"Recent posts
#1
26.7 Series / Re: Critical PHP vuln: php2she...
Last post by dxche - Today at 11:22:54 AMAdding to this: both CVEs (CVE-2026-109618, CVE-2026-109619) are rated CVSS 9.2 and reported as unauthenticated, so login protection on the GUI won't help. Also worth noting that by default lighttpd binds on every interface address, so the GUI is reachable from all internal VLANs, not only WAN.
Two follow up questions:
Is there any plan for 26.1 installs (still on PHP 8.3.30), or is upgrading to 26.7 the only way to get the fix?
Until the hotfix lands, is restricting Listen Interfaces plus WAN source IPs the recommended mitigation, or is there anything else you'd suggest?
Two follow up questions:
Is there any plan for 26.1 installs (still on PHP 8.3.30), or is upgrading to 26.7 the only way to get the fix?
Until the hotfix lands, is restricting Listen Interfaces plus WAN source IPs the recommended mitigation, or is there anything else you'd suggest?
#2
26.7 Series / Critical PHP vuln: php2shell (...
Last post by some-random-user - Today at 10:33:27 AMHello,
By default, PHP runs as root on OPNsense.
With that in mind, can you please confirm that OPNsense will release a fix for this critical vulnerability in sync with upstream (scheduled for 14:00 UTC today, 21 Oct 2026)?
Thanks in advance!
By default, PHP runs as root on OPNsense.
With that in mind, can you please confirm that OPNsense will release a fix for this critical vulnerability in sync with upstream (scheduled for 14:00 UTC today, 21 Oct 2026)?
Thanks in advance!
#3
German - Deutsch / Re: ACME all-inkl DNS-01 Chall...
Last post by no_Legend - Today at 10:16:19 AMSo funktioniert es bei mir.
nur die DNS Sleeptime steht bei mir auf 0
Ich frag mich gerade ob es etwas mit dem neuen und alten WebInterface im KAS zutun haben kann?
Willst du eine Wildcard erstellen?
Wie hast du es unter Certificates eingestellt?
nur die DNS Sleeptime steht bei mir auf 0
Ich frag mich gerade ob es etwas mit dem neuen und alten WebInterface im KAS zutun haben kann?
Willst du eine Wildcard erstellen?
Wie hast du es unter Certificates eingestellt?
#4
Intrusion Detection and Prevention / Re: Suricata configruation que...
Last post by BoNetTech - Today at 09:18:44 AMHi Vincent,
A few thoughts, since the behaviour differs between WAN and DMZ:
1) PPPoE + IPS. IPS mode (netmap) is a known limitation on PPPoE interfaces, while IDS (pcap) works on the virtual pppoe interface. The usual suggestion from the OPNsense developers is to run IPS on an internal interface (here your DMZ) and, if you also want visibility on the WAN, use IDS there. Which mode are you using on the WAN?
2) What the WAN sees. Inbound traffic is inspected before port forwarding, with your public IP as destination, while the DMZ interface sees the translated traffic. The documentation also notes that IPS on the WAN adds little, since the firewall already drops unsolicited traffic, and that NAT hides internal addresses there.
3) Home networks. The docs advise against using an external address as home network; since a PPPoE address can change, a fixed <wan ip>/32 would also become wrong after a reconnect.
4) Alert vs drop. A packet is only dropped if the rule action is drop (per rule or per policy). Check Services > Intrusion Detection > Alerts and your policies.
5) Hardware offloading. For IPS mode the docs ask to disable all hardware offloading features under Interfaces > Settings.
6) Slow DMZ transfers. Enable only the rulesets that match what you actually expose (web, mail, ...); a large ruleset on a small CPU slows transfers noticeably.
Which OPNsense version are you on, and which capture mode (PCAP, Netmap, Divert)?
— Sergio
A few thoughts, since the behaviour differs between WAN and DMZ:
1) PPPoE + IPS. IPS mode (netmap) is a known limitation on PPPoE interfaces, while IDS (pcap) works on the virtual pppoe interface. The usual suggestion from the OPNsense developers is to run IPS on an internal interface (here your DMZ) and, if you also want visibility on the WAN, use IDS there. Which mode are you using on the WAN?
2) What the WAN sees. Inbound traffic is inspected before port forwarding, with your public IP as destination, while the DMZ interface sees the translated traffic. The documentation also notes that IPS on the WAN adds little, since the firewall already drops unsolicited traffic, and that NAT hides internal addresses there.
3) Home networks. The docs advise against using an external address as home network; since a PPPoE address can change, a fixed <wan ip>/32 would also become wrong after a reconnect.
4) Alert vs drop. A packet is only dropped if the rule action is drop (per rule or per policy). Check Services > Intrusion Detection > Alerts and your policies.
