Recent posts

#1

26.7 Series / Post 26.7.4 Wireless Issue

Last post by TrustedComputer - Today at 05:25:19 AM

I didn't see the call-to-testing thread regarding the MVC/API migration for wireless until after upgrading to 26.7.4. I do use WiFi occasionally in my network as an access point (it's not on all the time). In the past, to enable it, it was necessary to (1) enable the WLAN interface, (2) toggle the mode from BSS to access point mode. This got it up and running and when done, I would (1) switch it back to BSS mode and then (2) disable the WLAN interface. The toggling between AP mode and BSS mode was necessary for clients to be able to connect.

Now, after 26.7.4 the old trick doesn't work anymore, nor does simply enabling the interface. In my troubleshooting, it seems to be necessary to enable the interface with the AP setting and then reboot the whole firewall. I'm hoping there's a way to fix this? It's not urgent as I don't use it very often, but it would be nice to have working right.

#2

Tutorials and FAQs / Re: [HOWTO] Reach your ONT, ca...

Last post by bamf - Today at 03:19:40 AM

Ok. But this is a route, right? Looking at the documentation https://man.freebsd.org/cgi/man.cgi?query=route

Code Select Expand

    Routes have associated flags which influence  operation  of  the  protocols
    when sending to destinations matched by the routes.  These flags may be set
    (or sometimes cleared) by indicating the following corresponding modifiers:

    -xresolve    RTF_XRESOLVE  - emit mesg on use (for external lookup)
    -iface    ~RTF_GATEWAY    - destination is directly reachable
    -static    RTF_STATIC    - manually added route
    -nostatic ~RTF_STATIC    - pretend route added by kernel or daemon
    -reject    RTF_REJECT    - emit an ICMP unreachable when matched
    -blackhole RTF_BLACKHOLE  - silently discard pkts (during updates)
    -proto1    RTF_PROTO1    - set protocol specific routing flag #1
    -proto2    RTF_PROTO2    - set protocol specific routing flag #2
So what we're using here is -blackhole. Can we use -reject instead?

#3

Tutorials and FAQs / Re: [HOWTO] Reach your ONT, ca...

Last post by Netlearn - Today at 01:52:51 AM

Is it possible to reject the blackholed traffic instead of dropping it?

No. It's not dropped, nor rejected. It's just blackholed.

#4

Tutorials and FAQs / Re: [HOWTO] Reach your ONT, ca...

Last post by bamf - Today at 12:35:33 AM

There's another and - in my opinion - better approach for preventing traffic with private destination addresses from being routed to the ISP:
Create null routes for all private address space. This will blackhole all private destination networks for which no higher priority routes exist. No firewall rules needed.

TIL. Thanks.

Is it possible to reject the blackholed traffic instead of dropping it?

#5

26.7 Series / Re: Unbound DNSSec Validator v...

Last post by newsense - Today at 12:31:58 AM

It's in 26.7.4

Check for updates. Restart Unbound

#6

Intrusion Detection and Prevention / Re: Suricata 8.0.6 — eve.json ...

Last post by Igor - Today at 12:30:39 AM

Try:
https://docs.opnsense.org/manual/how-tos/ips-bypass.html

#7

General Discussion / Re: OPNsense insists that DHCP...

Last post by Remington - September 17, 2026, 10:32:57 PM

For me the issue seems to be an old DHCP/DHCPv6 configuration in config.yml which is not necessary anymore as I moved from ISC DHCP to DNSMASQ. I have created a backup of config.xml. Removed the <dhcp> and <dhcpv6> bock and restored the firewall from this config. This fixed the issue.

#8

26.7 Series / Unbound DNSSec Validator vulne...

Last post by BigFreddy - September 17, 2026, 10:25:56 PM

Hi,

I seen online that there is a new Unbound DNSSec Validator vulnerability prior to version 1.26.1, does anyone know which version is OPNsense using and if this vulnerability was patched yet?

Thanks 

#9

German - Deutsch / Re: OpenVPN Server Export fail...

Last post by UKe - September 17, 2026, 09:59:14 PM

So zum Beispiel 😉

OK, mein Ehrgeiz ist geweckt, ich habe die KI gefragt.
1. der Insert-Image-Button ist unbrauchbar, man muß unter den Artikel auf "Click to Upload .." klicken
2. Quick Reply ist unbrauchbar, denn hier gibt es diesen Button nicht.
Also intuitiv ist das wirklich nicht.
Aber jetzt hab ich es kapiert, danke! ;-)

#10

German - Deutsch / Re: OpenVPN Server Export fail...

Last post by viragomann - September 17, 2026, 09:49:09 PM

BTW: Ich würde mir wünschen, Bilder über die Zwischenablage einfügen zu können, wie das auf vielen anderen Plattformen auch seit Jahren schon geht.
Einen Screenshot erst zu speichern und dann hochladen, das lokale Bild dann zu löschen, ist doch etwas kompliziert.