"Recent posts
#1
Hardware and Performance / Re: OPNsense on Sophos XGS: dr...
Last post by abdelmonem - Today at 11:08:13 PMHi Sergio,
A follow-up, since you asked the right question: the two work together now, since 0.1.0-alpha.5.6.
XGS: Settings has "Inspect, then hardware", off by default. With it on, each new connection goes to OPNsense's own Intrusion Detection in IPS mode, through an interface the driver makes for it, oxips0, until Suricata has let its first megabyte through. That's Suricata's own default stream depth. After that the coprocessor carries the rest, and a stream that a drop rule names never gets through at all.
Measured through the Intrusion Detection service on both boxes: a new TCP stream alerted on, then carried in hardware at 3.98 Gbit/s on the XGS 3300 and 941 Mbit/s on the XGS 136, its link full; a UDP stream with a drop rule, nothing let through.
https://npuforge.org/docs/measurements/inspect-2026-10-23/
So the honest limit now is the depth: past the first megabyte of a connection, Suricata sees nothing more of it.
Thanks again for pushing on this. It's a better project for it.
Abdelmonem
A follow-up, since you asked the right question: the two work together now, since 0.1.0-alpha.5.6.
XGS: Settings has "Inspect, then hardware", off by default. With it on, each new connection goes to OPNsense's own Intrusion Detection in IPS mode, through an interface the driver makes for it, oxips0, until Suricata has let its first megabyte through. That's Suricata's own default stream depth. After that the coprocessor carries the rest, and a stream that a drop rule names never gets through at all.
Measured through the Intrusion Detection service on both boxes: a new TCP stream alerted on, then carried in hardware at 3.98 Gbit/s on the XGS 3300 and 941 Mbit/s on the XGS 136, its link full; a UDP stream with a drop rule, nothing let through.
https://npuforge.org/docs/measurements/inspect-2026-10-23/
So the honest limit now is the depth: past the first megabyte of a connection, Suricata sees nothing more of it.
Thanks again for pushing on this. It's a better project for it.
Abdelmonem
#2
Russian - Русский / Re: os-xray — плагин Xray-core...
Last post by tyra - Today at 10:31:25 PMQuote from: tyra on October 21, 2026, 11:25:27 PMДобрый вечер. Оставляю восторг работе!!!!По переключал всё вдоль и поперёк все инстансы всё ХОР.!!! За исключением тех которые не работают и в HAPP на android,но это проблема на vps.ВОПРОС- Как внедрить auto ping и авто переключение между лучшем пингом?Quote from: Spylive on October 16, 2026, 02:25:10 PMos-xray v3.1.3 — исправления Apply, Restart All и переключения инстансовСпасибо за великолепную работу!!!!!!
Спасибо за обратную связь и подробное описание проблемы! Подобные зависания Apply и Restart All были выявлены при тестировании нашего форка и исправлены в новой версии v3.1.3.
Можно ли перейти с оригинального MrTheory/os-xray?
Да. Но при переходе с оригинального проекта рекомендую полностью удалить старую версию и установить наш форк заново. Прямое обновление оригинальной версии не тестировалось.
#3
26.7 Series / Re: Need an option - if it isn...
Last post by Bob.Dig - Today at 10:22:08 PMNo, I meant only one of your NAT-Rules, but fully, the whole page.
When it comes to your firewall rules that should block, none has done it. Look at my screenshot, how it should look like (I have IPv6 disabled).
When it comes to your firewall rules that should block, none has done it. Look at my screenshot, how it should look like (I have IPv6 disabled).
#4
26.7 Series / Re: Need an option - if it isn...
Last post by BenKenobi - Today at 09:05:53 PMand the rules -
#5
26.7 Series / Re: Need an option - if it isn...
Last post by BenKenobi - Today at 09:05:02 PMnot possible to show all the rules NAT first
#6
26.7 Series / Re: Need an option - if it isn...
Last post by Bob.Dig - Today at 08:55:26 PMPost a picture of one of your NAT rules, the full page. Just to make sure. And a picture of your firewall rules again, this time with the eye enabled.
#7
26.7 Series / Re: Need an option - if it isn...
Last post by BenKenobi - Today at 08:53:06 PMI've been doing that - it was adding another brute force source that showed me the IP was already blocked, I was also still receiving 'spam' from blocklisted IP's and ranges which I should not be. This has stopped since I introduced the !source into the NAT rule so far. Far too many IP's to list here but the aliases do contain what I expect.
Sources in Japan are being particularly problematic as are a few via some proxies that seek to bypass GEOIP, takes time to identify them. I'd post some server logs but I keep them pretty clean to make reviewing easier. I guess I could drop the !source and demonstrate that bad actors are able to bypass the firewall block rules.
Sources in Japan are being particularly problematic as are a few via some proxies that seek to bypass GEOIP, takes time to identify them. I'd post some server logs but I keep them pretty clean to make reviewing easier. I guess I could drop the !source and demonstrate that bad actors are able to bypass the firewall block rules.
#8
26.7 Series / Re: Need an option - if it isn...
Last post by Bob.Dig - Today at 08:47:19 PMLooks okayish. Toggle the eye-icon on top for some more info and check your aliases, what they actually contain.
#9
26.7 Series / Re: Upgraded to 26.7 - what sh...
Last post by (MARLOO) - Today at 08:29:04 PMQuote from: instantdreams on Today at 08:01:19 PMWhat am I missing?
Source NAT rules do not replace firewall rules. If you remove the Firewall Rules, there are no policies left to permit traffic from the LAN,so DNS and connectivity stop working
@ nero355 — very clear explanation
#10
26.7 Series / Re: Upgraded to 26.7 - what sh...
Last post by nero355 - Today at 08:23:49 PMQuote from: instantdreams on Today at 08:01:19 PMWhat am I missing?The fact that these two require !! 2 seperate migrations !! :
- Firewall Rules (Legacy) to Firewall Rules [new]
This [new] variant becomes Firewall Rules after the migration.
- Outbound NAT Rules to Source NAT Rules
This becomes just Source NAT Rules after the migration.
TL;DR : I think you misunderstood the whole thing ?!
