"Recent posts
#1
26.7 Series / Re: os-upnp plugin not working...
Last post by Chris123NT - Today at 01:54:01 AMQuote from: nero355 on July 22, 2026, 06:44:07 PMI mean, even on previous releases, if I didn't have the rule things would complain about strict NAT. With the rule all is fine. I've never gotten the UPNP plugin to give "open NAT" on OPNSense, pretty sure it's not possible in the current releases, but moderate is sufficient to get games to stop complaining so meh.Quote from: Warbreaker on July 22, 2026, 10:12:52 AMIt seems that way now, I didn't need it on 26.1 but the reason of why it was working is unknown to me, but now you do need it with 26.7IMHO you found a bug, because why would you need both of them when uPnP does more than a Source NAT Rule with Strict-port Enabled does : It completely opens the port like a Port Forward a.k.a. Destination NAT Rule would :)
#2
26.7 Series / Re: Services widget
Last post by OzziGoblin - Today at 01:20:38 AMHi Team
Just some feedback on 26.7.1, the upgrade went fine, but I'm using the vicuna theme and the services widget is pretty much unreadable.
Hope you can fix it at some stage
Just some feedback on 26.7.1, the upgrade went fine, but I'm using the vicuna theme and the services widget is pretty much unreadable.
Hope you can fix it at some stage
#3
General Discussion / Re: Migrating OpenBSD pf to Op...
Last post by pfry - Today at 01:19:12 AMQuote from: mbrogies on July 22, 2026, 10:00:14 PM[...]They are handled by the Layer3 Switch. Just routing, no firewalling, nothing...
Security is technically not existend with that setup.[...]
Is your intent to add security? I ditched my L3 switch(es) to go with a flat network where everything runs through the firewall. I even use my (current) switches as port expanders only (each end-station port with a unique VLAN). I have a small network with a relatively large firewall, so it works for me. Your Xeon Gold 6234s should give you decent throughput... One way to find out.
#4
General Discussion / Re: Please Make a Donation to ...
Last post by OzziGoblin - Today at 01:06:31 AMThanks team for all the work you're doing on Opnsense, answering questions, you must have a huge amount of patience :-)
Just donated 30 Euro
Just donated 30 Euro
#5
25.7, 25.10 Legacy Series / Issue browsing to some website...
Last post by tjhoppe - Today at 12:37:25 AM**Environment:**
- OPNsense 25.7.11_9-amd64
- Running as a VM on Proxmox (tested on both VirtIO and Intel E1000 emulated NICs — same result on both)
- WAN: DHCP, no PPPoE, no VLAN tagging
- Outbound NAT: Hybrid mode
**Symptom:**
TCP connections from LAN/WiFi clients (NAT'd through WAN) to certain destinations (confirmed with `www.usmagazine.com` test site, 192.0.66.2:443) hang indefinitely — SYN is sent, no SYN-ACK or any reply ever received. Other destinations (e.g. google.com) work fine through the same forwarding path.
Packet capture on WAN (and confirmed at the Proxmox host bridge level, before the physical NIC) shows the outbound SYN for the affected destination is malformed:
```
16:47:15.153180 IP <wan-ip>.11293 > 192.0.66.2.443: Flags, seq 64240, win 0, length 0
```
No TCP options at all (no MSS, window scale, SACK-permitted, or timestamps), and window size of 0 — not a normal SYN from any TCP stack.
**Critically:** `curl -v 192.0.66.2.443` run *from the OPNsense shell itself* to the same destination completes a normal handshake with correct options and a real window size every time. Only traffic that is **forwarded/NAT'd** through the box (from LAN or WiFi clients) produces the malformed SYN. This is 100% reproducible.
**Ruled out so far:**
- Hardware checksum/TSO/LRO offload — disabled via GUI and via `ifconfig -tso4 -tso6 -rxcsum -txcsum -lro` directly on all interfaces — no change
- `net.inet.tcp.tso=0` system tunable — no change (also confirmed default is TSO enabled and restored correctly)
- Firewall → Settings → Normalization → Disable interface scrub — no change
- Multiqueue on the VirtIO NICs (was set to 8, cleared to default) — no change
- NIC model — reproduced identically on both VirtIO and Intel E1000 emulated NICs
- Zenarmor/Sensei (os-sunnyvalley) — was installed, fully uninstalled + VM rebooted — no change
- Outbound NAT — Hybrid mode, WAN IP is correctly translated (confirmed in state table, `SYN_SENT:CLOSED`)
**Also confirmed:**
- The exact same public IP works fine when tested with a laptop directly connected (bypassing OPNsense entirely) — rules out ISP/destination-side IP blocking
- A separate **bare-metal** OPNsense install (same version) on a different machine, same general network type, does not reproduce this issue
- Works fine over a completely separate network path (cellular)
This strongly points at something in the pf forwarding/NAT code path specifically stripping TCP options and zeroing the window on certain outbound SYNs, independent of any NIC/driver/offload layer. Happy to provide additional packet captures, `pfctl -vvsr` output, states output, or test further changes — just let me know what's useful.
