"Recent posts
#1
General Discussion / Re: Let's AI Opnsense!
Last post by patlegu - Today at 05:52:26 PMHello,
The pages should be accessibles now; there were some minor issues with the site's geographic exclusion settings.
No worries, I understand your point of view. I'm not trying to sell anything. What you'll find in my notebook (nope.breizhland.eu) is strictly for my personal use. I log my tests there, along with site translations for quick reference, cheat sheets, and so on. If others find it useful, that's great, but it's not the primary goal. To circle back to my previous message: all my tests are run on the CPU using SLMs (Small Language Models) with the lightest possible system footprint. The results aren't always perfect, but that's part of the game.
My colleagues didn't think a practical implementation was possible, but it turned out to be—thanks to automation tools (OpenTofu, Ansible, etc.) that dynamically manage the creation and teardown of SLMs as supplementary resources. Admittedly, at the individual SLM level, it's 10 times slower on a CPU, but it costs 25 to 30 times less. You can have multiple SLMs processing incident queues or work orders. I'm not claiming this is *the* solution, but others might well find it useful at some point. Or not. :-) I don't use an MCP server; I rely solely on custom-built corpora. Training and validation are based on JSONL files containing thousands of lines, which serve as the foundation for training these LoRAs.
As for my current project, I'm simply exploring ways to use SaaS-based LLMs while keeping sensitive information out of their reach. I don't claim the results will be definitive. We'll see—the project might not pan out—but I'll have learned a lot along the way.
Regarding firewall security, I completely agree. Adding an internal AI component only increases the attack surface; this test was intended solely to observe the potential outcome. Nothing was deployed to production based on this, and I certainly wouldn't recommend doing so—quite the opposite, in fact.
In any case, thanks for the feedback. Have a great day.
Pat.
I almost forgot: all these "projects" are merely PoCs and have no other value. They should not be put into production as-is.
The pages should be accessibles now; there were some minor issues with the site's geographic exclusion settings.
No worries, I understand your point of view. I'm not trying to sell anything. What you'll find in my notebook (nope.breizhland.eu) is strictly for my personal use. I log my tests there, along with site translations for quick reference, cheat sheets, and so on. If others find it useful, that's great, but it's not the primary goal. To circle back to my previous message: all my tests are run on the CPU using SLMs (Small Language Models) with the lightest possible system footprint. The results aren't always perfect, but that's part of the game.
My colleagues didn't think a practical implementation was possible, but it turned out to be—thanks to automation tools (OpenTofu, Ansible, etc.) that dynamically manage the creation and teardown of SLMs as supplementary resources. Admittedly, at the individual SLM level, it's 10 times slower on a CPU, but it costs 25 to 30 times less. You can have multiple SLMs processing incident queues or work orders. I'm not claiming this is *the* solution, but others might well find it useful at some point. Or not. :-) I don't use an MCP server; I rely solely on custom-built corpora. Training and validation are based on JSONL files containing thousands of lines, which serve as the foundation for training these LoRAs.
As for my current project, I'm simply exploring ways to use SaaS-based LLMs while keeping sensitive information out of their reach. I don't claim the results will be definitive. We'll see—the project might not pan out—but I'll have learned a lot along the way.
Regarding firewall security, I completely agree. Adding an internal AI component only increases the attack surface; this test was intended solely to observe the potential outcome. Nothing was deployed to production based on this, and I certainly wouldn't recommend doing so—quite the opposite, in fact.
In any case, thanks for the feedback. Have a great day.
Pat.
I almost forgot: all these "projects" are merely PoCs and have no other value. They should not be put into production as-is.
#2
Virtual private networks / Re: [Guide] ProtonVPN WireGuar...
Last post by mlenje - Today at 04:26:01 PMUpdate - alert email duplication if you're using Gateway Groups + Monit
Small follow-up for anyone who builds this and then gets a real (non-test) failover event: if you've got Monit alerting on your individual gateway(s) and you're using Gateway Groups, you'll likely get double emails per event.
