Quote from: ProximusAl on April 02, 2026, 11:00:51 AMThe OPNSense docs state:
For legacy compatibility WAN interfaces set to type DHCP or interfaces with a Gateway Rules selection send reply packets to the corresponding gateway directly, also when the sender is on the same interface. This will break connectivity in some rare scenarios and can be disabled via Firewall->Settings->Advanced->Disable reply-to.
With Multi-WAN you generally want to ensure traffic leaves the same interface it arrives on, hence reply-to is added automatically by default. When using bridging, you must disable this behavior if the WAN gateway IP is different from the gateway IP of the hosts behind the bridged interface.
In my case, I have "Disable reply-to on WAN interface" selected, and my firewall rules have the reply-to explicitly set.
My secondary WAN is DHCP, and my primary is PPPoE, so this felt safest.
That works fine.
EDIT: I should add, I have migrated to the NEW rules....
Quote from: ProximusAl on April 02, 2026, 10:53:38 AMI can tell you it works fine on 26.1.5 so you must have something misconfigured.
You havent really given us enough information.
Have you checked "Disable Reply-To on WAN rules" on Firewall/Settings/Advanced?
Have you set the "Reply-To" on the actual firewall rule? (advanced mode)
Quote from: (MARLOO) on Today at 12:06:01 AM...
upgrade initially hung in GUI but completed cleanly via CLI (pkg update -f, pkg upgrade, reboot).