"Recent posts
#1
26.7, 26.10 Series / Re: Wireguard packet loss
Last post by hysteriward - Today at 08:44:07 PMThanks. I use an IONOS VPS. It's $15 a month with 2 statics. I ended up using 2 Wireguard tunnels to simplify the routing. In my area the only way to get a static ip is through a business account. It was costing me $170 per month for 20 up and 250 down. Now with residential service I get 500Mbs symmetrical for $40. It's well worth doing and it's working flawlessly. I took the trouble to learn nftables which is the replacement for iptables which is now deprecated on many Linux flavors. It took a while to get my head around it but it is easier to use. I'm willing to share my setup with the understanding that although it works, it may not be the best way to do it.
#2
General Discussion / Dnsmasq authoratative only for...
Last post by nintendoeats - Today at 07:59:05 PMBonjour,
I am using Dnsmasq for both DNS and DHCP. All has been well so far, but now I want to globally override a public server with my own mirror. Problem is, I am not mirroring the whole domain, only part of it. I would like to prevent upstream requests for bar.foo.com and baz.foo.com, but not *.foo.com like the Local option does.
I'm getting the impression that this behaviour is just outside the scope of Dnsmasq, and that the expectation is you will set up a different nameserver to differentiate these queries. Am I mistaken?
Thanks
I am using Dnsmasq for both DNS and DHCP. All has been well so far, but now I want to globally override a public server with my own mirror. Problem is, I am not mirroring the whole domain, only part of it. I would like to prevent upstream requests for bar.foo.com and baz.foo.com, but not *.foo.com like the Local option does.
I'm getting the impression that this behaviour is just outside the scope of Dnsmasq, and that the expectation is you will set up a different nameserver to differentiate these queries. Am I mistaken?
Thanks
#3
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 07:08:08 PMOK I've done what you said, is this the page you were talking about? (The top rule)
Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.
That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.
I will add this rule to the other vlans
I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.
Update: I put the rules in exactly this order and it worked to reach what's my IP website, it showed the proton endpoint address.
That's a good thing right it means proton is working 👍😁👍? I don't know how to test DNS though.
I will add this rule to the other vlans
I enabled (DNSsec)and some other options like (far gateway) during the initial setup using the 9.9.9.9 but I'm not sure if I did that right. I know I put the proper information in the Services>Unbound DNS> DNS over TLS.
#4
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - Today at 04:15:49 PMThanks, these screenshots answer most of my questions.
Confirmed:
– VLAN tags 10/20/30/99 match your switch. Good.
– Your PERSONAL20 "via Proton" rule has gateway Proton_Gway and sets the local tag NO_WAN_EGRESS, so your kill switch is built correctly. We'll test it at the end.
– Domain (53) is the right port for the test rule, and Gateway = None is right.
A correction from me: I told you to add "Localhost" in Unbound. I see now that this list has no such entry, so please ignore that. Keep the four VLANs selected, and no, don't add LAN (it has no IPv4 address).
One thing to check: on the new DNS rule, Destination must be "This Firewall" and Source "PERSONAL20 net". The dropdown covered those fields in your screenshot. If Destination is "any" with Gateway None, DNS queries could leave outside the tunnel without the kill switch tag. Please post a screenshot of the Source and Destination part of that rule.
Order: if it works below the block rule, leave it there. I can't tell why it failed above it; if you want to find out, post a screenshot of the rule list after moving it.
Next steps: if DNS works on PERSONAL20, copy the same rule to XBOXS10 and GUEST30. Then test the kill switch: disable the WireGuard instance for a moment (VPN > WireGuard), try to load a page from PERSONAL20 (it should fail), and enable it again.
Sergio
Confirmed:
– VLAN tags 10/20/30/99 match your switch. Good.
– Your PERSONAL20 "via Proton" rule has gateway Proton_Gway and sets the local tag NO_WAN_EGRESS, so your kill switch is built correctly. We'll test it at the end.
– Domain (53) is the right port for the test rule, and Gateway = None is right.
A correction from me: I told you to add "Localhost" in Unbound. I see now that this list has no such entry, so please ignore that. Keep the four VLANs selected, and no, don't add LAN (it has no IPv4 address).
One thing to check: on the new DNS rule, Destination must be "This Firewall" and Source "PERSONAL20 net". The dropdown covered those fields in your screenshot. If Destination is "any" with Gateway None, DNS queries could leave outside the tunnel without the kill switch tag. Please post a screenshot of the Source and Destination part of that rule.
