolved into an independent project with additional functionality and its own architecture.

I'm sincerely grateful for his work, encouragement, and constructive feedback.

A very special thanks also goes to bol-van for creating and maintaining Zapret2.

The original Zapret2 engine and its DPI research form the technological foundation of this project. Without that work, this integration would not exist.


Feedback and Code Review Welcome

This is an actively evolving open-source project, and I'd really appreciate feedback from the OPNsense community.

I'm especially interested in:

• Code review and security-related feedback.
• Testing on supported OPNsense installations.
• Suggestions for improving reliability, packaging, and maintainability.
• Strategy Lab testing results and reproducible bug reports.

If you find an issue or have a suggestion, feel free to reply here or open a GitHub issue.

GitHub — Tolian82/os-zapret2-restyle

Thanks to the OPNsense community for your time and feedback!

Best regards,
Tolian82

[In summary, everything went well.]

#4

26.7, 26.10 Series / Fresh 26.10 installation repor...

Last post by mooh - Today at 03:55:40 PM

Today, I did a fresh install on a DEC750. The machine had a bit of a checkered past. So, I wanted to take the opportunity to start from scratch, install the latest BIOS and do away with the legacy stuff, moving to dnsmasq and the new rules at the same time. Everything had been prepared on a test machine running 26.7.x and that backup was used to restore the configuration of the DEC750.

In summary, everything went well.

Some things didn't work as expected though:

• I chose the OPNsense-business-26.10-vga-amd64 installation image. I never got a login prompt on the console during installation. I probably should have chosen the serial version. Login via ssh didn't work either because
• The LAN interface does not issue dhcp addresses by default. I had to configure the ethernet interface of my PC manually.
• The installation and restoring the config went just fine. However, a check for updates after the reboot resulted in the re-installation of the OPNBEcore package. Not sure if this is the intended behaviour after entering the subscription key. In any case, there were a number of messages about missing CRLs.

Here's the log output:

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.10 (amd64) at Fri Oct 30 15:27:31 CET 2026
Strict TLS 1.3 and CRL checking is enabled.
Updating OPNsense repository catalogue...
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (166 candidates): .......... done
Processing candidates (166 candidates): . done
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
opnsense-business-26.10 [OPNsense] (Vital flag changed: 'true' -> 'false')

Number of packages to be reinstalled: 1

6 MiB to be downloaded.
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
[1/1] Fetching opnsense-business-26.10: .......... done
Checking integrity... done (0 conflicting)
[1/1] Reinstalling opnsense-business-26.10...
[1/1] Extracting opnsense-business-26.10: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
=====
Message from opnsense-business-26.10:

--
Just a dream and the wind to carry me
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/opnsense-business-26.10.pkg
/var/cache/pkg/opnsense-business-26.10~2$gokh8ff6.pkg
The cleanup will free 6 MiB
Deleting files: .. done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***


#5

Russian - Русский / Re: os-amneziawg — плагин Amne...

Last post by Gad - Today at 03:49:30 PM

так есть решения для протокола AmneziaWG 3.1?

https://github.com/nvk86/opnsense-awg-plugin

[os-zapret2-restyle]

#6

Russian - Русский / os-zapret2-restyle — плагин Za...

Last post by Tolian82 - Today at 03:45:43 PM

Всем привет!

Хочу представить свой проект — os-zapret2-restyle, нативный плагин для OPNsense, предназначенный для управления Zapret2, настройки стратегий обхода DPI и автоматизированного поиска работающих конфигураций.

Проект бесплатный, с открытым исходным кодом. Разработка началась в мае 2026 года и активно продолжается.


Что это такое

os-zapret2-restyle объединяет движок dvtws2 с интерфейсом OPNsense. Можно управлять службой, настраивать стратегии и запускать лабораторные проверки непосредственно из WebGUI, без необходимости вручную редактировать конфигурации.

Одна из главных особенностей — Strategy Lab. Вместо случайного перебора параметров пользователь может указать заблокированный ресурс, а лаборатория выполнит серию проверок стратегий на его собственном интернет-подключении и покажет подтверждённые результаты.

Ключевые возможности

• Управление Zapret2 — установка движка, выбор и смена upstream-версий, запуск, остановка, перезапуск и контроль состояния службы через WebGUI.
• Traffic Strategies — гибкие TCP/UDP-профили с нативным синтаксисом dvtws2, поддержкой HOSTLIST, IPSET, пользовательских параметров и исключений доменов.
• Strategy Lab — автоматический подбор и проверка стратегий. Режимы Standard и Extended; тестирование TLS, HTTP, QUIC/HTTP3 и UDP; проверка стабильности и сохранение результатов.
• Voice Transmission — отдельная страница с пятью настраиваемыми UDP/STUN-профилями: Telegram, Discord, X (Twitter), SIP (VoIP) и Custom. Функциональность экспериментальная: успешная работа голосовых вызовов пока не гарантируется.
• Дополнительные Lua/BIN ресурсы — установка и удаление дополнительных Lua-скриптов и бинарных payload-файлов, использование совместимых ресурсов при подборе стратегий.
• Безопасное применение конфигурации — предварительная проверка параметров, транзакционный Apply, интеграция с IPFW, контроль работоспособности службы и механизмы отката.
• Локализация — полноценный интерфейс на русском и английском языках, включая настройки, справку и диагностические сообщения.
• Установка и обновления — собственный репозиторий FreeBSD-пакетов с интеграцией в систему обновлений OPNsense.

