Recent posts

#1

26.7 Series / how to apply a schedule to a f...

Last post by sleek3177 - Today at 12:55:51 AM

I can't seem to find the way to apply a schedule to a firewall rule.
I have created an alias for the relevant IPs under Firewall>Aliases. I have created a schedule under Firewall>Settings>Schedules.

When I try to create a rule, I don't see anyplace to associate the schedule with the rule.
Am I doing something incorrectly?

#2

General Discussion / Re: Problem with ping on one e...

Last post by drosophila - Today at 12:05:04 AM

It probably is connected to your other issue, there seems to be some cruft in your config that creates a race condition for the IP config, and there seems to be a rules issue that may come from the same source. You could check the firewall live view if those ICMP replies are blocked. Also, your route configuration may be borked and have entries that blackhole these ICMP responses.

Like that a disabled but configured route blocks automatic generation of any route with an identical target network. IOW, if you configure a disabled static route to blackhole 192.168.0.0/16 and have this range on your LAN, then the LAN will get no route at all. This simple case is obviously not what you have, but there may be similar routing configurations left over, depending on the complexity of your set-up.

You could attempt a config export, followed by a config clear and a config import. Unless the remains are stored in the config file they should be gone after this withot affecting the intended configuration.

#3

26.7 Series / Re: Post Update to 26.7.1_1, K...

Last post by Monviech (Cedrik) - July 31, 2026, 11:09:16 PM

You probably have a faulty client polluting your leases.

https://github.com/opnsense/core/pull/10294

#4

26.7 Series / Re: CrowdSec remediation block...

Last post by SonicJoe - July 31, 2026, 10:44:35 PM

Possibly related to this: https://github.com/opnsense/src/issues/303

Edited to link correct issue

#5

Hardware and Performance / Deciso DEC-850v1 thermal senso...

Last post by N0b0dy1985 - July 31, 2026, 10:18:34 PM

On the Deciso DEC-850v1 (AMD Epyc 3201, Netboard A20) I'm trying to figure out which module or driver OPNsense is loading for the thermal sensors. Does anyone know? Does the plugin hwprobe have this info?

Edit, got it thanks anyway!

#6

26.7 Series / Post Update to 26.7.1_1, KeaDH...

Last post by stauf - July 31, 2026, 09:58:34 PM

Is anyone else seeing this?  I had a similar problem in the past and people added in the ability to delete a DHCP entry from the table.  Things have been stable for a few months now and, all of a sudden, after updating to 26.7.1_1, my address pool is getting exhausted.  Normally, I am only using 2-3 addresses in a pool of 30+.  These "declined" entries have a lifetime of 600 (instead of the default lifetime of 4000 which all of my "real" entries are set to).  I'll have to try to do a wireshark trace to find out if anything sending out DHC requests on my network, but I am not aware of any new devices on my network or any config changes.  As far as I know, the only recent change was updating to 26.7.1_1.

Luckily, it appears that my static pool is not being erroneously over-ridden (like it was last time) so, as long as I have static entries for the devices I want on the network (or existing dynamic entries), it is working fine.

What does "declined" mean as a "state" in the KeaDHCP Lease table?  If OpnSense declined a DHCP request, why burn an entry in the Lease table?  Even if it is for a shorter amount of time.

#7

26.7 Series / Re: mDNS forwarding between tw...

Last post by viragomann - July 31, 2026, 08:37:22 PM

Obviously negating 10.0.0.0/8 also catches multicast 224.0.0.251.

Sure.

On my wifi interface for mobile clients I have a rule allowing any to any but RFC 1918 networks and mDNS works great. However, I use UDP Broadcast relay and I don't use it for Airprint.

Thus I'm wondering what is best practice?

• Adding another rule covering mDNS/mutlicast and more than one interface (to make it a global rule) and moving it above the allow internet rule

Should work. So why not?
I just don't know if you really need to allow mDNS on multiple Interfaces.

• Altering the allow internet rule to not match mDNS/multicast (not sure how)

Should work as well, but requires a following rule,  which allows mDNS.
You could add the 10.0.0.0/8 and 224.0.0.251 to an alias and use this one in the rule as destination with 'invert'.

But I would rather add an additional rule for mDNS.

#8

26.7 Series / Re: mDNS forwarding between tw...

Last post by sjjh - July 31, 2026, 07:17:49 PM

As someone who really hates mDNS forcing devices like that I would like to suggest the following :
- Setup a CUPS Printer Server by using something like a Raspberry Pi 2B/3B or a small Intel Atom NUC running Linux.

While I do understand your rationale and agree with your dislike, I'm still hoping that it should be easier and less maintenance to allow mDNS between two VLANs than administering yet another device on the net.

Use Firewall->Log Files->Live View and watch traffic going to and from the printer.

That might have brought me one step closer. I activated logging for all rules on the firewall. One hit (using port 5353) caught my eyes, as it was passed by a rule I didn't have on my mind: We're using following rule to allow outgoing internet traffic:

• type: global rule
• description: allow internet
• interfaces: <basically all>
• quick: yes
• action: pass
• direction: in
• version: IPv4
• protocol: any
• source: any
• source port: any
• invert target: yes
• target: single host or network -> 10.0.0.0/8
• target port: any
• section: source routing
• gateway: WAN_gateway

Obviously negating 10.0.0.0/8 also catches multicast 224.0.0.251. A side-effect I didn't have on my mind. I'm assume that the wan gateway prevents to get it working. Thus I'm wondering what is best practice?

• Adding another rule covering mDNS/mutlicast and more than one interface (to make it a global rule) and moving it above the allow internet rule
• Altering the allow internet rule to not match mDNS/multicast (not sure how)
• Something completely different

I'm happy about a hint.

#9

26.1, 26,4 Series / Re: Suricata - Divert (IPS)

Last post by Gorpes - July 31, 2026, 04:26:13 PM

Hi @Monviech,

I have a follow-up question regarding Divert mode.

My setup is:

- One WAN and one LAN
- Zenarmor is enabled on the LAN interface
- Suricata is running in Divert (IPS) mode
- On LAN I added a Pass + divert-to Intrusion Detection rule (Source: LAN net, Destination: any) above the default "Allow LAN to any" rule.

Everything works as expected:

- Zenarmor inspects the traffic.
- Suricata generates alerts and blocks traffic when configured.
- Traffic matching the divert rule never reaches the default "Allow LAN to any" rule, which I understand is expected.

Is this considered a valid and recommended configuration for a simple home network?

Or would you recommend a different placement of the "divert-to" rule?

Also, is running Zenarmor on LAN together with a "divert-to" rule on the same interface a supported configuration?

Thank you!

#10

German - Deutsch / Re: Fragen zu OpenVPN Server K...

Last post by Patrick M. Hausen - July 31, 2026, 03:53:07 PM

Du kannst easy Screen Shots hochladen, wo genau ist das Problem?