- OPNsense 25.7.11_9-amd64
- Running as a VM on Proxmox (tested on both VirtIO and Intel E1000 emulated NICs — same result on both)
- WAN: DHCP, no PPPoE, no VLAN tagging
- Outbound NAT: Hybrid mode
**Symptom:**
TCP connections from LAN/WiFi clients (NAT'd through WAN) to certain destinations (confirmed with `www.usmagazine.com` test site, 192.0.66.2:443) hang indefinitely — SYN is sent, no SYN-ACK or any reply ever received. Other destinations (e.g. google.com) work fine through the same forwarding path.
Packet capture on WAN (and confirmed at the Proxmox host bridge level, before the physical NIC) shows the outbound SYN for the affected destination is malformed:
```
16:47:15.153180 IP <wan-ip>.11293 > 192.0.66.2.443: Flags
```
No TCP options at all (no MSS, window scale, SACK-permitted, or timestamps), and window size of 0 — not a normal SYN from any TCP stack.
**Critically:** `curl -v 192.0.66.2.443` run *from the OPNsense shell itself* to the same destination completes a normal handshake with correct options and a real window size every time. Only traffic that is **forwarded/NAT'd** through the box (from LAN or WiFi clients) produces the malformed SYN. This is 100% reproducible.
**Ruled out so far:**
- Hardware checksum/TSO/LRO offload — disabled via GUI and via `ifconfig -tso4 -tso6 -rxcsum -txcsum -lro` directly on all interfaces — no change
- `net.inet.tcp.tso=0` system tunable — no change (also confirmed default is TSO enabled and restored correctly)
- Firewall → Settings → Normalization → Disable interface scrub — no change
- Multiqueue on the VirtIO NICs (was set to 8, cleared to default) — no change
- NIC model — reproduced identically on both VirtIO and Intel E1000 emulated NICs
- Zenarmor/Sensei (os-sunnyvalley) — was installed, fully uninstalled + VM rebooted — no change
- Outbound NAT — Hybrid mode, WAN IP is correctly translated (confirmed in state table, `SYN_SENT:CLOSED`)
**Also confirmed:**
- The exact same public IP works fine when tested with a laptop directly connected (bypassing OPNsense entirely) — rules out ISP/destination-side IP blocking
- A separate **bare-metal** OPNsense install (same version) on a different machine, same general network type, does not reproduce this issue
- Works fine over a completely separate network path (cellular)
This strongly points at something in the pf forwarding/NAT code path specifically stripping TCP options and zeroing the window on certain outbound SYNs, independent of any NIC/driver/offload layer. Happy to provide additional packet captures, `pfctl -vvsr` output, states output, or test further changes — just let me know what's useful.
#6
26.7 Series / Re: Help me make sense of thes...
Last post by viragomann - July 22, 2026, 11:02:50 PMQuote from: teddybearnemo on July 22, 2026, 08:14:39 PMVLAN 10 Management
- here in goes my OPNSENSE and my Switch
VLAN 20 Trusted devices
- here goes my PC
VLAN 30 Guest WIFI
- here goes an AP ( doesn't know VLAN )
On VLAN20 you might want to allow any for your PC.
So you would need an allow any-to-any rule like it's predefined on LAN.
Quote from: teddybearnemo on July 22, 2026, 08:14:39 PMI dont know if VLAN 10 needs any rules or something ? some said it does, because it needs updates, and some say it doesn't because thats within the software so that i can update opnsense....i know the switch would be a file that i download on the website tp link and then upload it in the gui of the switch.In this case, there is no rule needed on VLAN10, expect for NTP if the swicht request it.
For internet access on VLAN30:
You didn't mention, if you use IPv4 only or IPv6 as well. For IPv4 I created an alias and added all RFC 1918 networks to it (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
The I use this alias in the pass as destination with "invert" checked. So
interface: VLAN 30
action: pass
protocol: any (if you want)
source: vlan 30 net
invert destination: checked
destination: RFC1918
dest. port: any (if you want)
Assuming your OPNsense provides the DNS and NTP, you additionally need a rule for these.
interface: VLAN 30
action: pass
protocol: TCP/UDP
source: vlan 30 net
destination: This firewall
dest. port: domain
interface: VLAN 30
action: pass
protocol: TCP/UDP
source: vlan 30 net
destination: This firewall
dest. port: NTP
To ensure, that the client use your OPNsene for these service, you can also redirect this traffic to it.
