"Recent posts
#1
26.7 Series / Re: Can settings from ver OPNs...
Last post by seamus - Today at 09:49:24 AMQuote from: lmoore on September 11, 2026, 03:01:57 PMSet up the back up machine on an isolated network to avoid IP address conflicts with the installation on the back up machine and especially when you've restored the configuration file.
Thanks for your reply! I have a couple of comments & questions if you don't mind, and I surely appreciate your time.
Re setting up on an "isolated network": To avoid confusion, let's agree to call my current, existing OPNsense ver 21.7.8 firewall as the "Primary" firewall, and a 2nd machine with the more current version of OPNsense we'll call the "Backup" firewall.
1. [QUESTION] I've only got a single network, and it's a fairly small one; my LAN is 192.168.1.0/255. I have about 20-30 hosts, and reserved approx 50 addresses for use as fixed IPs (using about 6 of those). My question is regarding the "isolated network". Could I simply connect the WAN for the "Backup" firewall to the LAN of the "Primary" firewall? IOW: connect the "Backup" WAN port into a switch used for LAN clients of the "Primary" firewall. And assign the "Backup" fw LAN to be (e.g.) 192.168.1.10/255? IOW the "Backup" firewall will be behind the "Primary" firewall? I could connect a couple of my Raspberry Pis to the "Primary" LAN to complete the "test configuration"... Would this setup be what you characterized as an "isolated network"?? If there's a simpler/better method, please let me know.
2. [COMMENT] After posting my question, I found a clear set of installation instructions for OPNsense. I successfully installed ver 26.7 on the "Backup" host machine. I used the shell to install/copy my latest backup config file into the "right place". Afterwards, I powered down the "Primary" firewall, and substituted the "Backup" firewall in its place to have a "look-see" at the GUI. To my surprise, most things worked! What didn't work was DHCP for all of the "dynamic" clients. I learned that ISC DHCP has been abandoned/deprecated by the ISC, and replaced with a new type of DHCP (KEA??). Anyway - I ran the network with the "Backup" firewall for about 20 minutes, and then restored the "Primary" firewall.
3. [QUESTION] Would the installation instructions I used for ver. 26.7 also work with older versions?
4. [QUESTION] Do you know what the last version number was for OPNsense that had the ISC DHCP as the default configuration?
Thanks again!
~S
#2
Hardware and Performance / Re: Mono Gateway (an NXP-based...
Last post by meyergru - Today at 09:47:21 AMYou cannot compare the former Mono price of $600 to today. It was set in early 2025, which where different times in terms of component prices.
The web site does not have a price for the shipping product and YT videos have become spare, the last one was this: https://www.youtube.com/watch?v=7f2BjPPJEWg, stating that the first batch of 1000 machines have been delivered and that Tomaž had a burnout.
I reckon that the price of the real product - if it ever arrives - will be much higher.
The web site does not have a price for the shipping product and YT videos have become spare, the last one was this: https://www.youtube.com/watch?v=7f2BjPPJEWg, stating that the first batch of 1000 machines have been delivered and that Tomaž had a burnout.
I reckon that the price of the real product - if it ever arrives - will be much higher.
#3
German - Deutsch / Re: Umstieg auf Kea DHCP
Last post by meyergru - Today at 09:32:29 AMKea sagt damit:
Multi-Threading ist aktiv. Deshalb werden Host-Reservations immer vor dem Lease-Lookup geprüft.
Normalerweise gibt es dafür die Option reservations-lookup-first. Wenn Multi-Threading aus ist, bestimmt diese Option, ob Kea zuerst nach einer statischen Reservation oder zuerst in der Lease-Datenbank sucht. Bei aktiviertem Multi-Threading ignoriert Kea diese Einstellung und erzwingt ersteres. Dadurch soll Locking auf der Lease-Datenbank vermieden werden.
Bei Multi-Threading würde eine etwaige Einstellung "reservations-lookup-first": false einfach ignoriert. Die Warnung ist etwas unglücklich, weil auf OpnSense eben Multi-Threading an ist, die Option wird aber per Default m.W. gar nicht gesetzt.
Multi-Threading ist aktiv. Deshalb werden Host-Reservations immer vor dem Lease-Lookup geprüft.
