"Recent posts
#1
Development and Code Review / MCP Server
Last post by HappyDoer - Today at 12:39:39 AMHas there been any consideration of an official MCP (Model Context Protocol) server for OPNsense? MCP is the open standard AI assistants (Claude, ChatGPT, Copilot, local LLMs etc.) use to talk to external tools, and since OPNsense already has a comprehensive REST API it seems a natural fit.
This could be either a first-class project or a vetted community project linked from the documentation's "Community Plugins > Other" list.
From a quick review, these are the most developed projects at the moment:
An official server would help me with:
A quick GitHub search already turns up 42 OPNsense MCP server projects, so there's clearly demand. Unfortunately, effort is spread across many partial implementations rather than one complete, up-to-date server. Would the team consider either building one or working with an external maintainer to list a recommended community option in the docs?
This could be either a first-class project or a vetted community project linked from the documentation's "Community Plugins > Other" list.
From a quick review, these are the most developed projects at the moment:
- Pixelworlds/opnsense-mcp-server (appears abandoned and is now outdated), and the more active adrianfako/opnsense-mcp-server fork.
- vespo92/OPNSenseMCP, which has been mentioned on this forum before.
An official server would help me with:
- Security and trust - a firewall is the last place you want an unvetted tool holding admin credentials. An official server could use the API only, with least-privilege API users and a clear read-only mode, rather than relying on SSH or shell access.
- Keeping up with releases - community servers fall behind as the API changes between releases. If one was maintained alongside OPNsense, it would track those changes.
- Troubleshooting and auditing - asking "why can't VLAN 20 reach the NAS?" or "which rules are unused or overlapping?" and getting an answer based on the live config, logs and states.
- Safer changes - describing a change in plain language, then reviewing the exact rules, aliases or NAT entries proposed before they are applied.
A quick GitHub search already turns up 42 OPNsense MCP server projects, so there's clearly demand. Unfortunately, effort is spread across many partial implementations rather than one complete, up-to-date server. Would the team consider either building one or working with an external maintainer to list a recommended community option in the docs?
#2
Russian - Русский / Какое видеонаблюдение установи...
Last post by Max NV - Today at 12:23:13 AMЗдравствуйте!
Есть ли какое-нибудь видеонаблюдение для дома?
Простенькое, наподобие motion для Linux.
Есть ли какое-нибудь видеонаблюдение для дома?
Простенькое, наподобие motion для Linux.
#3
26.7, 26.10 Series / Re: cve-2026-98432 (linux behi...
Last post by paepcke - Today at 12:08:28 AMFrom my understanding the bug itself (a very rare race condition in the ip option set multiprocessing handling) is useless without further down the road support via more flexible tcp header options.
The full working exploit chain requirements are not disclosed yet - for obvious reasons - but the Anthropic sample exploit seems to need mptcp enabled tcp services and tcp options support for the 2nd step, thats why all current more complex IDS rules targeting tcp.
Simply blocking ALL ip-options seems to be right choice here - after a review of the corresponding RFCs that define most of the prehistoric use cases.
Thanks for the qualified Feedback!
OPNsense/pf seems to be well equipped for the coming CVE-2026-98432 Linux Apocalypse. No need to inspect the tcp options in this case.
#4
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by really_lost - Today at 12:02:53 AMInstalling the legacy firewall plug-in, performing the migration I missed on NAT, and uninstalling the legacy plugin worked.
#5
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by Manfred.Knick - November 02, 2026, 11:51:59 PMC.f. Migration Notes:
(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.
AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.
Having migrated early, I can't test if the plugin is necessary for the Migration assistant.
Hth.
(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.
AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.
Having migrated early, I can't test if the plugin is necessary for the Migration assistant.
Hth.
#6
26.7, 26.10 Series / Re: Likely messed up NAT conve...
Last post by viragomann - November 02, 2026, 10:09:36 PMQuote from: really_lost on November 02, 2026, 08:54:20 PMThat's why I was wondering if it is as simple as installing the old rule plugin and then proceeding.This worked for me on 26.7.8.
Installed the legacy rules plugin, exported the outbound NAT rules and imported the file on the source NAT page and deleted the old rules finally.
After this was done, I removed the plugin again.
#7
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - November 02, 2026, 10:05:23 PMHi,
Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:
1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.
To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?
Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.
Sergio
Don't give up yet. The usual way out is to go back to a simple setup and add one thing at a time, checking each step before the next:
1. Start with no VLANs at all: WAN on one port, LAN on another, the PC directly on the LAN port. Make sure you get an IP by DHCP and can browse the internet. For DNS, use only ONE service at the start (Unbound, which is the default) and leave the DHCP/DNS settings as they are out of the box.
2. Only then add the VLANs. On a TP-Link TL-SG108E remember it is not enough to put the port in a VLAN: you usually also need to set the PVID of the port. Keep one port untagged on the default VLAN as a safe way back into the web UI.
3. Only after that add WireGuard. WireGuard itself does not depend on VLANs, it needs a working WAN, a firewall rule that allows its UDP port on WAN, and a rule on the WireGuard interface.
To help you better it would be useful to know:
- What do you want WireGuard for: reaching your home network from outside, or sending your traffic through a VPN provider?
- Is your OPNsense behind the ISP router (double NAT) or directly on the internet?
- How many network ports does the mini PC have, and which one is WAN and which is LAN?
- Which OPNsense version are you running (System > Firmware)?
Also, a backup of config.xml (System > Configuration > Backups) before each big change means you never need to reinstall from scratch.
Sergio
#8
High availability / Re: Aliases to support "No XML...
