"Recent posts
#1
26.1, 26,4 Series / Re: Use Wireguard from Inside ...
Last post by dseven - Today at 03:09:25 PMQuote from: nero355 on July 28, 2026, 05:02:57 PMDon't you need some kind of NAT Loopback a.k.a. Reverse NAT trickery to be able to connect to your WAN IP Address from your LAN side ?!
In OPNsense language that would be NAT Reflection I think...
No; there's no NAT involved really.... assuming the simple case where WireGuard is running on OPNsense and OPNsense's WAN interface address is the endpoint address. It "just works" for me - the firewall allows UDP port 51820 from LAN to the WAN address, and return traffic goes back through the LAN interface with the WAN address as the source.
If there's some other complexity, like an upstream FritzBox, then that's a different matter....
#2
German - Deutsch / Re: WireGuard-Tunnel ohne Inte...
Last post by Shoux - Today at 03:02:38 PMANY IDEA ?
#3
26.1, 26,4 Series / Re: With IPv6, how to get both...
Last post by Monviech (Cedrik) - Today at 03:01:11 PMThere is a very strong dogma that NAT66 is the devil itself (check out ipv6 reddit for example, they literally excommunicate people who even think about NATing IPv6).
In my opinion it just solves the same issue as NAT44 did, delegating the ownership of an IP address to a central device like a router. This is useful for Multi-WAN, dynamic DNS, VPN setups etc... and other kind of more specialized setups.
NPTv6 is harder to use, since e.g. in a SLAAC only network your router doesn't own the non-translated addresses and won't respond via NDP for them. There are ways to fix that but it's way more brute force than just using NAT66 instead.
In my opinion it just solves the same issue as NAT44 did, delegating the ownership of an IP address to a central device like a router. This is useful for Multi-WAN, dynamic DNS, VPN setups etc... and other kind of more specialized setups.
NPTv6 is harder to use, since e.g. in a SLAAC only network your router doesn't own the non-translated addresses and won't respond via NDP for them. There are ways to fix that but it's way more brute force than just using NAT66 instead.
#4
General Discussion / Re: Can't get firewall to pass...
Last post by viragomann - Today at 02:56:17 PMSince your OPNsense is virtualized you can consider to do the whole VLAN stuff in Proxmox and just provide the respective virtual interfaces to the VM.
#5
26.7 Series / Re: Services widget
Last post by drosophila - Today at 02:53:44 PMYes, but there is so much space wasted and widening it even further creates the problem that all other widgets won't properly fit anywhere anymore unless I put the ddns widget at the top. And if I go to a smaller screen it'd break the layout even more.
There are some other possible improvements to the general GUI layout that I take this opportunity to propose:
1) Move the tab header into the top row, along with the "edit GUI" button. That will remove the entire tab height which is more or less just blank space.
2) Move the footer into the left column, since that seldom contains more than fits on a screen, and frees up the entire footer height in the main view.
3) Make the title of the "Firewall States" widget editable, or change it to something that fits in one column, like "States". This is not terribly important though.
4) Change the FW rule display into a horizontal bar graph like the thermal/sensors widget. That way the text can be inside the graph and not overlap. It'd need to have some form of color inversion / XOR to remain readable though, look at Zone 0 for how it should not end up being like. :)
There are some other possible improvements to the general GUI layout that I take this opportunity to propose:
1) Move the tab header into the top row, along with the "edit GUI" button. That will remove the entire tab height which is more or less just blank space.
2) Move the footer into the left column, since that seldom contains more than fits on a screen, and frees up the entire footer height in the main view.
3) Make the title of the "Firewall States" widget editable, or change it to something that fits in one column, like "States". This is not terribly important though.
4) Change the FW rule display into a horizontal bar graph like the thermal/sensors widget. That way the text can be inside the graph and not overlap. It'd need to have some form of color inversion / XOR to remain readable though, look at Zone 0 for how it should not end up being like. :)
#6
26.1, 26,4 Series / Re: With IPv6, how to get both...
Last post by drosophila - Today at 02:46:57 PMQuote from: dseven on July 26, 2026, 12:18:34 PMI guess my comment was directed at the OP. Your (@drosophila) use case seems quite different.Maybe not so different, and to (finally ;) ) answer your question, I did briefly consider NPT but since that relies on the subnet sizes being identical (LAN and ISP), I've decided it to be better to go NAT66. That way I don't need to care about what prefix size the ISP hands me, so an ISP change would be fully transparent and not even require any configuration change. I feel NAT66 is the superior choice for this type of setup, even if it's unusual and commonly frowned upon due to what feels like ideology these days. :)
#7
26.7 Series / Re: OPNsense Protectli boot fa...
Last post by Patrick M. Hausen - Today at 02:35:52 PMQuote from: Redcoat on Today at 02:24:35 PM[... SMART status widget ...]No, it's when you click the pencil symbol in the upper right corner of the dashboard, then click on the plus sign to add a widget, then select the "SMART status" widget, click on "Add", then click on "Save".
Is that the listing in the options at Services>Smart?
#8
26.7 Series / Re: slow dhcp on wan -> broken...
Last post by drosophila - Today at 02:34:36 PMThanks for the clarifications! Initially I got my hopes up that I might be able to use this to get rid of the autogenerated LLA and also get an interface that exclusively receives Privacy Extension addresses. However, at least the latter will probably not work since PE depends on SLAAC and that will automatically give me ULA/GUA addresses on the respective interface that I'd then have to manually separate regardless. Thus I'd still need a script and then it wouldn't change the general situation. :)
Regarding promiscuous mode it would be odd to have attacks through this, since the upstream node will certainly use a switch, so an attacker would have to know your MAC, and even if they do, the likelihood of someone using promiscuous mode without having set up a tight firewall is too low to bother for any common criminal. High-profile criminals like NSA or similar insecurity agencies would be the only ones with sufficient budget and determination if you ended up on their hit-list for criticizing their respective "beloved leader" or say something they don't like.
Regarding promiscuous mode it would be odd to have attacks through this, since the upstream node will certainly use a switch, so an attacker would have to know your MAC, and even if they do, the likelihood of someone using promiscuous mode without having set up a tight firewall is too low to bother for any common criminal. High-profile criminals like NSA or similar insecurity agencies would be the only ones with sufficient budget and determination if you ended up on their hit-list for criticizing their respective "beloved leader" or say something they don't like.
#9
German - Deutsch / Re: Wireguard Netz-zu-Netz Lan...
Last post by WallE - Today at 02:28:24 PMLeider noch nichts direktes gefunden im Lancom Forum, werde da jetzt dann mal schauen...
#10
26.7 Series / Re: OPNsense Protectli boot fa...
Last post by Redcoat - Today at 02:24:35 PMQuote from: Patrick M. Hausen on July 28, 2026, 07:11:58 PMa dashboard widget
Is that the listing in the options at Services>Smart?