Normalerweise gibt es dafür die Option reservations-lookup-first. Wenn Multi-Threading aus ist, bestimmt diese Option, ob Kea zuerst nach einer statischen Reservation oder zuerst in der Lease-Datenbank sucht. Bei aktiviertem Multi-Threading ignoriert Kea diese Einstellung und erzwingt ersteres. Dadurch soll Locking auf der Lease-Datenbank vermieden werden.
Bei Multi-Threading würde eine etwaige Einstellung "reservations-lookup-first": false einfach ignoriert. Die Warnung ist etwas unglücklich, weil auf OpnSense eben Multi-Threading an ist, die Option wird aber per Default m.W. gar nicht gesetzt.
#4
26.7 Series / Re: Upgrade 26.7.1 to 26.7.1_1...
Last post by trdeal - Today at 08:45:49 AMChecked the !DNS Server rule and it is working correctly. Not sure what happened to the original DNS Server but it has been deleted as the new rule is working
#5
26.7 Series / Re: Upgrade 26.7.1 to 26.7.1_1...
Last post by trdeal - Today at 08:41:26 AMHi,
I found a workaround that has solved my problem and works after a reboot. After disabling my allow all rule. I cloned the NTP Server rule which worked for UDP traffic on port 123 and added the DNS Server alias and changed the traffic to UDP/TCP and port from 123 to 53, then moved it in front of the old DNS Server rule. After establishing the rule worked I removed the NTP Server host alias from the rule, applied changed, monitored traffic then rebooted, rule continued to work after reboot.
Just need to the check the !DNS Server rule blocking internal clients is working correctly.
I found a workaround that has solved my problem and works after a reboot. After disabling my allow all rule. I cloned the NTP Server rule which worked for UDP traffic on port 123 and added the DNS Server alias and changed the traffic to UDP/TCP and port from 123 to 53, then moved it in front of the old DNS Server rule. After establishing the rule worked I removed the NTP Server host alias from the rule, applied changed, monitored traffic then rebooted, rule continued to work after reboot.
Just need to the check the !DNS Server rule blocking internal clients is working correctly.
#6
Development and Code Review / RFC: Scheduled Unbound DNSBL p...
Last post by joelmnz - Today at 06:31:42 AMWe would like to contribute scheduled activation of individual Unbound DNSBL policies. This would be very useful in scenarios like blocking wildcard social domains except during lunch breaks and after hours for certain VLANs for instance.
Before choosing an implementation, we would appreciate guidance on how scheduling should fit the current OPNsense architecture.
The obvious options seem to be:
We would prefer to align with the project's intended direction before beginning implementation, particularly to avoid implementing a Cron-based solution that would later need to be replaced by shared schedule support if that is the projects intended direction
Therefore, we have the following questions:
Appreciate your guidance on this.
Before choosing an implementation, we would appreciate guidance on how scheduling should fit the current OPNsense architecture.
The obvious options seem to be:
- reuse the existing Firewall → Advanced → Schedules objects;
- expose DNSBL policy enable/disable through configd and use the existing Cron scheduler;
- or, if the existing firewall scheduling mechanism is considered legacy or too firewall-specific, consider whether this use case points toward a more general schedule service that could eventually be consumed by multiple OPNsense subsystems.
We would prefer to align with the project's intended direction before beginning implementation, particularly to avoid implementing a Cron-based solution that would later need to be replaced by shared schedule support if that is the projects intended direction
Therefore, we have the following questions:
- Are the existing firewall schedule objects intended to be reusable outside firewall rules?
- If not, is configd/Cron the preferred mechanism for scheduled service behaviour today?
- Would a reusable/general schedule abstraction be desirable, or would that be too broad a change for this feature?
Appreciate your guidance on this.
#7
26.7 Series / Re: Unbound Not Actually Block...
Last post by lmoore - Today at 04:36:56 AMQuote from: ticker on September 11, 2026, 04:35:09 PMThe built-in blocklist tester returns:
{"status":"error"}
This is a clue to your problem. When operating normally it will report as "OK".
Review Unbound log file for problems.