Архитектура: Traffic Strategies и Voice Transmission используют общую конфигурацию и один управляемый процесс dvtws2. Strategy Lab запускает изолированные проверки с временными правилами IPFW, после чего восстанавливает исходное состояние службы.

Посмотреть полную схему архитектуры в README.


Активная разработка и планы

Ближайшие задачи — версия v0.6.1:

• Полноценная поддержка IPv4/IPv6 — для IPSET, стратегий, голосовых профилей, IPFW и лаборатории.
• Global Exclude IPSet — единый список IPv4/IPv6-адресов и подсетей, исключённых из DPI-обработки во всех профилях.
• IPv6 в Strategy Lab — отдельный переключатель, независимое тестирование A/AAAA-адресов и адаптация времени проверок.

Часть этих изменений уже реализована в тестовых сборках и проходит проверки на FreeBSD/OPNsense. Полная приёмка на реальном сетевом трафике пока продолжается.

Дальнейшее развитие:

• Voice/P2P — исследование индивидуальных диапазонов UDP-портов, динамических адресов собеседников, STUN и дополнительных медиапротоколов.
• Strategy Lab — оптимизация поиска стратегий, развитие диагностики, сохранения заданий, отмены тестов и восстановления после ошибок.
• Lua/BIN — расширение каталога ресурсов, автоматическое определение их совместимости и улучшение генерации кандидатов.
• Надёжность — дальнейшая доработка обновлений, мониторинга службы, очистки временных ресурсов и обработки нештатных ситуаций.
• Производительность — исследование возможностей параллельного тестирования и сокращения времени подбора стратегий.
• Долгосрочная цель — развитие проекта до v1.0.0 и последующее рассмотрение портирования на pfSense.

Совместимость и установка

Текущий стабильный релиз: v0.6.0
Целевая платформа: OPNsense 26.7 / FreeBSD 15 amd64
Лицензия: MIT

GitHub: https://github.com/Tolian82/os-zapret2-restyle

Скачать стабильный релиз:
https://github.com/Tolian82/os-zapret2-restyle/releases/tag/v0.6.0

Инструкция по установке и настройке:
https://github.com/Tolian82/os-zapret2-restyle#installation-from-the-opnsense-web-gui

План развития:
https://github.com/Tolian82/os-zapret2-restyle/blob/main/docs/ROADMAP.md


Благодарности

Хочу отдельно поблагодарить Umurcan Gorur (ugorur) — автора оригинального os-zapret2.

Именно его проект вдохновил меня попробовать себя в разработке программного обеспечения. Несмотря на многолетнюю работу в ИТ, программирование стало для меня новой областью, которую я осваиваю в том числе с помощью искусственного интеллекта. Изначально проект вырос из этой идеи, а затем постепенно превратился в самостоятельную разработку с расширенным функционалом.

Отдельная огромная благодарность bol-van за создание и развитие Zapret2. Именно его движок и исследования DPI сделали возможной реализацию нашего плагина.


Обратная связь

Проект активно развивается, поэтому буду рад тестированию, замечаниям, предложениям и конструктивной критике.

Если обнаружите ошибку или захотите предложить новую возможность — пишите в этой теме или открывайте Issue на GitHub.

GitHub — os-zapret2-restyle

Если проект окажется полезным, буду благодарен за звёздочку на GitHub — это поможет другим пользователям найти его.

Спасибо сообществу OPNsense!

#7

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by Monviech (Cedrik) - Today at 02:33:46 PM

Did you type it with the "#"

if yes, do it without

Code Select Expand

opnsense-patch https://github.com/opnsense/core/commit/5b6ccdb592

#8

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by saki22 - Today at 02:23:32 PM

What do you mean by link? That is a command that you are supposed to enter while logged in as root to your OPNsense via SSH.

The this link # opnsense-patch https://github.com/opnsense/core/commit/5b6ccdb592 I use opnsense interface shell by com port

#9

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by Patrick M. Hausen - Today at 02:20:19 PM

What do you mean by link? That is a command that you are supposed to enter while logged in as root to your OPNsense via SSH.

#10

26.7, 26.10 Series / Re: Upgrade to 26.7.8 broke Ga...

Last post by saki22 - Today at 02:18:42 PM

I am experiencing the same problem is there a solution to fix this

Like Franco says, try the opnsense-patch command to see if that fixes (reverts) it.

I did that it says the link it says the comment is unavailable