Recent posts

#1

French - Français / Réserver un coworking à Paris ...

Last post by Armele - Today at 05:43:50 AM

Salut à tous,

Petit retour parce que je pense que ça peut aider quelqu'un. Il y a trois semaines je faisais un audit chez un client vers Opéra, à Paris. Bref. Session VPN de 4h prévue pour accéder au firewall OPNsense de la boîte, avec de la visio en parallèle pour montrer les résultats en direct. Et là, toutes les 20 minutes, la session se coupait. Franchement au début j'ai cru à un souci de config côté client, genre une règle NAT mal foutue ou un problème d'authentification. J'ai vérifié les logs, les états firewall qui expiraient bizarrement... rien de flagrant. Enfin si, en fait, il y avait bien un timeout d'état qui tombait pile à 20 minutes, mais le vrai souci c'était en amont: le wifi public depuis lequel je bossais qui coupait les connexions inactives ou faisait du NAT agressif de son côté, impossible à savoir exactement vu que c'est pas mon infra. Du coup ça remontait comme une coupure VPN alors que le problème venait du réseau local, pas de ma config. Deux heures perdues à débugger dans le vide avant de comprendre que ça venait pas de chez moi. Depuis j'ai changé ma façon de faire. Quand je sais que je vais devoir tenir une session VPN longue pour du diagnostic firewall, je réserve un espace de coworking à Paris avec une connexion fixe. Au moins je sais tout de suite où chercher si un problème apparaît.

Bonne continuation.

#2

Hardware and Performance / Re: 10G but reaching only 5-5....

Last post by pfry - Today at 01:49:01 AM

[...]1) iperf3 (on the router) is not a tool for testing bandwidth of a router. We dont run apps on the fw, we use the device as a fw/router.
[...]
Run the same test as you did, note the results, then just run "sysctl net.inet.tcp.sendbuf_max=16777216" then re-run the testing again, any difference?[...]

Good point. Folks can tune the heck out of OPNsense as a session terminator, but it generally serves little purpose (improved performance for benchmarks against the firewall itself, and some services, perhaps?) and any (permanent) tuneables should be checked/maintained across (kernel) upgrades to avoid obsolete/potentially detrimental cruft.

#3

26.7 Series / Re: General feedback

Last post by pfry - Today at 01:09:04 AM

[...]1. These update points are fixed and vetted.[...]

While I would characterize that as a choice, the nature of OPNsense (constant evolution with limited functional abstraction) makes an arbitrary upgrade step impractical. So a somewhat inevitable choice.

I've fallen behind on updates myself, so I plan to work up a new config on fresh install on a second machine... before a fresh install on a third machine which will replace the first, on which I will then perform a fresh install and keep as a backup. It's worth it to me to avoid stress and potential downtime; YMMV.

#4

26.7 Series / Re: Confused by 26.7 upgrade

Last post by Patrick M. Hausen - Today at 12:36:24 AM

The rule UI was replaced, entirely. You need to migrate your rules to the new system. Use the migration assistant. Detailed instructions are on the migration assistant UI page. Just do as is documented there.

You might need to install the legacy rule plugin to finally delete all the legacy rules.

This was announced months ago for 26.1 - you could have gone through the migration in 26.1 already to be prepared for 26.7.

#5

26.7 Series / Confused by 26.7 upgrade

Last post by Plethodon - Today at 12:29:18 AM

After I upgraded to 26.7 everything worked, so I thought I was done.  But when I went to enable some rules that I generally keep disabled, the rules weren't even there. Then I noticed that the interface didn't even let me select a rule (no checkboxes on the left side). I'm starting to think that I missed something big about this upgrade.

Then I noticed a Migration assistant under Firewall. Can anyone direct me to what I should do about this situation? I've read some posts about the Migration assistant, but I'm not clear whether that even applies to my situation. Thanks.

#6

General Discussion / Re: NUT is Broken After Udatin...

Last post by DavidGA - August 30, 2026, 11:53:24 PM

Do we need a new patch for 26.7.3_8?

# opnsense-patch https://github.com/opnsense/core/commit/14710e775
Fetched 14710e775 via https://github.com/opnsense/core
2 out of 3 hunks failed while patching opnsense/mvc/app/views/layout_partials/base_tabs_header.volt

I previously used to revert nut, which after upgrading to 26.7 is no longer possible. Nut seems to be working in the background (although it is difficult to tell) but the dashboard widget says "Nut is not returning a status. Click to reconfigure Nut." and the diagnostics page is blank.

#7

26.7 Series / Re: Can anyone at OPNsense cre...

Last post by Igor - August 30, 2026, 09:02:04 PM

I just create an instance for surfshark using wireguard, same setup for it.

Create instance and peer (from manual setup file),
Create interface,
Create Source NAT,
Create Gateway, 10.14.0.1

Added in my vpn group as tear1 for test - working well.

#8

Tutorials and FAQs / Re: What to do and what to avo...

Last post by meyergru - August 30, 2026, 08:57:58 PM

You are using the wrong documentation. Please read the first paragraph of the initial post in this thread and follow the linked swanctl Roadwarrior documentation. The guide you linked describes the old/legacy IPsec configuration, which is why those menus do not exist in your installation.

#9

General Discussion / Re: nfSensei ( fork pfsense )

Last post by Netlearn - August 30, 2026, 08:30:18 PM

We all know how much time it takes for a project like this to get mature... if it started recently and suddenly it has all the features, I would say that it is likely completely AI coded.

Can't say how mature the project is at this moment, because there is no any official release I can find, so I suppose the dev considers it's not enough to publish it.

But anyway, it's being developed since 2004.

#10

General Discussion / Re: The joys of Google AI

Last post by OPNenthu - August 30, 2026, 07:44:33 PM

I'm using LocalAI in Vulkan mode which seems to be the highest performance I can get out of the little machine I'm using.

I would like to do the same kind of thing, but the only machine I have that might be adequate enough is my main PC (RTX 5070 Ti, 16GB).  It's running a linux desktop but that's not the problem, I think.  The issue is that I would want to run the LLMs in some kind of strong isolation like KVM but Nvidia doesn't allow partitioning on their consumer class GPUs. :(  I don't know how to expose it to the VM without completely losing display output on the host.

Anybody have luck with containers?  Assuming it works for getting access to the GPU, is it safe enough for this purpose?