Turns out OPNsense auto-registers its own native Monit check called "gateway_alert" (script: /usr/local/opnsense/scripts/monit/gateway_alert.php) as soon as you set up Gateway Group alerting - separate from any custom per-gateway Monit check you build yourself following a guide like this one. Both end up watching the same underlying gateway, so a single real down/up event fires two separate emails.
A few things worth knowing if you hit this:
What I did instead: upgraded my own custom per-gateway alert script to match the native one's down-message detail (names the routing group) AND added a real recovery message with actual delay/loss numbers - something the native script never provides either way. Once my custom script covered everything the native one did plus more, I just disabled the native "gateway_alert" check in Services > Monit > Settings and kept only my own. One informative email per real transition now, in both directions, with zero risk of losing the customization to a future update since it's entirely in a script I own.
Updated script (drop-in replacement for the alert script from earlier in this thread):
Don't disable the native check blindly - check this first: "gateway_alert.php" only loops over gateways that are members of a Gateway Group (look at the source, it walks getGroupsConfig() -> tiers). If your plain WAN gateway is also a member of some other group on your box, disabling this native check would blind you to a raw WAN outage too - don't do that. Check System > Gateways > Group and confirm exactly which gateways are covered before disabling anything. In my case only the two ProtonVPN gateways were in any group, so my main WAN was never covered by this check either way - disabling it cost me nothing I actually had. Your setup may differ.
(Side note if this does apply to you: a dedicated alert for a full WAN-down event is arguably moot anyway, since the box usually can't get an email out over a WAN link that's actually down - so this mostly only matters if you also want alerts for partial degradation like high WAN latency/loss, or a "we're back, here's how long we were down" message after the fact.)
Also worth knowing if you're new to this: Monit only alerts on a state transition, not ongoing status - so if only your primary gateway goes down and your rollover/secondary was healthy the whole time, you won't get any email at all for the secondary. That's expected, not a gap in coverage.
Real-world confirmation, for what it's worth: this whole setup got its first genuine (non-test) workout the night after I built it - primary tunnel dropped for about an hour due to a real upstream VPN provider hiccup, failed over automatically, recovered and failed back automatically, zero manual intervention needed. That's the actual point of building this in the first place, so good to see it hold up outside of deliberate testing.
Small follow-up for anyone who builds this and then gets a real (non-test) failover event: if you've got Monit alerting on your individual gateway(s) and you're using Gateway Groups, you'll likely get double emails per event.
Turns out OPNsense auto-registers its own native Monit check called "gateway_alert" (script: /usr/local/opnsense/scripts/monit/gateway_alert.php) as soon as you set up Gateway Group alerting - separate from any custom per-gateway Monit check you build yourself following a guide like this one. Both end up watching the same underlying gateway, so a single real down/up event fires two separate emails.
A few things worth knowing if you hit this:
- The native "gateway_alert" script is actually more detailed on the down side than a simple custom script - it names the routing group being affected and distinguishes down vs packet-loss vs high-latency triggers.
- But it's silent on recovery by design - look at the source and the success path never echoes anything, so Monit just shows a generic "status succeeded (0) -- no output" when a gateway comes back up. No detail at all.
- Don't edit that native script directly to fix this - it's core OPNsense code (Copyright Deciso B.V.) and any local change will likely get silently overwritten on your next firmware update.
What I did instead: upgraded my own custom per-gateway alert script to match the native one's down-message detail (names the routing group) AND added a real recovery message with actual delay/loss numbers - something the native script never provides either way. Once my custom script covered everything the native one did plus more, I just disabled the native "gateway_alert" check in Services > Monit > Settings and kept only my own. One informative email per real transition now, in both directions, with zero risk of losing the customization to a future update since it's entirely in a script I own.