Destination NAT rule:
interface: VLAN 30
protocol: TCP/UDP
source: vlan 30 net
destination: any
dest. port: 53
redirect target IP: 127.0.0.1
redirect target port: 53
And the same for NTP, port 123.
#7
26.7 Series / Re: Problems with floating rul...
Last post by Patrick M. Hausen - July 22, 2026, 10:41:10 PMQuote from: Bob.Dig on July 22, 2026, 10:33:10 PMThis makes no sense to me to begin with.
In the old system this meant "all interfaces". You can still select "any" in the new system.
#8
26.7 Series / Re: Problems with floating rul...
Last post by Bob.Dig - July 22, 2026, 10:33:10 PMQuote from: ivoruetsche on July 21, 2026, 12:10:15 AMFloating rule:This makes no sense to me to begin with.
Interface: nothing selected
#9
26.7 Series / Update from 26.7 to 26.7.1: ok
Last post by notspam - July 22, 2026, 10:15:12 PMUpdate from 26.7 to 26.7.1 was fine.
Need to check if the Intel CPU microcode loading is needed.
And I need to check for some files laying around.
----------
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7 (amd64) at Wed Jul 22 15:16:59 UTC 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
SunnyValley repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
SunnyValley repository is up to date.
All repositories are up to date.
Checking for upgrades (21 candidates): .......... done
Processing candidates (21 candidates): .......... done
The following 22 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cpu-microcode-rc: 1.0_2 [OPNsense]
Installed packages to be UPGRADED:
ca_root_nss: 3.124 -> 3.125 [OPNsense]
git: 2.54.0 -> 2.55.0 [OPNsense]
json-c: 0.18 -> 0.19 [OPNsense]
luajit: 2.1.0.20260524 -> 2.1.0.20260629 [OPNsense]
nginx: 1.30.3_1,3 -> 1.30.4,3 [OPNsense]
nss: 3.124 -> 3.125 [OPNsense]
opnsense: 26.7 -> 26.7.1 [OPNsense]
os-bind: 1.34_3 -> 1.34_4 [OPNsense]
os-cpu-microcode-intel: 1.1 -> 1.1_1 [OPNsense]
os-q-feeds-connector: 1.6 -> 1.6_1 [OPNsense]
p11-kit: 0.26.2 -> 0.26.4 [OPNsense]
pciids: 20260624 -> 20260711 [OPNsense]
phpunit9-php85: 9.6.34 -> 9.6.35 [OPNsense]
py313-certifi: 2026.5.20 -> 2026.6.17 [OPNsense]
py313-cryptography: 48.0.0_1,1 -> 48.0.1,1 [OPNsense]
ruby33-gems: 4.0.15 -> 4.0.16 [OPNsense]
tailscale: 1.98.8 -> 1.98.9 [OPNsense]
telegraf: 1.39.0 -> 1.39.1_1 [OPNsense]
turnserver: 4.10.0 -> 4.14.0 [OPNsense]
wazuh-agent: 4.14.5 -> 4.14.6 [OPNsense]
Installed packages to be REINSTALLED:
cpu-microcode-intel-20260512_1 [OPNsense] (options changed)
Number of packages to be installed: 1
Number of packages to be upgraded: 20
Number of packages to be reinstalled: 1
The process will require 3 MiB more space.
117 MiB to be downloaded.
[1/22] Fetching nginx-1.30.4,3.pkg: .......... done
[2/22] Fetching ruby33-gems-4.0.16.pkg: ......... done
[3/22] Fetching pciids-20260711.pkg: ......... done
[4/22] Fetching nss-3.125.pkg: .......... done
[5/22] Fetching wazuh-agent-4.14.6.pkg: .......... done
[6/22] Fetching py313-certifi-2026.6.17.pkg: ....... done
[7/22] Fetching turnserver-4.14.0.pkg: .......... done
[8/22] Fetching py313-cryptography-48.0.1,1.pkg: .......... done
[9/22] Fetching os-bind-1.34_4.pkg: ... done
[10/22] Fetching cpu-microcode-intel-20260512_1.pkg: .......... done
[11/22] Fetching json-c-0.19.pkg: ....... done
[12/22] Fetching tailscale-1.98.9.pkg: .......... done
[13/22] Fetching git-2.55.0.pkg: .......... done
[14/22] Fetching phpunit9-php85-9.6.35.pkg: .......... done
[15/22] Fetching os-cpu-microcode-intel-1.1_1.pkg: . done
[16/22] Fetching ca_root_nss-3.125.pkg: ......... done
[17/22] Fetching luajit-2.1.0.20260629.pkg: .......... done
[18/22] Fetching os-q-feeds-connector-1.6_1.pkg: . done
[19/22] Fetching telegraf-1.39.1_1.pkg: .......... done
[20/22] Fetching p11-kit-0.26.4.pkg: .......... done
[21/22] Fetching cpu-microcode-rc-1.0_2.pkg: . done
[22/22] Fetching opnsense-26.7.1.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/22] Upgrading ca_root_nss from 3.124 to 3.125...
