Recent posts

#1

High availability / Aliases to support "No XMLRPC ...

Last post by chandrayandeepak - Today at 06:22:38 AM

In scenario like configuration sync between DC and DR, it would help if "No XMLRPC Sync" flag (likewise in Virtual IPs) is provided in "Aliases" also to explicitly instructed OPNsense to exclude it from replication.

There are policies to replicate from DC to DR where common alias name are used pointing to different content and DC -> DR sync would break required configuration at DR side.

An example maybe where Source NAT is used to let LAN side traffic go out of Alias named "AddOn_IP". For DC & DR, content of AddOn_IP may be different policy should stay same.

#2

26.7, 26.10 Series / Re: Unable to import Trust Aut...

Last post by chandrayandeepak - Today at 05:21:29 AM

Upgrade to 26.7.8_2 fixed the issue, imported authorities now.

#3

26.7, 26.10 Series / Upgrade from 26.7.7 to 26.7.8...

Last post by BillM - Today at 05:18:35 AM

I've attached the "Audit Health" log and the Update Log:
[13/41] Fetching python313-3.13.16: ........
pkg-static: fetch size does not match expected package size
Flushing temporary package files... done
Starting web GUI...done.
Partial update failure detected: report this error log to OPNsense.
No further actions will be taken. Please restart the update now.
***DONE***

I have tried rebooting before installing the update.
Haven't had an issue with the update process before, so not at all sure of how to proceed.
The firewall is at a client's office, so I don't have easy physical access.
It is a Protectli Model FW4B-2-4-240, if that helps.

#4

26.7, 26.10 Series / Re: PPPoE over an unassigned V...

Last post by johndoeuser - November 01, 2026, 10:35:46 PM

I want to chime in to this thread. I seem to have exactly the same issue as OP. A (Dutch) KPN fiber connection. PPPoE configured over vlan6 tagged interface. PPPoE works flawlessly up to version OPNsense 26.7.1_1-amd64. At the moment I have a cold stand-by with a clean install and upgraded to OPNsense 26.7.8_2-amd64. I only configured PPPoE which still doesn't want to start working. Help?! ;-)

#5

26.7, 26.10 Series / Re: cve-2026-98432 (linux behi...

Last post by nero355 - November 01, 2026, 09:40:05 PM

PF has an allow-opts filter-rule modifier. By default, PF blocks packets containing IPv4 options. A pass rule needs allow-opts to permit them.

If you check your ruleset in /tmp/rules.debug you can grep if your ruleset contains rules with allow-opts.

Also if its on a non quick automatic rule that would allow-opts, you can create a quick rule in the same direction that blocks options.

So as long as you haven't created any Manual Firewall Rules that Allow TCP traffic to have 'allow-opts' included then even outdated Linux based devices are completely safe behind your OPNsense/FreeBSD based Firewall ?

If so : VERY COOL! :)

#6

26.7, 26.10 Series / Re: [Solved by reboot] 26.7 Up...

Last post by danmac - November 01, 2026, 08:18:33 PM

LOL! ^_^

haha I'm glad I amused someone :)

here's how I fixed (?) this problem on my setup, now I can just click update on the Web UI, I tested it upgrading from 26.7.7 to 26.7.8 worked first time whereas before it would fail repeatedly

either that or this is all bullshit and I just got extraordinarily lucky, I'll post it anyway

ssh to your firewall as root
# ee /usr/local/sbin/opnsense-update
(or use your preferred editor that isn't nano as we don't have that :P)
search (CTRL-Y) for STAGE1 or go to line 906
behold the two opnsense-fetch command lines
where the two lines say "-T 30 -q" change these to "-T 120 -a -q"
(you could probably get away with just the STAGE2 line but fuck it since we're here anyway)
save the file with ESC (wait) ENTER ENTER

now hit the web UI and do your update

the changes persisted after my upgrade and reboot, but I expect they will be wiped out at some point

for those who are sensitive to such topics this post is 100% grass fed medium rare non AI, I didn't even fire it up, just looked at opnsense-update & fetch on github then the args for fetch, then fucked about in SSH weeeeeee

if it still doesn't work for you, maybe try the Kent mirror as that's what I'm using

have fun chaps, happy Sunday o7

#7

General Discussion / Re: Learn firewall, NAT, routi...

Last post by Seimus - November 01, 2026, 07:04:34 PM

I'd start with Cisco CCNA textbooks or Rich Stevens' "TCP/IP Illustrated, Volume I". Also recommended: Radia Perlman, "Interconnections - Bridges and Routers".

This! I read those CCNA books several times, and they are really great.

If you want a video format or a listening format I advice Keith Barker.
Keith Barker CCNA

But overall nothing beats those books.

Regards,
S.

#8

26.7, 26.10 Series / Re: [26.7.8_2] Unable to Displ...

Last post by MoonbeamFrame - November 01, 2026, 05:50:38 PM

Deleted.

#9

General Discussion / Re: Learn firewall, NAT, routi...

Last post by Patrick M. Hausen - November 01, 2026, 05:28:33 PM

I'd start with Cisco CCNA textbooks or Rich Stevens' "TCP/IP Illustrated, Volume I". Also recommended: Radia Perlman, "Interconnections - Bridges and Routers".

#10

German - Deutsch / Re: Caddy Logs per Wazuh Agent...

Last post by marcquark - November 01, 2026, 05:18:41 PM

Ich weiß nicht, wie Wazuh funktioniert, aber die Access Logs von Caddy landen in /var/log/caddy/access/*, nicht in /var/ossec/logs/opnsense_syslog.log.

Mittlerweile bin ich da aufgeklärt (aka hab' den Mittag mit Code Durchwühlen verbracht). Das Wazuh Agent Plugin klinkt sich in syslog-ng ein und muss dann aber alles, was zu Wazuh soll, noch mal in ein lokales File schreiben, damit der Wazuh Agent sie auslesen kann. Das ist die /var/ossec/logs/opnsense_syslog.log. Eine Pipe geht wohl derzeit seitens Wazuh nicht.


Dass die Caddy Logs nicht mit kommen ist ein Bug, der sich wiederum aus der Caddy Syslog Integration ergibt. Lösungsansätze gibt's mehrere, ich hoffe mir antwortet einer der Maintainer was bevorzugt wäre :) https://github.com/opnsense/plugins/issues/5859