Recent posts

#1

Zenarmor (Sensei) / Re: Very high SSD writes with ...

Last post by Bunch - Today at 11:17:28 AM

Proxmox host: ext4
VM storage: LVM-thin
OPNSense: ZFS

#2

Italian - Italiano / Consiglio per aggiornamento a ...

Last post by GrepZilla - Today at 10:29:59 AM

Ciao a tutti,

Sto valutando l'aggiornamento del mio firewall OPNsense dalla versione 26.1.11_10 alla 26.7. Trattandosi di un ambiente di produzione/rete principale, vorrei verificare preventivamente l'eventuale presenza di bug noti o problemi di compatibilità con la mia configurazione e i plugin installati.

Di seguito i dettagli del mio sistema attuale:

System Information:

OPNsense: 26.1.11_10-amd64

FreeBSD: 14.3-RELEASE-p16

OpenSSL: 3.0.21

Plugin Installati:

os-acme-client (4.16_1)

os-cpu-microcode-intel (1.1)

os-crowdsec (1.0.12)

os-mdns-repeater (1.2)

os-q-feeds-connector (1.6)

os-sensei / Zenarmor (2.6.2)

os-sensei-agent (2.6.1)

os-sensei-updater (2.0)

os-sunnyvalley (1.5_2)

os-sftp-backup (1.1_2)

os-tailscale (1.4)

In particolare, vorrei sapere se ci sono criticità note riguardo l'integrazione con Zenarmor (os-sensei), CrowdSec e Tailscale sul nuovo ramo 26.7, o se la stabilità generale suggerisca di attendere ancora qualche release minor.

Qualcuno ha già eseguito l'upgrade con uno stack di plugin simile? Riscontrate regressioni particolari?

Grazie in anticipo per il vostro tempo e per i preziosi consigli.

#3

26.7 Series / Upgrade advice to OPNsense 26....

Last post by GrepZilla - Today at 10:26:38 AM

Hi everyone,

I am planning to upgrade my OPNsense firewall from version 26.1.11_10 to 26.7. Since this instance manages a primary network environment, I want to double-check for any known regressions, bugs, or compatibility issues with my current plugin setup before proceeding.

Here are my current system details:

System Information:

OPNsense: 26.1.11_10-amd64

FreeBSD: 14.3-RELEASE-p16

OpenSSL: 3.0.21

Installed Plugins:

os-acme-client (4.16_1)

os-cpu-microcode-intel (1.1)

os-crowdsec (1.0.12)

os-mdns-repeater (1.2)

os-q-feeds-connector (1.6)

os-sensei / Zenarmor (2.6.2)

os-sensei-agent (2.6.1)

os-sensei-updater (2.0)

os-sunnyvalley (1.5_2)

os-sftp-backup (1.1_2)

os-tailscale (1.4)

Specifically, I would like to know if there are any known caveats or breaking changes regarding Zenarmor (os-sensei), CrowdSec, or Tailscale on the 26.7 release branch, or if it is recommended to hold off for a couple more minor updates.

Has anyone performed this upgrade with a similar plugin stack? Any feedback or advice would be greatly appreciated.

Thanks in advance for your support!

Best regards.

#4

26.1, 26,4 Series / Re: Unable to update issue

Last post by franco - Today at 09:43:06 AM

Happy to hear :)

#5

26.7 Series / Re: Confused by 26.7 upgrade

Last post by franco - Today at 08:56:50 AM

> Apparently the rules didn't continue to work.

You're convoluting your experience with the technical facts in this particular case. It's futile to go into an argument like that.


Cheers,
Franco

#6

26.7 Series / WebUI SSL issue following 26.7...

Last post by SaltyBishop - Today at 12:33:42 AM

Hello

Sharing in case anyone else has a similar issue.

Following my upgrade to 26.7 (26.7.1_1), I was unable to access the web UI due to an invalid SSL certificate/configuration. The error was: SSL_ERROR_INTERNAL_ERROR_ALERT (Firefox) and ERR_SSL_PROTOCOL_ERROR (Chrome).

I just wanted to share how I fixed this. The steps I followed are very simple - available here.

Essentially:

• Login to box via console
• Select Shell
• Run: configctl webgui restart renew

Big thanks to the project, I love what you're doing! This is the first time I've had to intervene since I dropped Sophos UTM!

#7

General Discussion / Re: Trying to block an alias g...

Last post by Patrick M. Hausen - Today at 12:12:32 AM

That's not even a group alias. It's a host alias. I suspected there might possibly be a bug in the way groups are processes, but you are not using a group.

A group alias is one of type "Network group" containing other aliases. This can be helpful in implicit documentation. By creating your aliases as

Host_A, type "Host", content 10.42.69.13
Host_B, type "Host", content 10.42.69.39
Host_C, type "Host", content 10.42.70.39

and then

Blocked_from_Internet, type "Network group", content Host_A, Host_B, Host_C

you document what each of these IP addresses actually are.

That should work exactly the same but you get (IMHO) better discoverability when you look at it again 6 months from now ;-)

#8

Development and Code Review / Re: netflector available as pl...

Last post by UnicronHD - September 07, 2026, 11:14:50 PM

Thanks, great to hear that the first implementation is ready. I'm happy to test it.

I'm running:

OPNsense 26.7.3_11-amd64
FreeBSD 15.1-RELEASE-p3
OpenSSL 3.5.8
Architecture: amd64

Binary:
https://drive.google.com/uc?export=download&id=1VcsmIz9SZDM5Sxqav6a19TTZbojL_gCR

SHA256:
f485f068b0529f36851e8dfeeae06e1bd1f118b5405dadcd67b9eb78fe34a633  netflector-0.16.0-freebsd15-amd64

Here is a config (I assume you will call it roon.toml) you can use for Roon reflection. Feel free to enable more protocols if needed. It assumes that unicast replies are allowed in the firewall. Add more entries if you need reflection between more VLANs.

Code Select Expand

# "debug" shows every relayed datagram; drop to "info" once it works.
log_level = "debug"

[reflectors.roon]
# Interface names as ifconfig lists them, e.g. igb0 / igb1 or vtnet0 / vtnet1.
source_if = "lan"
target_if = "iot"
udp_ports = [9003]
udp_groups = ["239.255.90.90"]
udp_broadcast = true
bidirectional = true

First smoke test:

Code Select Expand

./netflector-0.16.0-freebsd15-amd64 --version
./netflector-0.16.0-freebsd15-amd64 --check-config roon.toml

Then run it (for the purity of this experiment make sure that netflector plugin is stopped):

Code Select Expand

./netflector-0.16.0-freebsd15-amd64 roon.toml

At start the log should show something like this:

Code Select Expand

reflector roon: lan <-> iot [udp(9003 on 239.255.90.90,broadcast)]

And then each reflected query will log something like this:

Code Select Expand

reflected UDP relay datagram from <ip>:<port> to ...


#9

General Discussion / Re: Trying to block an alias g...

Last post by The Crazy Squirrel - September 07, 2026, 11:14:26 PM

I don't know why, but now it's working.  I didn't change anything from my original post.
Was it time?  Was it a cache?  I have no idea.


Just in case someone else stumbles on this I'll go ahead and include the group alias.

#10

General Discussion / Re: Trying to block an alias g...

Last post by cookiemonster - September 07, 2026, 10:50:05 PM

Right. It's the inverted destination in your rule that made me think is what you wanted to do.
Should work then. Perhaps needs a reset of states.
Perhaps this helps https://forum.opnsense.org/index.php?topic=49147.0.
ps.The preferred way is using block to anything not in RFC1918