[1/22] Extracting ca_root_nss-3.125: ..... done
[2/22] Installing cpu-microcode-rc-1.0_2...
[2/22] Extracting cpu-microcode-rc-1.0_2: .... done
[3/22] Reinstalling cpu-microcode-intel-20260512_1...
[3/22] Extracting cpu-microcode-intel-20260512_1: .......... done
[4/22] Upgrading git from 2.54.0 to 2.55.0...
===> Creating groups
Using existing group 'git_daemon'
===> Creating users
Using existing user 'git_daemon'
[4/22] Extracting git-2.55.0: .......... done
[5/22] Upgrading json-c from 0.18 to 0.19...
[5/22] Extracting json-c-0.19: .......... done
[6/22] Upgrading luajit from 2.1.0.20260524 to 2.1.0.20260629...
[6/22] Extracting luajit-2.1.0.20260629: .......... done
[7/22] Upgrading nginx from 1.30.3_1,3 to 1.30.4,3...
===> Creating groups
Using existing group 'www'
===> Creating users
Using existing user 'www'
[7/22] Extracting nginx-1.30.4,3: .......... done
[8/22] Upgrading nss from 3.124 to 3.125...
[8/22] Extracting nss-3.125: .......... done
[9/22] Upgrading opnsense from 26.7 to 26.7.1...
[9/22] Extracting opnsense-26.7.1: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
[OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
Model OPNsense\WazuhAgent\WazuhAgent can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\WazuhAgent\WazuhAgent from 0.0.0 to 1.0.3
[OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
Model OPNsense\Siproxd\General can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\Siproxd\General from 0.0.0 to 1.1.0
Migrated OPNsense\Trust\General from 1.0.1 to 1.0.2
Flushing all caches...done.
Writing firmware settings: OPNsense SunnyValley
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[10/22] Upgrading os-bind from 1.34_3 to 1.34_4...
[10/22] Extracting os-bind-1.34_4: .......... done
Stopping configd...done
Starting configd.
Reloading plugin configuration
Flushing all caches...done.
Configuring system logging...done.
Reloading template OPNsense/Bind: OK
Reloading template OPNsense/Syslog: OK
[11/22] Upgrading os-cpu-microcode-intel from 1.1 to 1.1_1...
[11/22] Extracting os-cpu-microcode-intel-1.1_1: ... done
Reloading firmware configuration
[OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
Model OPNsense\WazuhAgent\WazuhAgent can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\WazuhAgent\WazuhAgent from 0.0.0 to 1.0.3
[OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
Model OPNsense\Siproxd\General can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\Siproxd\General from 0.0.0 to 1.1.0
Flushing all caches...done.
Writing firmware settings: OPNsense SunnyValley
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[12/22] Upgrading os-q-feeds-connector from 1.6 to 1.6_1...
[12/22] Extracting os-q-feeds-connector-1.6_1: .......... done
Stopping configd...done
Starting configd.
Reloading plugin configuration
Flushing all caches...done.
Configuring system logging...done.
Reloading template OPNsense/QFeeds: OK
Service `cron' has been restarted.
[13/22] Upgrading p11-kit from 0.26.2 to 0.26.4...
[13/22] Extracting p11-kit-0.26.4: .......... done
[14/22] Upgrading pciids from 20260624 to 20260711...
[14/22] Extracting pciids-20260711: ..... done
[15/22] Upgrading phpunit9-php85 from 9.6.34 to 9.6.35...
[15/22] Extracting phpunit9-php85-9.6.35: .... done
[16/22] Upgrading py313-certifi from 2026.5.20 to 2026.6.17...
[16/22] Extracting py313-certifi-2026.6.17: .......... done
[17/22] Upgrading py313-cryptography from 48.0.0_1,1 to 48.0.1,1...
[17/22] Extracting py313-cryptography-48.0.1,1: .......... done
[18/22] Upgrading ruby33-gems from 4.0.15 to 4.0.16...
[18/22] Extracting ruby33-gems-4.0.16: .......... done
[19/22] Upgrading tailscale from 1.98.8 to 1.98.9...
[19/22] Extracting tailscale-1.98.9: ...... done
[20/22] Upgrading telegraf from 1.39.0 to 1.39.1_1...
===> Creating groups
Using existing group 'telegraf'
===> Creating users
Using existing user 'telegraf'
[20/22] Extracting telegraf-1.39.1_1: ...... done
[21/22] Upgrading turnserver from 4.10.0 to 4.14.0...