Order: if it works below the block rule, leave it there. I can't tell why it failed above it; if you want to find out, post a screenshot of the rule list after moving it.
Next steps: if DNS works on PERSONAL20, copy the same rule to XBOXS10 and GUEST30. Then test the kill switch: disable the WireGuard instance for a moment (VPN > WireGuard), try to load a page from PERSONAL20 (it should fail), and enable it again.
Sergio
#5
Russian - Русский / Re: os-xray — плагин Xray-core...
Last post by tyra - Today at 02:23:01 PMQuote from: Spylive on <strong>Today</strong> at 12:35:25 PMЭто как? Каким то каскадом? У меня сейчас есть (пока оплаченный) тоже заблокированный ip. Получается VPS-заграница -> VPS-заграница уже заблокированный?Quote from: tyra on October 23, 2026, 10:31:25 PMДобрый вечер. Оставляю восторг работе!!!!По переключал всё вдоль и поперёк все инстансы всё ХОР.!!! За исключением тех которые не работают и в HAPP на android,но это проблема на vps.ВОПРОС- Как внедрить auto ping и авто переключение между лучшем пингом?Автоматический выбор не планировал делать, как и работу по спискам. В основном это делалось для работы на актуальной версии opnsense через свой VPS сервер.
Сейчас РКН активно блокирует личные VPS, но я работаю через цепочку VPS и специально использую выходным сервером уже заблокированный в РКН и это позволило мне уже несколько месяцев обходить блокировку.
#6
26.7, 26.10 Series / Re: PPPoE over an unassigned V...
Last post by fanski - Today at 01:48:56 PMQuote from: franco on October 13, 2026, 12:15:51 PMHi fanski,
> In 26.7.1 the vlan0.35 was not the first VLAN to be created.
Previously the VLANs were created in a batch before interfaces were brought up, but that changed in .3 with the support of VLANs on top of bridges.
We haven't seen many oddities, but there were a few. Some hidden in the old code and some apparently in drivers. I need to recheck the code I gave you, but it feels like the kernel is lying to us here.
At the moment I need to release 26.7.7 though so I'll try to get back to this later this week.
Cheers,
Franco
Hi Franco,
I guess you are really busy at the moment, I just wanted to ask if you think you will have the time to look at this again or if you see another option?
Currently I'm a little bit blocked with my VoIP as it's not working without the siproxd which seems not available in version 26.7.1 (OPNSense tells me to upgrade to get the plugin running again and I need it as my ISP is not really accepting STUN as it seems because I can't login anymore after some time). And additionally I would really like to keep my software up to date, especially the firewall :)
Many thanks,
Fanski
#7
Russian - Русский / Re: os-xray — плагин Xray-core...
Last post by Spylive - Today at 12:35:25 PMQuote from: tyra on October 23, 2026, 10:31:25 PMДобрый вечер. Оставляю восторг работе!!!!По переключал всё вдоль и поперёк все инстансы всё ХОР.!!! За исключением тех которые не работают и в HAPP на android,но это проблема на vps.ВОПРОС- Как внедрить auto ping и авто переключение между лучшем пингом?Автоматический выбор не планировал делать, как и работу по спискам. В основном это делалось для работы на актуальной версии opnsense через свой VPS сервер.
Сейчас РКН активно блокирует личные VPS, но я работаю через цепочку VPS и специально использую выходным сервером уже заблокированный в РКН и это позволило мне уже несколько месяцев обходить блокировку.
#8
General Discussion / Re: Disable: "Default allow LA...
Last post by Monviech (Cedrik) - Today at 11:12:42 AMWell press on the link button in the rule. You will most likely end up in the migrator cause theyre old rules.
#9
General Discussion / Re: Disable: "Default allow LA...
Last post by passeri - Today at 10:46:27 AMRules are processed in order, by default as first match, so there is no impediment to adding overriding restrictions prior to the default rules.
What problem are you trying to solve?
What problem are you trying to solve?
#10
General Discussion / Disable: "Default allow LAN to...
Last post by marsk - Today at 10:36:35 AMHi
Disable firewall rules:
- Default allow LAN to any rule
- Default allow LAN IPv6 to any rule
I can't edit the "Default allow LAN to any" and "Default allow LAN IPv6 to any" rules, it seems they are locked.
//marsk
Disable firewall rules:
- Default allow LAN to any rule
- Default allow LAN IPv6 to any rule
I can't edit the "Default allow LAN to any" and "Default allow LAN IPv6 to any" rules, it seems they are locked.
//marsk