5) Hardware offloading. For IPS mode the docs ask to disable all hardware offloading features under Interfaces > Settings.
6) Slow DMZ transfers. Enable only the rulesets that match what you actually expose (web, mail, ...); a large ruleset on a small CPU slows transfers noticeably.
Which OPNsense version are you on, and which capture mode (PCAP, Netmap, Divert)?
— Sergio
#5
26.7 Series / Re: Setup issues with new OPNS...
Last post by pfry - Today at 08:22:57 AMHow's your LAN side set up? I have the Frontizon equivalent, so for the static network I use a bridge. In other words, my WAN interface is a bridge, and the physical interfaces in that subnet are members. Is that your plan?
68.94.156.1/68.94.157.1? Heh. [sbcglobal.net]. anycast, I believe. (I worked for SBC for 16 years - those are familiar. And oddly the reverse DNS is still there.)
Edit: I assume your firewall is .162. Oddly, the path from here ([tailbone.net], among others) to there flips between Vz and Cogent.
68.94.156.1/68.94.157.1? Heh. [sbcglobal.net]. anycast, I believe. (I worked for SBC for 16 years - those are familiar. And oddly the reverse DNS is still there.)
Edit: I assume your firewall is .162. Oddly, the path from here ([tailbone.net], among others) to there flips between Vz and Cogent.
#7
26.7 Series / Setup issues with new OPNSense...
Last post by Ratfink - Today at 07:15:21 AMI thought after all these years I had plenty of knowledge until I attempted this installatoin of OPNSense Software on a PC.
If anyone can help I wouldbe greatful. even would pay for help at this point. Just impossibly massive failure.
this is where I am at.
Even after reading instructions and reearching for weeks I cant get this to work. I also dont understand the menu enough to figure out where some of this above metnioned info is supposed to go? AI is useless as it jsut brings up old legacy menu tabs from many years ago. I have had to reinstall 13 times. So any help would be appreicated...
Thanks
If anyone can help I wouldbe greatful. even would pay for help at this point. Just impossibly massive failure.
this is where I am at.
- OPNSense Software/PC is installed and is getting out to Internet.
- One other PC connected to network, setup as dhcp unable to connect to internet.
- ISP is ATT Fiber, Managed Biz, dedicated, using a Silicom ATT-V150 Appliance managed by ATT, need to connect opnsense to this in order to get out to internet.
- Static IP Im trying to use is 12.132.133.165, rest of info below.
WAN IP 12.132.133.160/29,
WAN Gateway 12.132.133.161,
WAN Subnet (CIDR)/29,
Public Range (Begin) 12.132.133.162, Public Range (End) 12.132.133.166,
Public Subnet Mask 255.255.255.248,
Public Gateway 12.132.133.161,
DNS 1 68.94.156.1,
DNS 2 68.94.157.1.
Even after reading instructions and reearching for weeks I cant get this to work. I also dont understand the menu enough to figure out where some of this above metnioned info is supposed to go? AI is useless as it jsut brings up old legacy menu tabs from many years ago. I have had to reinstall 13 times. So any help would be appreicated...
Thanks
#8
Intrusion Detection and Prevention / Re: Interface Configuration fo...
Last post by crystalscrack - Today at 06:25:50 AMI put Suricata and OPNsense to use in a production setting and learned that carefully setting up the interface is key to getting good performance. It's interesting how deeply people here talk about the specifics of setting up platforms for the best traffic inspection. I had similar problems with VLAN tagging, but using what other people had to say really sped up the process.
#9
Intrusion Detection and Prevention / Re: Suricata alerts after inte...
Last post by cheetahcreepy - Today at 06:20:43 AMHey everyone! It hurts me too that Suricata alerts started going off after I changed the interface. I just read this thread about it. Like you, I felt like everyone was out to get me when I recently changed the settings on my router. It's interesting how these kinds of changes can make our setups act in strange ways. What struck me is how important it is to keep a close eye on the logs during those times.
#10
Intrusion Detection and Prevention / Suricata configruation questio...
Last post by Vincent Chen - Today at 02:29:11 AMHi all,
My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.
I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.
If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.
Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.
Thanks for any help,
My wan use pppoe to get a public ipv4, services are port forwarded to dmz subnet.
I got suricata enabled for a while. I have <wan ip>/32,<dmz net>/24 defined as homenet.
If I enable ips on dmz, traffic pass or block as rules defined. But transfer from dmz will slow down because packet inspect.
If I enable ips only on wan, no alter at all. But transfer from dmz will be full speed.
Here is my question:
Threats usually come from wan then pass to dmz. Why enable ips only on wan not block anything or alert anything.
Thanks for any help,
