"Recent posts
#1
26.7 Series / Re: Log rate limiting - any be...
Last post by newsense - Today at 12:39:39 AM@meyergru Did you enable syncookies in FW -Settings? The Anti DDoS settings that is.
Try Adaptive, Start at 95% End at 70%
Try Adaptive, Start at 95% End at 70%
#2
26.7 Series / Re: Log rate limiting - any be...
Last post by Patrick M. Hausen - August 20, 2026, 11:55:28 PMThere is no log rate limit, yet. @meyergru created a hack using the rule application limit and two consecutive rules to achieve the desired effect.
#3
26.7 Series / Re: Log rate limiting - any be...
Last post by WN1X - August 20, 2026, 11:35:26 PMIt seems to me the rule should be applied regardless if the log rate limit has been reached. Obviously, without logging.
#4
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by Patrick M. Hausen - August 20, 2026, 11:18:22 PMYou do not need a port forward rule to access the UI on WAN. Just a simple allow rule on the interface and of course "disable reply-to" must ve active globally.
Oh and do not mess with the "listen interface" settings.
Oh and do not mess with the "listen interface" settings.
#5
Portuguese - Português / [TUTORIAL] Bloqueio de Anúncio...
Last post by TecDicas - August 20, 2026, 10:37:27 PMFala, pessoal! Tudo certo?
Gostaria de compartilhar um guia prático que elaborei detalhando a implementação do Unbound DNS com Blocklists (DNSBL) no OPNsense (testado na versão 26.7).
O objetivo do artigo foi criar uma solução leve de filtragem de tráfego que não sobrecarregasse tanto a memória RAM e o processador do firewall (evitando o overhead de proxies pesados ou motores de inspeção profunda).
O que é abordado no material:
Seleção de Políticas e Listas (DNSBL): Configuração de listas focadas em AdBlock, Adware e rastreadores (como as listas da família HaGeZi).
O "Pulo do Gato" no YouTube/Google (Protocolo QUIC): Como contornar o problema de navegadores (Chrome/Edge) que usam conexões UDP na porta 443 para burlar consultas DNS padrão.
Mapeamento de Wildcards: Estruturação correta de subdomínios da CDN do Google sem violar as regras de validação do sistema.
Automação via Cron: Agendamento diário para atualização das listas sem intervenção manual.
Para quem quiser conferir o passo a passo completo com telas e explicações detalhadas, o artigo está publicado no blog:
https://tecdicas.inf.br/bloquear-sites-unbound-dns-opnsense
Espero que o conteúdo ajude quem está estruturando a segurança do seu Homelab ou rede corporativa! Caso tenham sugestões de melhoria nas regras ou outras abordagens para o protocolo QUIC, sintam-se à vontade para comentar abaixo para debatermos.
Abraços!
Gostaria de compartilhar um guia prático que elaborei detalhando a implementação do Unbound DNS com Blocklists (DNSBL) no OPNsense (testado na versão 26.7).
O objetivo do artigo foi criar uma solução leve de filtragem de tráfego que não sobrecarregasse tanto a memória RAM e o processador do firewall (evitando o overhead de proxies pesados ou motores de inspeção profunda).
O que é abordado no material:
Seleção de Políticas e Listas (DNSBL): Configuração de listas focadas em AdBlock, Adware e rastreadores (como as listas da família HaGeZi).
O "Pulo do Gato" no YouTube/Google (Protocolo QUIC): Como contornar o problema de navegadores (Chrome/Edge) que usam conexões UDP na porta 443 para burlar consultas DNS padrão.
Mapeamento de Wildcards: Estruturação correta de subdomínios da CDN do Google sem violar as regras de validação do sistema.
Automação via Cron: Agendamento diário para atualização das listas sem intervenção manual.
Para quem quiser conferir o passo a passo completo com telas e explicações detalhadas, o artigo está publicado no blog:
https://tecdicas.inf.br/bloquear-sites-unbound-dns-opnsense
Espero que o conteúdo ajude quem está estruturando a segurança do seu Homelab ou rede corporativa! Caso tenham sugestões de melhoria nas regras ou outras abordagens para o protocolo QUIC, sintam-se à vontade para comentar abaixo para debatermos.
Abraços!
#6
26.7 Series / Log rate limiting - any better...
Last post by meyergru - August 20, 2026, 09:07:47 PMRecently, I had a problem when some of my friends told me that out voice chat was choppy. When I investigated, I found my OpnSense at 100% CPU. That turned out to be due to 7 WAN block rules for various blocklists and an ongoing DDOS attack.
I had logging enabled for those rules and the log was constantly being written to. I could not even reliably use the web UI.
This made me think about how to rate-limit the logs. Apparently, with 26.7.2, there is now max-pkg-rate from pf available.
So, now, you can create two block rules, one with logging enabled, quick block and "Max packet rate [packets]" = 1 and "Max packet rate [seconds]" = 1 to have a rule that matches at most once per second and logs and another quick block rule without logging and without rate limits immediately following that.
By using that, you still have (rate-limited) logging, but without the risk for a totally overwhelmed OpnSense.
Alas, you need two rules, because the first one will not match any more when the rate limit has been exceeded. Would there be a better way of having such a thing (i.e. eat the cake and still have it)?
P.S.: Allowing rate-limiting on block rules is a potential security hole, IMHO: When you use that without thinking, the block will not be applied when the rate is too high, i.e. block rules can be circumvented by just hitting more frequently at the target....
I guess the original idea was to do this for pass rules only and rate-limiting those on the side.
I had logging enabled for those rules and the log was constantly being written to. I could not even reliably use the web UI.
This made me think about how to rate-limit the logs. Apparently, with 26.7.2, there is now max-pkg-rate from pf available.
So, now, you can create two block rules, one with logging enabled, quick block and "Max packet rate [packets]" = 1 and "Max packet rate [seconds]" = 1 to have a rule that matches at most once per second and logs and another quick block rule without logging and without rate limits immediately following that.
By using that, you still have (rate-limited) logging, but without the risk for a totally overwhelmed OpnSense.
Alas, you need two rules, because the first one will not match any more when the rate limit has been exceeded. Would there be a better way of having such a thing (i.e. eat the cake and still have it)?
P.S.: Allowing rate-limiting on block rules is a potential security hole, IMHO: When you use that without thinking, the block will not be applied when the rate is too high, i.e. block rules can be circumvented by just hitting more frequently at the target....
I guess the original idea was to do this for pass rules only and rate-limiting those on the side.
#7
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by comet424 - August 20, 2026, 08:02:05 PMok so Source NAT is Outbound NAT then
so then this should open up the thing
well that didnt work i can not port forward through the darn wan connection ugh... so much headache to just simply open up port 80 to access the gui
so then this should open up the thing
well that didnt work i can not port forward through the darn wan connection ugh... so much headache to just simply open up port 80 to access the gui
#8
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by Patrick M. Hausen - August 20, 2026, 08:00:20 PMDestination NAT is port forward. Source NAT is just regular outbound masquerading.
#9
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by comet424 - August 20, 2026, 07:57:23 PMah ok
ya its still checked
and under Firewall Nat
is Source NAT the same as Port Forward?
as there is no + option to say open a port 80 under Source NAT
ya its still checked
and under Firewall Nat
is Source NAT the same as Port Forward?
as there is no + option to say open a port 80 under Source NAT
#10
Tutorials and FAQs / Re: how do you access OpnSense...
Last post by viragomann - August 20, 2026, 07:51:39 PMQuote from: comet424 on August 20, 2026, 07:44:23 PMill have to look up what a reply-to isIn mentioned it in #7.
I think, I'm out here...