Updated script (drop-in replacement for the alert script from earlier in this thread):
Code Select
#!/usr/local/bin/php
<?php
require_once 'config.inc';
require_once 'interfaces.inc';
require_once 'util.inc';
require_once 'plugins.inc.d/dpinger.inc';
$gwname = 'YOUR_GATEWAY_NAME';
$groupname = 'YOUR_GATEWAY_GROUP_NAME';
$gateways_status = dpinger_status();
if (empty($gateways_status[$gwname])) {
echo "Gateway {$gwname} status could not be determined." . PHP_EOL;
exit(1);
}
$status = $gateways_status[$gwname]['status'];
$delay = $gateways_status[$gwname]['delay'];
$loss = $gateways_status[$gwname]['loss'];
if (stristr($status, 'down') !== false) {
echo "MONITOR: {$gwname} is down, removing from routing group {$groupname}." . PHP_EOL;
exit(1);
}
echo "MONITOR: {$gwname} is up (delay {$delay}, loss {$loss}), rejoining routing group {$groupname}." . PHP_EOL;
exit(0);
Don't disable the native check blindly - check this first: "gateway_alert.php" only loops over gateways that are members of a Gateway Group (look at the source, it walks getGroupsConfig() -> tiers). If your plain WAN gateway is also a member of some other group on your box, disabling this native check would blind you to a raw WAN outage too - don't do that. Check System > Gateways > Group and confirm exactly which gateways are covered before disabling anything. In my case only the two ProtonVPN gateways were in any group, so my main WAN was never covered by this check either way - disabling it cost me nothing I actually had. Your setup may differ.
(Side note if this does apply to you: a dedicated alert for a full WAN-down event is arguably moot anyway, since the box usually can't get an email out over a WAN link that's actually down - so this mostly only matters if you also want alerts for partial degradation like high WAN latency/loss, or a "we're back, here's how long we were down" message after the fact.)
Also worth knowing if you're new to this: Monit only alerts on a state transition, not ongoing status - so if only your primary gateway goes down and your rollover/secondary was healthy the whole time, you won't get any email at all for the secondary. That's expected, not a gap in coverage.
Real-world confirmation, for what it's worth: this whole setup got its first genuine (non-test) workout the night after I built it - primary tunnel dropped for about an hour due to a real upstream VPN provider hiccup, failed over automatically, recovered and failed back automatically, zero manual intervention needed. That's the actual point of building this in the first place, so good to see it hold up outside of deliberate testing.
#3
26.7 Series / Re: Renewed server certificate...
Last post by Ed V. - Today at 04:07:26 PMUpgrade to 26.7.2_2
No change. Still unable to add or update SSL certificates via the WebUI.
Is there a way to do this via Command Line?
No change. Still unable to add or update SSL certificates via the WebUI.
Is there a way to do this via Command Line?
#4
Announcements / OPNsense 26.4.2 business editi...
Last post by franco - Today at 04:06:24 PMThis business release is based on the OPNsense 26.1.11 community version
with additional reliability improvements.
Please note that this release offers source NAT as a tentative replacement
for outbound NAT. Feature parity is a work in progress for the 26.10 series.
For now, please be aware that source NAT continues to work as before,
but the GUI will not allow you to edit the source NAT rules unless you
choose hybrid or manual mode in the settings. This aligns with how the
outbound NAT page is working. Starting with 26.10, the hybrid or manual
mode will be required to render source NAT rules into the firewall.