[21/22] Extracting turnserver-4.14.0: .......... done
[22/22] Upgrading wazuh-agent from 4.14.5 to 4.14.6...
===> Creating groups
Using existing group 'wazuh'
===> Creating users
Using existing user 'wazuh'
===> Creating homedir(s)
[22/22] Extracting wazuh-agent-4.14.6: ....... done
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
=====
Message from cpu-microcode-rc-1.0_2:
--
This port includes an RC script, which is one of two methods to update
the CPU microcode on a FreeBSD system.
1. Early loading.
This method does not use the RC script included here.
This is the preferred method, because it ensures that any CPU features
added or removed by a microcode update are visible to the kernel by
applying the update before the kernel performs CPU feature detection.
To enable updates using early loading, add the following lines to
/boot/loader.conf:
cpu_microcode_load="YES"
and the appropriate one of these lines:
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
cpu_microcode_name="/boot/firmware/amd-ucode.bin"
The microcode update will be loaded when the system is rebooted.
AMD systems running FreeBSD prior to 2024-02-22 snapshot
34467bd76 only support late loading.
2. Late loading.
This method, which does use the RC script included here, is enabled by
adding the following line to /etc/rc.conf:
microcode_update_enable="YES"
The microcode update is then applied upon reboot or when the microcode
update service is run via:
# service microcode_update start
If the CPU requires a microcode update, a console message such as the
following will appear:
Updating CPU Microcode...
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl0 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl2 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl4 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl6 from rev 0x17 to rev 0x22... done.
Done.
It is safe to enable both methods.
You may need to manually remove /usr/local/etc/nginx/mime.types if it is no longer needed.
You may need to manually remove /usr/local/etc/nginx/nginx.conf if it is no longer needed.
=====
Message from opnsense-26.7.1:
--
Just a dream and the wind to carry me
You may need to manually remove /usr/local/etc/turnserver.conf if it is no longer needed.
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/ca_root_nss-3.125~8725d4a9fe.pkg
/var/cache/pkg/nss-3.125.pkg
/var/cache/pkg/luajit-2.1.0.20260629~f3b48e6f2e.pkg
/var/cache/pkg/wazuh-agent-4.14.6.pkg
/var/cache/pkg/telegraf-1.39.1_1~4cbedcb0d0.pkg
/var/cache/pkg/tailscale-1.98.9~8a62092a9a.pkg
/var/cache/pkg/phpunit9-php85-9.6.35~087aef86c4.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~ec7bd62a9e.pkg
/var/cache/pkg/py313-certifi-2026.6.17~58dc2bd8ba.pkg
/var/cache/pkg/turnserver-4.14.0.pkg
/var/cache/pkg/os-bind-1.34_4.pkg
/var/cache/pkg/p11-kit-0.26.4~e23788585f.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2~e75ff3975e.pkg
/var/cache/pkg/opnsense-26.7.1.pkg
/var/cache/pkg/ruby33-gems-4.0.16~3d37468a49.pkg
/var/cache/pkg/json-c-0.19.pkg
/var/cache/pkg/os-q-feeds-connector-1.6_1~8a67c2cb7f.pkg
/var/cache/pkg/pciids-20260711.pkg
/var/cache/pkg/ruby33-gems-4.0.16.pkg
/var/cache/pkg/pciids-20260711~34ad3f8084.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1.pkg
/var/cache/pkg/nginx-1.30.4,3.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1.pkg
/var/cache/pkg/p11-kit-0.26.4.pkg
/var/cache/pkg/telegraf-1.39.1_1.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1~b6c2f86624.pkg
/var/cache/pkg/phpunit9-php85-9.6.35.pkg
/var/cache/pkg/tailscale-1.98.9.pkg
/var/cache/pkg/wazuh-agent-4.14.6~e52e175272.pkg
/var/cache/pkg/nss-3.125~3bd727dc98.pkg
/var/cache/pkg/turnserver-4.14.0~63568cdf01.pkg
/var/cache/pkg/json-c-0.19~0011d31480.pkg
/var/cache/pkg/os-q-feeds-connector-1.6_1.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2.pkg
/var/cache/pkg/py313-certifi-2026.6.17.pkg
/var/cache/pkg/luajit-2.1.0.20260629.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1.pkg
/var/cache/pkg/ca_root_nss-3.125.pkg
/var/cache/pkg/git-2.55.0~4fe4a1faf3.pkg
/var/cache/pkg/git-2.55.0.pkg
/var/cache/pkg/nginx-1.30.4,3~a4e2b8cdeb.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1~8ae9834ac8.pkg
/var/cache/pkg/opnsense-26.7.1~d7ce0a8dc3.pkg
/var/cache/pkg/os-bind-1.34_4~65de8e379f.pkg
The cleanup will free 117 MiB
Deleting files: .......... done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***
--
Need to check if the Intel CPU microcode loading is needed.
