Recent posts

#1

General Discussion / Re: Free GeoIP Database to use...

Last post by Tonton Jo - Today at 09:26:44 PM

Hi!

Not sure if it's the right place, but i wanted to share this:

I've vibecoded a script that generate a geoIP database from scratch that matches the requirements in terms of format for Opnsense.

• It was fully open sources
• Based on the internet registries database
• Automatically updated everyday using a workflow
• PS and Bash scripts to self host / build yourselves available.

The database can be downloaded here and will be automatically updated:
link deleted

Find the scripts for both bash and Powershell usage if you need to self-host here:
link deleted

Regards

Jo

This looks like a useful contribution to the OPNsense community! Having an open-source GeoIP database that updates automatically could make maintenance much easier for self-hosters. I'd be particularly interested in how you validate the registry data, handle IPv4 and IPv6 ranges, and ensure the generated database stays compatible with OPNsense updates. Documentation on data accuracy and a few reproducible tests would also help build confidence for people who want to use it in production.

Hello sir,

Thanks for your interest, i do think this is usefull.

It's back online thanks to IPLocate.io who share an usable and updated database.
It's now even more accurate than RIR databases.

#2

26.7 Series / Re: SSD drive died - I disable...

Last post by Patrick M. Hausen - Today at 09:14:06 PM

Just the OS or something else?

VM and jail storage in a mirror vdev/pool. Constantly written. One of the VMs is Elastiflow on Ubuntu.

Monitoring health with Scrutiny and Grafana. No issues with 50% of "Percentage used" in SMART output. Replaced with new ones shortly after going over 50%

For an OPNsense installation even with Elastic 1 TB is plenty. And at the end of the day you need to store the data *somewhere*. So even if you could use an external Elastic instance with Zenarmor in the free or home tier, that one would probably run on an SSD, too - as does my Elastiflow.

I'd categorise the two mentioned products as "prosumer". I have dozens of the Samsung 970 at home, friends' homes, at work, ... never lost one so far.

#3

26.7 Series / Re: SSD drive died - I disable...

Last post by nero355 - Today at 08:35:11 PM

I think a TBW of 600 for a 1T device is quite good and will easily last a couple of years. I'm using both the Samsung and the WD in my two NAS systems.

For what exactly : Just the OS or something else ?

Don't get me wrong :
I am sure they will last a while, but I wouldn't be surprised if they would suddenly fail for whatever reason...
They all also have very basic power loss protection because of the lack of onboard capacitors that protect the RAM Cache (Which they luckily have unlike some other SSD models IIRC) and that can have a very bad effect on the integrity of your data !!

#4

26.7 Series / Re: SSD drive died - I disable...

Last post by Patrick M. Hausen - Today at 07:07:11 PM

I think a TBW of 600 for a 1T device is quite good and will easily last a couple of years. I'm using both the Samsung and the WD in my two NAS systems.

#5

General Discussion / Re: Openstack support

Last post by itstechguy - Today at 06:37:34 PM

OpenStack support for OPNsense would be interesting, especially for teams managing multiple firewall instances. Automating deployment, interface configuration, and network setup could save a lot of time and reduce manual errors. I'd be curious to know whether anyone has successfully implemented this using cloud-init, Terraform, or Ansible, and what limitations they encountered with virtual network interfaces and routing. A documented deployment example would be a great starting point for the community.

#6

Portuguese - Português / Re: Crash - Atualizando do 26....

Last post by itstechguy - Today at 06:30:20 PM

Hoje 16-07-2026,Tentei por 2 vezes atualizar o firewall e deu erro.
Como tenho instalado o Adguard (mimugmail), vou tentar mais uma vez apos desinstala-lo.
Se o problema começou após uma atualização recente, consultar informações sobre uma versão antiga pode ajudar a entender se houve alguma mudança relevante, embora seja importante usar apenas versões compatíveis e confiáveis. Se o erro persistir, os logs podem ajudar bastante a encontrar a solução..
Apesar que pelas imagens a seguir, não acredito muito que seja este o problema, mas...
Alguem teve o mesmo erro na hora de atualizar?

