"Recent posts
#1
General Discussion / Re: how insecure is FreeBSD 14...
Last post by DEC740airp414user - Today at 12:31:27 AMThanks I appreciate the response
#2
General Discussion / Re: how insecure is FreeBSD 14...
Last post by newsense - Today at 12:06:47 AMIt's not.
OpenSSL released the patches this week for all supported versions. Vulnerabilities rated medium were the highest in the lot, none of them required an out of band patching for BE. They will be addressed on the next dot release.
The same is true for OpenSSH. Versions 10.4 and 10.5 came out weeks apart, July 7th and August 11th.
26.4.2 BE on August 14th included 10.4 as it was the latest available on Freshports at the time.
No available patches are missed. It's all a matter of timing and risk assessment. Nothing critical is missing from BE and there's no need to jump between CE and BE for security reasons.
OpenSSL released the patches this week for all supported versions. Vulnerabilities rated medium were the highest in the lot, none of them required an out of band patching for BE. They will be addressed on the next dot release.
The same is true for OpenSSH. Versions 10.4 and 10.5 came out weeks apart, July 7th and August 11th.
26.4.2 BE on August 14th included 10.4 as it was the latest available on Freshports at the time.
No available patches are missed. It's all a matter of timing and risk assessment. Nothing critical is missing from BE and there's no need to jump between CE and BE for security reasons.
#3
Development and Code Review / Looking for feedback
Last post by hdholm - August 29, 2026, 11:48:25 PMBecause I use it, I've created a plugin to manage and monitor a Tang daemon. It seems to be working for me. I don't know if there is interest in making it more widely available and how I would go about that - submit a pull request? Any comments or constructive criticism are gratefully accepted. The plugin itself is pretty straightforward, the existing FreeBSD ports do the hard lifting. Code is at https://github.com/hdholm/plugins/tree/tang/security/tang The plugin depends on llhttp, jose, and tang which are all available from FreeBSD ports. I keep everything on an internal server to which I point the FW firmware update, but I could make it public if there was interest.
If you're not familiar with Tang, it is part of a two part system used primarily on Linux. If you encrypt your hard drives and specifically your root drive it means you can't boot after an automated restart without someone typing in the key - unless you have tang server. Asa simplified explanation, the other part of the system (clevus) lives on the encrypted system and reaches out to the tang portion when booting to unlock the encryption. If the tang server is available (which is usually only true on your local network) then the encryption is unlocked, otherwise the disks remain secure. Having this on an internal (or even gateway in simple cases) firewall, is an obvious choice for where this lives since if the firewall is down, you probably need local intervention for things beyond typing in the encryption key.
If you're not familiar with Tang, it is part of a two part system used primarily on Linux. If you encrypt your hard drives and specifically your root drive it means you can't boot after an automated restart without someone typing in the key - unless you have tang server. Asa simplified explanation, the other part of the system (clevus) lives on the encrypted system and reaches out to the tang portion when booting to unlock the encryption. If the tang server is available (which is usually only true on your local network) then the encryption is unlocked, otherwise the disks remain secure. Having this on an internal (or even gateway in simple cases) firewall, is an obvious choice for where this lives since if the firewall is down, you probably need local intervention for things beyond typing in the encryption key.
#4
German - Deutsch / ACME Client zurücksetzen
Last post by PrinceLG - August 29, 2026, 11:18:43 PMHallo zusammen,
ich habe meine OpnSense auf eine neue Hardware übertragen (Neuinstallation 26.7.3 und Restore der letzten Konfigurtion).
Funktioniert auch alles perfekt, leider werden im ACME Client keine Konfigurationen gezeigt, Konten Zertifikate etc alles weg.
Der ACME Client bietet das Zurücksetzen an hier ist mir nicht klar wie das funktioniert.
Im Hinweis zum Zurücksetzen heisst es "Der ACME Client wird bei der nächsten geplanten Ausführung automatisch alles neu generieren."
Frage: was ist konkret mit diesem Hinweis gemeint: "bei der nächsten geplanten Ausführung" gemeint ?
Ich habe gedacht, damit ist der nächste Cronjob zur Erneuerung gemeint, aber es geschieht seit Tagen nichst der ACME Client bleibt leer.
Wie kann ich die Daten aus dem Zertifikatsspeicher wie angedacht übernehmen?
Viele Grüße
Karl
ich habe meine OpnSense auf eine neue Hardware übertragen (Neuinstallation 26.7.3 und Restore der letzten Konfigurtion).
Funktioniert auch alles perfekt, leider werden im ACME Client keine Konfigurationen gezeigt, Konten Zertifikate etc alles weg.
Der ACME Client bietet das Zurücksetzen an hier ist mir nicht klar wie das funktioniert.
Im Hinweis zum Zurücksetzen heisst es "Der ACME Client wird bei der nächsten geplanten Ausführung automatisch alles neu generieren."
Frage: was ist konkret mit diesem Hinweis gemeint: "bei der nächsten geplanten Ausführung" gemeint ?
Ich habe gedacht, damit ist der nächste Cronjob zur Erneuerung gemeint, aber es geschieht seit Tagen nichst der ACME Client bleibt leer.
Wie kann ich die Daten aus dem Zertifikatsspeicher wie angedacht übernehmen?
Viele Grüße
Karl
#5
General Discussion / nut is still broken and the ol...
Last post by DavidGA - August 29, 2026, 10:05:41 PMI used to do this to fix nut:
But now:
Any other solution now?
