"Recent posts
#1
Announcements / Re: OPNsense 26.4.1 business e...
Last post by franco - Today at 03:43:59 PMHere are the full patch notes for patch release 2:
o system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
o system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
o system: lower max-request-size to roughly max post size in lighttpd configs[63] (reported by lujiefsi)
o system: do not let the components selectpicker grow indefinitely in defaults page
o system: dashboard widget does not know about patch release syntax
o system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
o reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
o firewall: use "urgent" as empty default for firewall debug messages
o firewall: invalidate rule stats cache for firewall utilities API endpoint
o captive portal: automatic block rule should be evaluated after the anti-lockout rule
o firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
o monit: use throwNotFullAdmin() to restrict monit GUI write access to full admins due to intended system wide execution rights
o monit: fix mail-format and poll-time validation
o openvpn: client export can export private keys for unlisted certificate references[64] (reported by iys8 and lujiefsi)
o unbound: missing NetMaskAllowed=N on override address
o backend: remove cache file on execution error in script_output
o mvc: safeguard some write operations with missing throwReadOnly() actions for custom action[65] (reported by lujiefsi)
o mvc: form labels can be empty so make sure to add them to avoid warnings in forms
o ui: fix multiple stored XSS[66] (reported by lujiefsi)
o ports: openvpn 2.7.5[67]
o ports: suricata 8.0.6[68]
--
[63] https://github.com/opnsense/core/security/advisories/GHSA-h4qj-j2x9-q553
[64] https://github.com/opnsense/core/security/advisories/GHSA-rw63-4hw9-p4v7
[65] https://github.com/opnsense/core/security/advisories/GHSA-vw8q-pqq7-2q7v
[66] https://github.com/opnsense/core/security/advisories/GHSA-jm2f-ch62-rpxr
[67] https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst
[68] https://suricata.io/2026/07/09/suricata-8-0-6-and-7-0-17-released/
o system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
o system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
o system: lower max-request-size to roughly max post size in lighttpd configs[63] (reported by lujiefsi)
o system: do not let the components selectpicker grow indefinitely in defaults page
o system: dashboard widget does not know about patch release syntax
o system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
o reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
o firewall: use "urgent" as empty default for firewall debug messages
o firewall: invalidate rule stats cache for firewall utilities API endpoint
o captive portal: automatic block rule should be evaluated after the anti-lockout rule
o firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
o monit: use throwNotFullAdmin() to restrict monit GUI write access to full admins due to intended system wide execution rights
o monit: fix mail-format and poll-time validation
o openvpn: client export can export private keys for unlisted certificate references[64] (reported by iys8 and lujiefsi)
o unbound: missing NetMaskAllowed=N on override address
o backend: remove cache file on execution error in script_output
o mvc: safeguard some write operations with missing throwReadOnly() actions for custom action[65] (reported by lujiefsi)
o mvc: form labels can be empty so make sure to add them to avoid warnings in forms
o ui: fix multiple stored XSS[66] (reported by lujiefsi)
o ports: openvpn 2.7.5[67]
o ports: suricata 8.0.6[68]
--
[63] https://github.com/opnsense/core/security/advisories/GHSA-h4qj-j2x9-q553
[64] https://github.com/opnsense/core/security/advisories/GHSA-rw63-4hw9-p4v7
[65] https://github.com/opnsense/core/security/advisories/GHSA-vw8q-pqq7-2q7v
[66] https://github.com/opnsense/core/security/advisories/GHSA-jm2f-ch62-rpxr
[67] https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst
[68] https://suricata.io/2026/07/09/suricata-8-0-6-and-7-0-17-released/
#2
26.7 Series / Re: Services widget
Last post by WN1X - Today at 03:29:29 PMMaybe lose the green inverse video effect and just color the text red/green depending on the service state.
#3
French - Français / Emploi en télé-travail et OPNs...
Last post by MariusLo - Today at 03:28:48 PMSalut, ça fait 8 mois que j'ai décroché un emploi en télé-travail full remote pour une boite de dev basée à Lyon, et depuis le début j'essaye de sécuriser ma connexion correctement depuis chez moi. J'ai installé OPNsense sur une petite box que j'ai récupéré y'a quelques semaines, un truc à 80 euros d'occaz, pas grand chose mais sa tourne. Le problème c'est que je galère à configurer le VPN côté client pour accèder au réseau interne de la boite... leur DSI m'a envoyé un fichier .ovpn mais je sais pas trop ou l'intégrer proprement dans OPNsense sans que ça casse le reste du trafic. J'ai lu des trucs sur le split tunneling mais franchement les tutos sont pas clair du tout. Quelqu'un ici bosse en remote et a déjà monté ce genre de config ? J'avoue que je rame un peu là.
#4
26.7 Series / Re: OPNSense 26.7 on Proxmox 9...
Last post by meyergru - Today at 02:46:38 PMYou did use multiple threads if you tried this via iperf?
Also look at:
https://forum.opnsense.org/index.php?topic=52420.0
And be sure to use "host" CPU type and disable Spectre and Meltdown mitigations.
Also look at:
https://forum.opnsense.org/index.php?topic=52420.0
And be sure to use "host" CPU type and disable Spectre and Meltdown mitigations.
#5
26.7 Series / Re: OPNSense 26.7 on Proxmox 9...
Last post by adamdb - Today at 02:36:39 PMQuote from: meyergru on Today at 02:13:11 PMSee this for a start. Use RSS under OpnSense (it's documented) and set the VM NICs to multiqueue.
thanks. I'd already configured multi-queue on the nics to match the allocated number of cores. Not sure if RSS will help here though. The machine is doing almost nothing CPU wise..
Will have a read anyway. thank you.
#6
26.7 Series / Re: [Solved by reboot] 26.7 Up...
Last post by knowHoff - Today at 02:31:20 PMI assume I had the same issue, at least the health check log looked the same like health check log
Interestingly I have two almost exact same systems.
The other system updated fine from the webGUI.
Thank you for taking care of us!
Cheers
Interestingly I have two almost exact same systems.
The other system updated fine from the webGUI.
Thank you for taking care of us!
Cheers
#7
26.7 Series / Re: Ports 2000, 5060 wrongly r...
Last post by meyergru - Today at 02:28:19 PMPort 113 is often blocked by ISPs - there is good reason to do that. Try if you see any packets on that port by creating a logging rule for the port and see if it fires at all.
You can check by creating rules as well for the "open" ports in order to see if something in front of your connection catches these packets, be it the ISP or the bridge modem.
Other than that, you may have a PNP daemon installed which allows LAN devices to dynamically open ports to the outside and some VoIP or other device does this (And yes, port 5060 is for SIP).
You can check by creating rules as well for the "open" ports in order to see if something in front of your connection catches these packets, be it the ISP or the bridge modem.
Other than that, you may have a PNP daemon installed which allows LAN devices to dynamically open ports to the outside and some VoIP or other device does this (And yes, port 5060 is for SIP).
#8
26.7 Series / Re: OPNSense 26.7 on Proxmox 9...
Last post by meyergru - Today at 02:13:11 PMSee this for a start. Use RSS under OpnSense (it's documented) and set the VM NICs to multiqueue.
#9
26.7 Series / Re: Ports 2000, 5060 wrongly r...
Last post by Aerowinder - Today at 02:11:04 PMIs anything listening on those ports?
Code Select
sockstat -4 -6 -l | grep :2000
sockstat -4 -6 -l | grep :5060 #10
26.7 Series / Re: OPNSense 26.7 on Proxmox 9...
Last post by Aerowinder - Today at 02:03:46 PMSilly question maybe, but what speed is being negotiated on the link?