And I need to check for some files laying around.
----------
***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7 (amd64) at Wed Jul 22 15:16:59 UTC 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
SunnyValley repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf:
Fetching data.pkg:
SunnyValley repository is up to date.
All repositories are up to date.
Checking for upgrades (21 candidates): .......... done
Processing candidates (21 candidates): .......... done
The following 22 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
cpu-microcode-rc: 1.0_2 [OPNsense]
Installed packages to be UPGRADED:
ca_root_nss: 3.124 -> 3.125 [OPNsense]
git: 2.54.0 -> 2.55.0 [OPNsense]
json-c: 0.18 -> 0.19 [OPNsense]
luajit: 2.1.0.20260524 -> 2.1.0.20260629 [OPNsense]
nginx: 1.30.3_1,3 -> 1.30.4,3 [OPNsense]
nss: 3.124 -> 3.125 [OPNsense]
opnsense: 26.7 -> 26.7.1 [OPNsense]
os-bind: 1.34_3 -> 1.34_4 [OPNsense]
os-cpu-microcode-intel: 1.1 -> 1.1_1 [OPNsense]
os-q-feeds-connector: 1.6 -> 1.6_1 [OPNsense]
p11-kit: 0.26.2 -> 0.26.4 [OPNsense]
pciids: 20260624 -> 20260711 [OPNsense]
phpunit9-php85: 9.6.34 -> 9.6.35 [OPNsense]
py313-certifi: 2026.5.20 -> 2026.6.17 [OPNsense]
py313-cryptography: 48.0.0_1,1 -> 48.0.1,1 [OPNsense]
ruby33-gems: 4.0.15 -> 4.0.16 [OPNsense]
tailscale: 1.98.8 -> 1.98.9 [OPNsense]
telegraf: 1.39.0 -> 1.39.1_1 [OPNsense]
turnserver: 4.10.0 -> 4.14.0 [OPNsense]
wazuh-agent: 4.14.5 -> 4.14.6 [OPNsense]
Installed packages to be REINSTALLED:
cpu-microcode-intel-20260512_1 [OPNsense] (options changed)
Number of packages to be installed: 1
Number of packages to be upgraded: 20
Number of packages to be reinstalled: 1
The process will require 3 MiB more space.
117 MiB to be downloaded.
[1/22] Fetching nginx-1.30.4,3.pkg: .......... done
[2/22] Fetching ruby33-gems-4.0.16.pkg: ......... done
[3/22] Fetching pciids-20260711.pkg: ......... done
[4/22] Fetching nss-3.125.pkg: .......... done
[5/22] Fetching wazuh-agent-4.14.6.pkg: .......... done
[6/22] Fetching py313-certifi-2026.6.17.pkg: ....... done
[7/22] Fetching turnserver-4.14.0.pkg: .......... done
[8/22] Fetching py313-cryptography-48.0.1,1.pkg: .......... done
[9/22] Fetching os-bind-1.34_4.pkg: ... done
[10/22] Fetching cpu-microcode-intel-20260512_1.pkg: .......... done
[11/22] Fetching json-c-0.19.pkg: ....... done
[12/22] Fetching tailscale-1.98.9.pkg: .......... done
[13/22] Fetching git-2.55.0.pkg: .......... done
[14/22] Fetching phpunit9-php85-9.6.35.pkg: .......... done
[15/22] Fetching os-cpu-microcode-intel-1.1_1.pkg: . done
[16/22] Fetching ca_root_nss-3.125.pkg: ......... done
[17/22] Fetching luajit-2.1.0.20260629.pkg: .......... done
[18/22] Fetching os-q-feeds-connector-1.6_1.pkg: . done
[19/22] Fetching telegraf-1.39.1_1.pkg: .......... done
[20/22] Fetching p11-kit-0.26.4.pkg: .......... done
[21/22] Fetching cpu-microcode-rc-1.0_2.pkg: . done
[22/22] Fetching opnsense-26.7.1.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/22] Upgrading ca_root_nss from 3.124 to 3.125...
[1/22] Extracting ca_root_nss-3.125: ..... done
[2/22] Installing cpu-microcode-rc-1.0_2...
[2/22] Extracting cpu-microcode-rc-1.0_2: .... done
[3/22] Reinstalling cpu-microcode-intel-20260512_1...
[3/22] Extracting cpu-microcode-intel-20260512_1: .......... done
[4/22] Upgrading git from 2.54.0 to 2.55.0...
===> Creating groups
Using existing group 'git_daemon'
===> Creating users
Using existing user 'git_daemon'
[4/22] Extracting git-2.55.0: .......... done
[5/22] Upgrading json-c from 0.18 to 0.19...