Here are the full patch notes for the initial release:
o system: improve the log_archive script to also work on log subdirectories
o system: routing: changed "disable" option to "enable"
o system: add "local_uri" type in SanitizeFilter() and use it to avoid hardcoding
o system: several compatible adjustments for upcoming PHP 8.5
o system: enhance live log widget (contributed by Greelan)
o system: support 7680 bit RSA type for certificates and authorities
o reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
o reporting: stop NetFlow service before reloading configuration
o interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
o interfaces: fix typos in GIF reconfiguration script
o interfaces: improve VIP page save when no subnet was posted
o firewall: use htmlSafe() on action search value in live log[1] (reported by call-AX)
o firewall: always show automatic and legacy rules in new rules GUI
o firewall: add the same new rules GUI design to the MVC NAT pages
o firewall: add CSV download/upload to MVC NAT pages
o firewall: add migration for outbound NAT into source NAT page
o firewall: destination NAT: display effective port when local-port is omitted
o firewall: source NAT: allow empty target which means the interface address
o firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
o firewall: improve performance on MVC pages using virtualDOM
o firewall: allow WAN as "associated interface" for NPTv6 when prefix ID is set
o firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
o firewall: show rule counts that can be exported and hide tab if no rules exist
o firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
o firewall: add validations for "No RDR" option to prevent target and local-port being set
o firewall: fix some small issues in menu registration for legacy pages
o firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
o firewall: scope get action to general settings in source NAT
o kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
o kea: add widget to show DHCP leases
o kea: simplify model option values
o kea: improve prefix watcher accuracy via both interface and MAC address key
o kea: store subnet IDs inside the model so they cannot shift during config regeneration
o kea: change dynamic pool range from prefix to range 1000-2000
o kea: switch custom DHCP option config generation to libdhcp_flex_option library
o openvpn: add some input validation for control characters in connection status[2] (reported by lujiefsi)
o openvpn: simplify model option values
o unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
o unbound: update Hagezi blocklists to use new mirror URL
o mvc: add some missing htmlSafe() calls for generated HTML[3] (reported by lujiefsi)
o mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
o mvc: DescriptionField: disable special and newline characters
o mvc: FileObject: fix exception bug (contributed by Greelan)
o mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
o mvc: use camelCase for carp_status action
o mvc: translate backend system status messages
o mvc: translate grid view labels
o ui: add some more legacy_html_escape_form_data() safeguards[4] (reported by Arpit Jain)
o ui: bootgrid: minor optimizations
o plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS[5]
o plugins: os-OPNWAF 2.3
o plugins: os-cloudflared 1.1[6]
o plugins: os-freeradius 1.10.2[7]
o plugins: os-vnstat 1.4[8]
o src: igc: disable PCIe ASPM to improve stability
o src: ena: update driver version to v2.8.3
o src: coredump: do not assume that the number of ELF segments is consistent[9]
o src: sysvsem: fix a TOCTOU race in semctl()[10]
o src: wg: check for crypto operation errors[11]
o src: tzdata: import 2026c[12]
o ports: curl 8.21.0[13]
o ports: lighttpd 1.4.84[14]
o ports: openssh 10.4p1[15]
o ports: openvpn 2.7.6[16]
o ports: phalcon 5.16.0[17]
o ports: py-duckdb 1.5.4[18]
o ports: python 3.13.15[19]
o ports: syslog-ng 4.12.0[20]
o ports: unbound 1.26.0[21]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[2] https://github.com/opnsense/core/security/advisories/GHSA-fqmm-g6xw-qhm4
[3] https://github.com/opnsense/core/security/advisories/GHSA-75fw-j788-j4hj
[4] https://github.com/opnsense/core/security/advisories/GHSA-6vv6-fpw9-8r2g
[5] https://docs.opnsense.org/vendor/deciso/opndns.html
[6] https://github.com/opnsense/plugins/blob/stable/26.1/net/cloudflared/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/net/freeradius/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.1/net/vnstat/pkg-descr
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:55.elf.asc
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:54.sysvsem.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
[13] https://curl.se/changes.html#8_21_0
[14] https://www.lighttpd.net/2026/06/17/1.4.84/
[15] https://www.openssh.com/txt/release-10.4
[16] https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst
[17] https://github.com/phalcon/cphalcon/releases/tag/v5.16.0
[18] https://github.com/duckdb/duckdb/releases/tag/v1.5.4
[19] https://docs.python.org/release/3.13.15/whatsnew/changelog.html
[20] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.12.0
[21] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-0
with additional reliability improvements.