Last post by BoNetTech - November 02, 2026, 10:02:05 PMThanks Franco. Ticket opened: https://github.com/opnsense/core/issues/11142
#9
Tutorials and FAQs / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - November 02, 2026, 09:52:28 PMHi thanks for the reply.. I copied from notepad just written out. I'm trying to get OpnSense working in general with Wireguard and the vlans.
I have a modem in bridge mode provided by my isp to the (WAN) of The mini PC. It is OK and working I have 2 NICs 128ssd 4gb ram. I installed the Zfs with no other partitions, wiped fresh.
From mini PC (LAN) to switch port 1. I guess that's the trunk? I have 8 port Tp link TLSG108E managed.
I wanted to do the installation and setup offline until the end to test the VPN and kill switch. I want all vlans to go through wireguard VPN no fallback on ISP. I want to have the management local only through wired offline connection.
I did have this working somewhat with no loss to web ui but I changed something while doing DNS and it lost access..
I have 4 vlans set up,
Port1- Trunk
Port2,6- Vlan20 for PC
Ports3,4,5 - Vlan10 for consoles
Port7 - Vlan30 Guest (WiFi ap later)
Port8 - Vlan99 Management
I think everything is setup correctly up until I started doing dnsmasq and dhcp. I don't understand these and used chatgpt but got locked out of the web ui.
I can access when I hook a keyboard up to the mini pc and enter shell, then pfctl -d, that let's me access again from My management vlan99 on port 8.
Then once I log in on PC, I enter pfctl -e in shell to activate it again.
I can change whatever and log out log in but as soon as I close the broswer it wipes the data on there and I can't get back in whereas before I could after clearing cookies and data.
I've got a handshake from wireguard but I can't access the internet from anything so I searched what it could be, suggestions were dns, firewall rules, dhcp, I've never fully went to a website or anything online yet.
I started to attempt to fix that, but lost access now I have multiple problems and I'm not much of a tech person, I do know a little bit I'm trying to learn as much as I can.
The bit about the tutorials is for the killswitch floating rule.
The tutorial says to make a floating rule for the WAN to interface with matching tag to block ISP fall back if connection is lost, but when I click apply on that rule it disappears from floating rules and ends up under WAN rules instead. Its confusing for me to understand when I don't know the basic all that well, this seems for far more advanced people than for my level 😅
I used chatgpt for this whole setup guide so far I told it to use opnsense.org documentation for any reference and no guessing if that helps any.. I dont want to come into a space im still learning about by using ai to do it for me i want to actually learn how to get this running.
I hope that can give a better picture of what I have going on. I don't know what you need to know for my settings but just let me know.
I have a modem in bridge mode provided by my isp to the (WAN) of The mini PC. It is OK and working I have 2 NICs 128ssd 4gb ram. I installed the Zfs with no other partitions, wiped fresh.
From mini PC (LAN) to switch port 1. I guess that's the trunk? I have 8 port Tp link TLSG108E managed.
I wanted to do the installation and setup offline until the end to test the VPN and kill switch. I want all vlans to go through wireguard VPN no fallback on ISP. I want to have the management local only through wired offline connection.
I did have this working somewhat with no loss to web ui but I changed something while doing DNS and it lost access..
I have 4 vlans set up,
Port1- Trunk
Port2,6- Vlan20 for PC
Ports3,4,5 - Vlan10 for consoles
Port7 - Vlan30 Guest (WiFi ap later)
Port8 - Vlan99 Management
I think everything is setup correctly up until I started doing dnsmasq and dhcp. I don't understand these and used chatgpt but got locked out of the web ui.
I can access when I hook a keyboard up to the mini pc and enter shell, then pfctl -d, that let's me access again from My management vlan99 on port 8.
Then once I log in on PC, I enter pfctl -e in shell to activate it again.
I can change whatever and log out log in but as soon as I close the broswer it wipes the data on there and I can't get back in whereas before I could after clearing cookies and data.
I've got a handshake from wireguard but I can't access the internet from anything so I searched what it could be, suggestions were dns, firewall rules, dhcp, I've never fully went to a website or anything online yet.
I started to attempt to fix that, but lost access now I have multiple problems and I'm not much of a tech person, I do know a little bit I'm trying to learn as much as I can.
The bit about the tutorials is for the killswitch floating rule.
The tutorial says to make a floating rule for the WAN to interface with matching tag to block ISP fall back if connection is lost, but when I click apply on that rule it disappears from floating rules and ends up under WAN rules instead. Its confusing for me to understand when I don't know the basic all that well, this seems for far more advanced people than for my level 😅
I used chatgpt for this whole setup guide so far I told it to use opnsense.org documentation for any reference and no guessing if that helps any.. I dont want to come into a space im still learning about by using ai to do it for me i want to actually learn how to get this running.
I hope that can give a better picture of what I have going on. I don't know what you need to know for my settings but just let me know.
#10
26.7, 26.10 Series / Re: Upgrade from 26.7.7 to 26...
Last post by danmac - November 02, 2026, 09:50:05 PMI think your nearest mirror would be LeaseWeb (HTTPS, San Francisco, US) you could try that
your problem looks somewhat familiar, you are by no means the first to battle the updater along similar lines:
https://forum.opnsense.org/index.php?topic=52388.0
although I cannot recommend tinkering off-piste with the update scripts as I've done, given that yours is production gear you can't just reach over to hit with a hammer, plus I haven't checked if those changes even apply to the download that's failing on yours
good luck o7, pmji :)
your problem looks somewhat familiar, you are by no means the first to battle the updater along similar lines:
https://forum.opnsense.org/index.php?topic=52388.0
although I cannot recommend tinkering off-piste with the update scripts as I've done, given that yours is production gear you can't just reach over to hit with a hammer, plus I haven't checked if those changes even apply to the download that's failing on yours
good luck o7, pmji :)