[5/22] Extracting json-c-0.19: .......... done
[6/22] Upgrading luajit from 2.1.0.20260524 to 2.1.0.20260629...
[6/22] Extracting luajit-2.1.0.20260629: .......... done
[7/22] Upgrading nginx from 1.30.3_1,3 to 1.30.4,3...
===> Creating groups
Using existing group 'www'
===> Creating users
Using existing user 'www'
[7/22] Extracting nginx-1.30.4,3: .......... done
[8/22] Upgrading nss from 3.124 to 3.125...
[8/22] Extracting nss-3.125: .......... done
[9/22] Upgrading opnsense from 26.7 to 26.7.1...
[9/22] Extracting opnsense-26.7.1: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
[OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
Model OPNsense\WazuhAgent\WazuhAgent can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\WazuhAgent\WazuhAgent from 0.0.0 to 1.0.3
[OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
Model OPNsense\Siproxd\General can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\Siproxd\General from 0.0.0 to 1.1.0
Migrated OPNsense\Trust\General from 1.0.1 to 1.0.2
Flushing all caches...done.
Writing firmware settings: OPNsense SunnyValley
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[10/22] Upgrading os-bind from 1.34_3 to 1.34_4...
[10/22] Extracting os-bind-1.34_4: .......... done
Stopping configd...done
Starting configd.
Reloading plugin configuration
Flushing all caches...done.
Configuring system logging...done.
Reloading template OPNsense/Bind: OK
Reloading template OPNsense/Syslog: OK
[11/22] Upgrading os-cpu-microcode-intel from 1.1 to 1.1_1...
[11/22] Extracting os-cpu-microcode-intel-1.1_1: ... done
Reloading firmware configuration
[OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
Model OPNsense\WazuhAgent\WazuhAgent can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\WazuhAgent\WazuhAgent:general.server_address] A value is required.{}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\WazuhAgent\WazuhAgent from 0.0.0 to 1.0.3
[OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
Model OPNsense\Siproxd\General can't be saved, skip ( OPNsense\Base\ValidationException: [OPNsense\Siproxd\General:if_inbound] A value is required.{}
[OPNsense\Siproxd\General:if_outbound] A value is required.{}
[OPNsense\Siproxd\General:use_rport] Option [] not in list.{Option1}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php(947): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/script/run_migrations.php(69): OPNsense\Base\BaseModel->runMigrations()
#2 {main} )
Failed OPNsense\Siproxd\General from 0.0.0 to 1.1.0
Flushing all caches...done.
Writing firmware settings: OPNsense SunnyValley
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[12/22] Upgrading os-q-feeds-connector from 1.6 to 1.6_1...
[12/22] Extracting os-q-feeds-connector-1.6_1: .......... done
Stopping configd...done
Starting configd.
Reloading plugin configuration
Flushing all caches...done.
Configuring system logging...done.
Reloading template OPNsense/QFeeds: OK
Service `cron' has been restarted.
[13/22] Upgrading p11-kit from 0.26.2 to 0.26.4...
[13/22] Extracting p11-kit-0.26.4: .......... done
[14/22] Upgrading pciids from 20260624 to 20260711...
[14/22] Extracting pciids-20260711: ..... done
[15/22] Upgrading phpunit9-php85 from 9.6.34 to 9.6.35...
[15/22] Extracting phpunit9-php85-9.6.35: .... done
[16/22] Upgrading py313-certifi from 2026.5.20 to 2026.6.17...
[16/22] Extracting py313-certifi-2026.6.17: .......... done
[17/22] Upgrading py313-cryptography from 48.0.0_1,1 to 48.0.1,1...
[17/22] Extracting py313-cryptography-48.0.1,1: .......... done
[18/22] Upgrading ruby33-gems from 4.0.15 to 4.0.16...
[18/22] Extracting ruby33-gems-4.0.16: .......... done
[19/22] Upgrading tailscale from 1.98.8 to 1.98.9...
[19/22] Extracting tailscale-1.98.9: ...... done
[20/22] Upgrading telegraf from 1.39.0 to 1.39.1_1...
===> Creating groups
Using existing group 'telegraf'
===> Creating users
Using existing user 'telegraf'
[20/22] Extracting telegraf-1.39.1_1: ...... done
[21/22] Upgrading turnserver from 4.10.0 to 4.14.0...
[21/22] Extracting turnserver-4.14.0: .......... done
[22/22] Upgrading wazuh-agent from 4.14.5 to 4.14.6...
===> Creating groups
Using existing group 'wazuh'
===> Creating users
Using existing user 'wazuh'
===> Creating homedir(s)
[22/22] Extracting wazuh-agent-4.14.6: ....... done
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
=====
Message from cpu-microcode-rc-1.0_2:
--
This port includes an RC script, which is one of two methods to update
the CPU microcode on a FreeBSD system.