Please note that this release offers source NAT as a tentative replacement
for outbound NAT. Feature parity is a work in progress for the 26.10 series.
For now, please be aware that source NAT continues to work as before,
but the GUI will not allow you to edit the source NAT rules unless you
choose hybrid or manual mode in the settings. This aligns with how the
outbound NAT page is working. Starting with 26.10, the hybrid or manual
mode will be required to render source NAT rules into the firewall.
Here are the full patch notes for the initial release:
o system: improve the log_archive script to also work on log subdirectories
o system: routing: changed "disable" option to "enable"
o system: add "local_uri" type in SanitizeFilter() and use it to avoid hardcoding
o system: several compatible adjustments for upcoming PHP 8.5
o system: enhance live log widget (contributed by Greelan)
o system: support 7680 bit RSA type for certificates and authorities
o reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
o reporting: stop NetFlow service before reloading configuration
o interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
o interfaces: fix typos in GIF reconfiguration script
o interfaces: improve VIP page save when no subnet was posted
o firewall: use htmlSafe() on action search value in live log[1] (reported by call-AX)
o firewall: always show automatic and legacy rules in new rules GUI
o firewall: add the same new rules GUI design to the MVC NAT pages
o firewall: add CSV download/upload to MVC NAT pages
o firewall: add migration for outbound NAT into source NAT page
o firewall: destination NAT: display effective port when local-port is omitted
o firewall: source NAT: allow empty target which means the interface address
o firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
o firewall: improve performance on MVC pages using virtualDOM
o firewall: allow WAN as "associated interface" for NPTv6 when prefix ID is set
o firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
o firewall: show rule counts that can be exported and hide tab if no rules exist
o firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
o firewall: add validations for "No RDR" option to prevent target and local-port being set
o firewall: fix some small issues in menu registration for legacy pages
o firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
o firewall: scope get action to general settings in source NAT
o kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
o kea: add widget to show DHCP leases
o kea: simplify model option values
o kea: improve prefix watcher accuracy via both interface and MAC address key
o kea: store subnet IDs inside the model so they cannot shift during config regeneration
o kea: change dynamic pool range from prefix to range 1000-2000
o kea: switch custom DHCP option config generation to libdhcp_flex_option library
o openvpn: add some input validation for control characters in connection status[2] (reported by lujiefsi)
o openvpn: simplify model option values
o unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
o unbound: update Hagezi blocklists to use new mirror URL
o mvc: add some missing htmlSafe() calls for generated HTML[3] (reported by lujiefsi)
o mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
o mvc: DescriptionField: disable special and newline characters
o mvc: FileObject: fix exception bug (contributed by Greelan)
o mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
o mvc: use camelCase for carp_status action
o mvc: translate backend system status messages
o mvc: translate grid view labels
o ui: add some more legacy_html_escape_form_data() safeguards[4] (reported by Arpit Jain)
o ui: bootgrid: minor optimizations
o plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS[5]
o plugins: os-OPNWAF 2.3
o plugins: os-cloudflared 1.1[6]
o plugins: os-freeradius 1.10.2[7]
o plugins: os-vnstat 1.4[8]
o src: igc: disable PCIe ASPM to improve stability
o src: ena: update driver version to v2.8.3
o src: coredump: do not assume that the number of ELF segments is consistent[9]
o src: sysvsem: fix a TOCTOU race in semctl()[10]
o src: wg: check for crypto operation errors[11]
o src: tzdata: import 2026c[12]