# opnsense-revert -r 26.1.7 nut
But now:
Fetching nut.pkg: ..[fetch: https://mirror.sfo12.us.leaseweb.net/opnsense/FreeBSD:15:amd64/26.7/MINT/26.1.7/latest/Latest/nut.pkg.sig: Not Found] failed
Any other solution now?
#6
High availability / Re: UDP Broadcast Relay - Trac...
Last post by loadduck - August 29, 2026, 08:23:41 PMThis would be real great to have it embeded, next to include setup in UDP Broadcast Relay into XMLRPC Sync to next to Interfaces: Neighbors: Static Assignments (as cluster aware KEA is not able to register static ARP).
With this users would be able to have WoL and DLNA working between lans/vlans "out of the box" from backup node.
With this users would be able to have WoL and DLNA working between lans/vlans "out of the box" from backup node.
#7
26.7 Series / Re: os-upnp plugin not working...
Last post by BondiBlueBalls - August 29, 2026, 07:31:47 PMHere's my current working UPnP setup for comparison. In my case, Games is the VLAN/interface where my PS5 lives, and 10.251.4.20 is the PS5's static/reserved IP, so obviously substitute your own interface, subnet, and device IP as needed.
UPnP settings
UPnP IGD and PCP/NAT-PMP are both enabled. WAN is the external interface and Games is the only internal interface.
I'm using:
The other advanced options are left at their defaults.
Access Control List
I have Default deny enabled with a single ACL entry allowing only the PS5:
Firewall rule
On the Games interface, I have a TCP/UDP rule allowing:
The upnp_ports alias is a Port(s) alias containing:
That firewall rule is above my RFC1918 block rule so clients on the Games network can actually reach the UPnP daemon.
Outbound NAT
I'm using Hybrid outbound NAT with a manual WAN rule for the Games network:
The Proton VPN rule shown in the screenshot is unrelated to UPnP, as are the automatically generated rules below it.
With this setup, UPnP mappings are working correctly for me. Yes, I'm seeing "NAT type: Open" in MW3.
UPnP settings
UPnP IGD and PCP/NAT-PMP are both enabled. WAN is the external interface and Games is the only internal interface.
I'm using:
Code Select
UPnP IGD compatibility: IGDv1 (IPv4 only)
Allow third-party mapping: Disabled
Disable IPv6 mapping: Enabled
The other advanced options are left at their defaults.
Access Control List
I have Default deny enabled with a single ACL entry allowing only the PS5:
Code Select
allow 1024-65535 10.251.4.20/32 1024-65535
Firewall rule
On the Games interface, I have a TCP/UDP rule allowing:
Code Select
Source: Games net
Destination: Games address
Port: upnp_ports
The upnp_ports alias is a Port(s) alias containing:
Code Select
1900
2189
5351
That firewall rule is above my RFC1918 block rule so clients on the Games network can actually reach the UPnP daemon.
Outbound NAT
I'm using Hybrid outbound NAT with a manual WAN rule for the Games network:
Code Select
Interface: WAN
Source: Games net
Destination: any
NAT address: Interface address
Static Port: YES
The Proton VPN rule shown in the screenshot is unrelated to UPnP, as are the automatically generated rules below it.
With this setup, UPnP mappings are working correctly for me. Yes, I'm seeing "NAT type: Open" in MW3.
#8
26.7 Series / State limits and the virusprot...
Last post by Jimbo218297 - August 29, 2026, 07:12:47 PMI noticed that you can create state limits using the virusprot alias in firewall rules to help prevent against potential abuse or attacks but I'm a bit confused about the set up process.
In the advanced setting on firewall rules I'm assuming you enter the maximum source connections then below that you set the virusprot alias as the overload table option. But I've noticed that all my IP type aliases are also listed as options for the overload table?
What I'm confused about is what the virusprot alias actually is? It's listed as dynamic when viewed with the list of aliases I've created myself.
Also what would happen if I put an IP type alias I've created as an option for the overload table when creating a state limit? Would it limit maximum states only for those source networks/IPs?
I see there is also an automatically generated rate limit rule that is created when the checkbox 'Disable rate limit rule' is unchecked (default) which also uses the virusprot alias as the source address.
Thanks in advance for any help as I'm by no means an expert. I've recently moved from pfSense and it's great to be able to support the project directly so I've been donating €10/month to show my appreciation.
In the advanced setting on firewall rules I'm assuming you enter the maximum source connections then below that you set the virusprot alias as the overload table option. But I've noticed that all my IP type aliases are also listed as options for the overload table?
What I'm confused about is what the virusprot alias actually is? It's listed as dynamic when viewed with the list of aliases I've created myself.
Also what would happen if I put an IP type alias I've created as an option for the overload table when creating a state limit? Would it limit maximum states only for those source networks/IPs?
I see there is also an automatically generated rate limit rule that is created when the checkbox 'Disable rate limit rule' is unchecked (default) which also uses the virusprot alias as the source address.
Thanks in advance for any help as I'm by no means an expert. I've recently moved from pfSense and it's great to be able to support the project directly so I've been donating €10/month to show my appreciation.
#9
26.7 Series / Re: Lenovo M720q randomly hang...
Last post by userunkn4wn - August 29, 2026, 06:44:02 PMYes, a display emulator would be a relatively easy but not a really satisfying fix, but yeah, I will consider this when I run out of options.
#10
German - Deutsch / Re: IPU662 defekt - Hilfe benö...
Last post by Snoopy - August 29, 2026, 06:19:24 PMNein hat es nicht.
Ich habe mir jetzt mal bei Amazon nen RAM und die SSD bestellt und werde damit testen.
Ich habe mir jetzt mal bei Amazon nen RAM und die SSD bestellt und werde damit testen.