1. Early loading.
This method does not use the RC script included here.
This is the preferred method, because it ensures that any CPU features
added or removed by a microcode update are visible to the kernel by
applying the update before the kernel performs CPU feature detection.
To enable updates using early loading, add the following lines to
/boot/loader.conf:
cpu_microcode_load="YES"
and the appropriate one of these lines:
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
cpu_microcode_name="/boot/firmware/amd-ucode.bin"
The microcode update will be loaded when the system is rebooted.
AMD systems running FreeBSD prior to 2024-02-22 snapshot
34467bd76 only support late loading.
2. Late loading.
This method, which does use the RC script included here, is enabled by
adding the following line to /etc/rc.conf:
microcode_update_enable="YES"
The microcode update is then applied upon reboot or when the microcode
update service is run via:
# service microcode_update start
If the CPU requires a microcode update, a console message such as the
following will appear:
Updating CPU Microcode...
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl0 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl2 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl4 from rev 0x17 to rev 0x22... done.
/usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl6 from rev 0x17 to rev 0x22... done.
Done.
It is safe to enable both methods.
You may need to manually remove /usr/local/etc/nginx/mime.types if it is no longer needed.
You may need to manually remove /usr/local/etc/nginx/nginx.conf if it is no longer needed.
=====
Message from opnsense-26.7.1:
--
Just a dream and the wind to carry me
You may need to manually remove /usr/local/etc/turnserver.conf if it is no longer needed.
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/ca_root_nss-3.125~8725d4a9fe.pkg
/var/cache/pkg/nss-3.125.pkg
/var/cache/pkg/luajit-2.1.0.20260629~f3b48e6f2e.pkg
/var/cache/pkg/wazuh-agent-4.14.6.pkg
/var/cache/pkg/telegraf-1.39.1_1~4cbedcb0d0.pkg
/var/cache/pkg/tailscale-1.98.9~8a62092a9a.pkg
/var/cache/pkg/phpunit9-php85-9.6.35~087aef86c4.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~ec7bd62a9e.pkg
/var/cache/pkg/py313-certifi-2026.6.17~58dc2bd8ba.pkg
/var/cache/pkg/turnserver-4.14.0.pkg
/var/cache/pkg/os-bind-1.34_4.pkg
/var/cache/pkg/p11-kit-0.26.4~e23788585f.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2~e75ff3975e.pkg
/var/cache/pkg/opnsense-26.7.1.pkg
/var/cache/pkg/ruby33-gems-4.0.16~3d37468a49.pkg
/var/cache/pkg/json-c-0.19.pkg
/var/cache/pkg/os-q-feeds-connector-1.6_1~8a67c2cb7f.pkg
/var/cache/pkg/pciids-20260711.pkg
/var/cache/pkg/ruby33-gems-4.0.16.pkg
/var/cache/pkg/pciids-20260711~34ad3f8084.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1.pkg
/var/cache/pkg/nginx-1.30.4,3.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1.pkg
/var/cache/pkg/p11-kit-0.26.4.pkg
/var/cache/pkg/telegraf-1.39.1_1.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1~b6c2f86624.pkg
/var/cache/pkg/phpunit9-php85-9.6.35.pkg
/var/cache/pkg/tailscale-1.98.9.pkg
/var/cache/pkg/wazuh-agent-4.14.6~e52e175272.pkg
/var/cache/pkg/nss-3.125~3bd727dc98.pkg
/var/cache/pkg/turnserver-4.14.0~63568cdf01.pkg
/var/cache/pkg/json-c-0.19~0011d31480.pkg
/var/cache/pkg/os-q-feeds-connector-1.6_1.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2.pkg
/var/cache/pkg/py313-certifi-2026.6.17.pkg
/var/cache/pkg/luajit-2.1.0.20260629.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1.pkg
/var/cache/pkg/ca_root_nss-3.125.pkg
/var/cache/pkg/git-2.55.0~4fe4a1faf3.pkg
/var/cache/pkg/git-2.55.0.pkg
/var/cache/pkg/nginx-1.30.4,3~a4e2b8cdeb.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1~8ae9834ac8.pkg
/var/cache/pkg/opnsense-26.7.1~d7ce0a8dc3.pkg
/var/cache/pkg/os-bind-1.34_4~65de8e379f.pkg
The cleanup will free 117 MiB
Deleting files: .......... done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***
--
#10
26.7 Series / Re: Problems with floating rul...
Last post by userfw - July 22, 2026, 10:07:24 PMFloating rules are processed before interface rules, it's expected behaviour: https://docs.opnsense.org/manual/firewall.html#processing-order
They didn't change with 26.7, but it's different between legacy and "new" rules.
They didn't change with 26.7, but it's different between legacy and "new" rules.