o ports: curl 8.21.0[13]
o ports: lighttpd 1.4.84[14]
o ports: openssh 10.4p1[15]
o ports: openvpn 2.7.6[16]
o ports: phalcon 5.16.0[17]
o ports: py-duckdb 1.5.4[18]
o ports: python 3.13.15[19]
o ports: syslog-ng 4.12.0[20]
o ports: unbound 1.26.0[21]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c
[2] https://github.com/opnsense/core/security/advisories/GHSA-fqmm-g6xw-qhm4
[3] https://github.com/opnsense/core/security/advisories/GHSA-75fw-j788-j4hj
[4] https://github.com/opnsense/core/security/advisories/GHSA-6vv6-fpw9-8r2g
[5] https://docs.opnsense.org/vendor/deciso/opndns.html
[6] https://github.com/opnsense/plugins/blob/stable/26.1/net/cloudflared/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.1/net/freeradius/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.1/net/vnstat/pkg-descr
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:55.elf.asc
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:54.sysvsem.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-EN-26:18.tzdata.asc
[13] https://curl.se/changes.html#8_21_0
[14] https://www.lighttpd.net/2026/06/17/1.4.84/
[15] https://www.openssh.com/txt/release-10.4
[16] https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst
[17] https://github.com/phalcon/cphalcon/releases/tag/v5.16.0
[18] https://github.com/duckdb/duckdb/releases/tag/v1.5.4
[19] https://docs.python.org/release/3.13.15/whatsnew/changelog.html
[20] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.12.0
[21] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-26-0
#5
Tutorials and FAQs / Re: OPNsense aarch64 firmware ...
Last post by Maurice - Today at 03:58:40 PMOPNsense 26.7.2 aarch64 packages and sets released. Includes base / kernel 26.7.2_4, core 26.7.2_2 and hostapd 2.12_2.
#6
26.7 Series / Re: Issue upgrading from 26.7....
Last post by john79 - Today at 03:32:53 PMJust to confirm if anyone else run into the same. Suggested solution by franco solved it and up and running on latest version.
#7
26.7 Series / Re: Boot stuck for 1-2 min aft...
Last post by Gilgamesh - Today at 03:31:57 PMThat was my 1st thought as I indeed use Unbound and WG with FQDN.
But 4 lines up I can see Starting Unbound DNS...done. and there is no delay on this line. Only on the mentioned "Configuring WireGuard VPN...".
And the system is not slow, booting from SSD. Usually take under a minute to fully boot. I didn't notice this with the previous firmware based on 26.1.x. No chages in the configuration.
Is there a simple way (GUI) to put some delay for WG?
But 4 lines up I can see Starting Unbound DNS...done. and there is no delay on this line. Only on the mentioned "Configuring WireGuard VPN...".
And the system is not slow, booting from SSD. Usually take under a minute to fully boot. I didn't notice this with the previous firmware based on 26.1.x. No chages in the configuration.
Is there a simple way (GUI) to put some delay for WG?
#8
German - Deutsch / Re: VPN Wireguard Peer Generat...
Last post by schmidi - Today at 03:17:21 PMWow, vielen leiben Dank euch allen für die schnelle Rückmeldung, ich bin begeistert, ich habe tatsächlich mal versucht dies alles manuell anzulegen, leider sehe ich über den Status immer nur den sent aber nicht den recived, also scheint etwas mit den Rollen nicht zu passen. Ich wühle mich mal durch die opnsense docu. Vielen Dank nochmals und ein sonniges Wochenende euch allen
#9
26.7 Series / Re: upgrade from 26.7 to 26.7....
Last post by johanDG - Today at 01:57:32 PMI'm just using the default mirror. Important thing to note: the opnsense firewall is behind a corporate firewall (configured with environment settings - see https://docs.opnsense.org/development/backend/configd.html).
Looks like this approach is broken on 26.7.2
I could install the missing package updates using an bash shell, setting the environment settings for the session and running the following command:
/usr/local/opnsense/scripts/firmware/launcher.sh update
Looks like this approach is broken on 26.7.2
I could install the missing package updates using an bash shell, setting the environment settings for the session and running the following command:
/usr/local/opnsense/scripts/firmware/launcher.sh update
#10