The domain 'metrics.icloud.com' is reported as blocked on my system;
Code Select
{
"status": "OK",
"action": "Block",
"policy": {
"source_nets": [],
"address": "0.0.0.0",
"rcode": 0,
"description": "Hagezi Multi ULTIMATE - Agressive",
"id": "cef05142-cb68-4a0f-91cb-af2383e450b4",
"passlist": ".*localhost$",
"prio": 3.402823669209385e+38,
"hidx": 0,
"bl": "ULTIMATE - Aggressive Blocking",
"category": "Hagezi Multi - Clean the Internet"
}
} #8
General Discussion / Re: Block Local Network Connec...
Last post by connervt - Today at 02:17:39 AMQuote from: pfry on September 07, 2026, 04:02:32 PMQuote from: connervt on September 07, 2026, 02:26:05 PM[...]Instead, I have an AppleTV4K and a Chromecast
[...]
I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.
Heh. The lesser of two evils? (I imagine your practical choices are limited; I don't pay attention to that class of devices.)
Instead of "Lesser of two evils" I think of it more as a decision made after performing a risk assessment.
Apple has shown to have set a higher bar for security, and Chromecast devices are basically dumb where the casting device is likely a bigger risk.
WebOS used by LG (and who knows what by budget TV brands) are certainly more suspect, and the preloaded apps that come on your smart TV are a revenue source for the TV makers, not unlike the bloat of software that came on your Packard Bell PC bought in the 1990's.
#9
26.7 Series / Re: Unbound Not Actually Block...
Last post by ticker - Today at 02:16:02 AMQuote from: DEC740airp414user on September 11, 2026, 10:39:35 PMReporting - unbound dns. Is that giving you stats of anything being blocked?No, it remains at 0.
I even tried resetting the stats in there.
It shows domains are resolving. But 0 is blocked.
In the Reporting > Unbound page, I actually also tried clicking the GUI button for a domain that's allowed, to blocklist it.
The button DOES change the little block button-from "block" to "allow", however it does not add to the "Blocked" counter, nor does it show blocked in the list, nor in details.. and I can still resolve it from my machine. All even after restarting the Unbound service.
#10
General Discussion / Re: Allow Public Internet IPv4...
Last post by wiring8228 - Today at 12:33:34 AMHey everyone!
First of all, thanks for the reply, @viragomann. I'll try to put your advice into practice as soon as I have some free time.
I'd like to clarify that my posts are not LLM-generated content. I wrote the text myself, though it took a little less effort as I'd already asked a similar question before. Writing such long texts is not really fun, especially since it takes a tremendous amount of effort 😐
In my first forum post, I added the following comment. I don't think an LLM would ask about more efficient formatting methods though 😆:
I adopted this writing style when I became active on the Ubuntu Community Hub, where a similar format was specified.
In my view, this style has the advantage of providing the full range of information right away, reducing the need for follow-up questions. In addition, this makes it easier for other people who might come across this post in the future to understand the circumstances under which this question arose.
Before posting texts like this, I consult LLMs, but at the time of writing, they were unable to provide a reliable answer. As I couldn't find any similar questions on the forum either, I decided to post this one. I prefer to exchange ideas with people rather than LLMs, which can only draw on existing knowledge and may generate corresponding hallucinations.
Greetings
A human living on planet Earth 🙃
First of all, thanks for the reply, @viragomann. I'll try to put your advice into practice as soon as I have some free time.
I'd like to clarify that my posts are not LLM-generated content. I wrote the text myself, though it took a little less effort as I'd already asked a similar question before. Writing such long texts is not really fun, especially since it takes a tremendous amount of effort 😐
In my first forum post, I added the following comment. I don't think an LLM would ask about more efficient formatting methods though 😆:
QuoteOff-topic: Manually converting this text, which was originally written in Markdown, was quite a hassle. Are there any better tools I could use for this?
I adopted this writing style when I became active on the Ubuntu Community Hub, where a similar format was specified.
In my view, this style has the advantage of providing the full range of information right away, reducing the need for follow-up questions. In addition, this makes it easier for other people who might come across this post in the future to understand the circumstances under which this question arose.
Before posting texts like this, I consult LLMs, but at the time of writing, they were unable to provide a reliable answer. As I couldn't find any similar questions on the forum either, I decided to post this one. I prefer to exchange ideas with people rather than LLMs, which can only draw on existing knowledge and may generate corresponding hallucinations.
Greetings
A human living on planet Earth 🙃