Já passei por problemas semelhantes ao atualizar o OPNsense, principalmente quando há plugins de terceiros instalados. Antes de desinstalar o AdGuard, eu verificaria os logs de atualização para identificar a causa exata do erro. Também vale conferir possíveis incompatibilidades com a versão atual do firewall.

#7

General Discussion / Re: Free GeoIP Database to use...

Last post by itstechguy - Today at 06:26:04 PM

Hi!

Not sure if it's the right place, but i wanted to share this:

I've vibecoded a script that generate a geoIP database from scratch that matches the requirements in terms of format for Opnsense.

• It was fully open sources
• Based on the internet registries database
• Automatically updated everyday using a workflow
• PS and Bash scripts to self host / build yourselves available.

The database can be downloaded here and will be automatically updated:
link deleted

Find the scripts for both bash and Powershell usage if you need to self-host here:
link deleted

Regards

Jo

This looks like a useful contribution to the OPNsense community! Having an open-source GeoIP database that updates automatically could make maintenance much easier for self-hosters. I'd be particularly interested in how you validate the registry data, handle IPv4 and IPv6 ranges, and ensure the generated database stays compatible with OPNsense updates. Documentation on data accuracy and a few reproducible tests would also help build confidence for people who want to use it in production.

#8

General Discussion / Re: Advice on migration

Last post by itstechguy - Today at 06:24:51 PM

Hi guys, noob here.

I decided to get rid of my shitty TP-Link router and run Opnsense as a replacement. I have an ONT and PPPoE access from my ISP plus some self definedsome routing rules to my nginx that runs as a reverse proxy. My home lab consists of two proxmox nodes running a total of 20 VMs and LXCs (static IPs on all of them).

I have predefined in Opnsense some VLANs with DHCP with the ranges I want for each.

How should I replace the router with minimum disruption?

The approaches I can think about are:

Opnsense before everything, where I configure PPoE WAN, router after it with DHCP WAN. I gradually connect each node to Opnsense until migration is complete, after which the router is removed.

Router as is, opnsense has DHCP WAN. I gradually connect each node to Opnsense until migration is complete. Change opnsense Wan to PPPoE.

I am aware that machines connected to the new Opnsense vlan will not be able to connect with others and the gradual migration will be done in batches based on their dependency.

Any help or suggestions are appreciated. Thank you.

Hi

If I were you, I'd go with a staged migration, but make sure you have a backup of your current router configuration and a way to roll back if something goes wrong. Since you're using PPPoE, VLANs, and a reverse proxy, I'd first test the WAN connection and firewall rules, then migrate one VLAN or group of VMs at a time. Also, double-check DHCP scopes and routing to avoid IP conflicts or breaking access to your Proxmox nodes. Keeping the old router ready until everything is verified will make the transition much less stressful.

#9

General Discussion / Re: Firewall Map Plugin

Last post by itstechguy - Today at 06:23:16 PM

I'd be cautious too, especially with firewall plugins that can affect network security. I'd review the source code, check for community feedback, and test it in a lab environment before installing it on a production system. Getting an independent code review and wider community adoption would go a long way toward building trust.

#10

26.7 Series / Re: SSD drive died - I disable...

Last post by nero355 - Today at 06:06:25 PM

Maybe try to get one used. Samsung 970, WD Black, ... that kind of devices.

NOFI, but that's consumer crap and will probably have the same outcome over time as his old SSD that died... :'(

"This is the way" =>

older low-end enterprise-type devices

Or whatever Workstation/Enterprise SSD you can get for a decent price :)

This example :

(I never had any of my SSDs die on me, and I own some that I have used for well over ten years - including the one in the laptop I'm writing this message from)

Is probably one of those too : Good old Intel 320 Series 160/180 GB with MLC NAND or so ??

Ohh and by the way :
You could disable Hostwatch to reduce logging too! ;)