"Recent posts
#1
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by BoNetTech - Today at 07:25:40 PMThanks for the extra screenshots, they help a lot. The upload quality is low, so please correct me if I misread something.
A correction first: I earlier said your KSWITCHENGAGE rule looked like an inbound block. Now I see it is a floating rule on WAN, direction Out, Block, matching the local tag NO_WAN_EGRESS. That is a proper kill switch design. For it to work, your "via Proton" rules on the VLANs must set that tag ("Set local tag" in the rule, Internal tagging section). Can you check one of them and post a screenshot of that section?
Where I think things went wrong (one thing at a time):
DNS for the VLANs. I don't see any rule that allows DNS (TCP/UDP port 53) from XBOXS10, PERSONAL20 and GUEST30 to "This Firewall". MGNT99 only allows https to the firewall. If your clients get the firewall as DNS server via DHCP, their queries are dropped. As a first test, add on PERSONAL20 only: Pass, TCP/UDP, source PERSONAL20 net, destination "This Firewall", port 53, above the other rules. Then test DNS from a device on that VLAN. If it works, copy the rule to the other VLANs.
Unbound and 127.0.0.1. Under Services > Unbound DNS > General, Network Interfaces shows only GUEST30, MGNT99, PERSONAL20, XBOXS10. "Localhost" is not selected. That may be where 127.0.0.1 got lost: the firewall itself cannot use Unbound without it. Please don't change it yet, we'll come back to it after step 1.
VLAN IDs. On the switch you use VLAN 10, 20, 30, 99, and the port settings look consistent. In OPNsense the devices are named vlan01, vlan02, vlan03, vlan09. Please check under Interfaces > Devices > VLAN that the VLAN tags are really 10, 20, 30, 99 and the parent interface is the one connected to switch port 1.
Updates. Traffic from the firewall itself is not tagged NO_WAN_EGRESS, so the kill switch should not block it. But your system DNS servers are set to use the Proton gateway, so lookups (and update checks) go through the tunnel. If the tunnel is down, updates will fail. That is your choice: keep it if you want everything in the VPN, or leave the gateway empty for one DNS server if you want updates to work without the tunnel.
And about ChatGPT: you are right that setups built from partial advice are hard to untangle. Take a backup of config.xml now, and let's go step by step.
Sergio
A correction first: I earlier said your KSWITCHENGAGE rule looked like an inbound block. Now I see it is a floating rule on WAN, direction Out, Block, matching the local tag NO_WAN_EGRESS. That is a proper kill switch design. For it to work, your "via Proton" rules on the VLANs must set that tag ("Set local tag" in the rule, Internal tagging section). Can you check one of them and post a screenshot of that section?
Where I think things went wrong (one thing at a time):
DNS for the VLANs. I don't see any rule that allows DNS (TCP/UDP port 53) from XBOXS10, PERSONAL20 and GUEST30 to "This Firewall". MGNT99 only allows https to the firewall. If your clients get the firewall as DNS server via DHCP, their queries are dropped. As a first test, add on PERSONAL20 only: Pass, TCP/UDP, source PERSONAL20 net, destination "This Firewall", port 53, above the other rules. Then test DNS from a device on that VLAN. If it works, copy the rule to the other VLANs.
Unbound and 127.0.0.1. Under Services > Unbound DNS > General, Network Interfaces shows only GUEST30, MGNT99, PERSONAL20, XBOXS10. "Localhost" is not selected. That may be where 127.0.0.1 got lost: the firewall itself cannot use Unbound without it. Please don't change it yet, we'll come back to it after step 1.
VLAN IDs. On the switch you use VLAN 10, 20, 30, 99, and the port settings look consistent. In OPNsense the devices are named vlan01, vlan02, vlan03, vlan09. Please check under Interfaces > Devices > VLAN that the VLAN tags are really 10, 20, 30, 99 and the parent interface is the one connected to switch port 1.
Updates. Traffic from the firewall itself is not tagged NO_WAN_EGRESS, so the kill switch should not block it. But your system DNS servers are set to use the Proton gateway, so lookups (and update checks) go through the tunnel. If the tunnel is down, updates will fail. That is your choice: keep it if you want everything in the VPN, or leave the gateway empty for one DNS server if you want updates to work without the tunnel.
And about ChatGPT: you are right that setups built from partial advice are hard to untangle. Take a backup of config.xml now, and let's go step by step.
Sergio
#2
Virtual private networks / Re: OPNsense + AirVPN (WireGua...
Last post by BoNetTech - Today at 07:23:58 PMGreat 👍
#3
Hardware and Performance / Dec3860 CMOS Battery Type
Last post by infinisourcekc - Today at 07:05:57 PMI cannot seem to find any information on the type of battery the Dec3860 requires for the board. I know that it is not a CR2032. The battery is definitely dead but unfortunately does not have any labels on it that would indicate type. Has anyone found any documentation as to they type of battery these use?
#4
Virtual private networks / Re: OPNsense + AirVPN (WireGua...
Last post by SenseX - Today at 06:10:00 PMHi,
Thank you for pointing me in the right direction!
After a few hours of troubleshooting, I finally managed to get it working.
It turns out that the issue was that I needed to add the AirVPN gateway to the AirVPN firewall rule using the Reply-to option.
The solution was simply to set:
Reply-to:
Thanks again for your help!
Thank you for pointing me in the right direction!
After a few hours of troubleshooting, I finally managed to get it working.
It turns out that the issue was that I needed to add the AirVPN gateway to the AirVPN firewall rule using the Reply-to option.
The solution was simply to set:
Reply-to:
Code Select
AirVPN_GWEverything is now working as expected!Thanks again for your help!
#5
Zenarmor (Sensei) / Re: Attempting to install ZenA...
Last post by haymak3r - Today at 05:43:51 PMWhoa. That was it?? Both google AI and ChatGPT never mentioned this at all when I was trying to figure this out lol.
A notification in the app would be great for something this easy. Thank you so much! Why does development mode cause this??
Thanks again!
Sincerely,
Chris
A notification in the app would be great for something this easy. Thank you so much! Why does development mode cause this??
Thanks again!
Sincerely,
Chris
#6
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 05:29:36 PMOnly lets me upload 4 attachments at a time⬇️
#7
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 05:28:40 PMRemaining screenshots ⬇️
#8
Virtual private networks / Re: Noob trying to get Wiregua...
Last post by RoWAN Tree - Today at 05:24:52 PMI can get into the web ui from vlan99 port 8 @ 192.168.99.1, but I have to enter the console first to do pfctl -d then -e to enable again but if say my laptop goes into sleep mode for a while when I try the web ui it doesn't open. Maybe a certificate thing?
I've saved a back up like you said to do, the reason for Assignments>LAN not having IP was chatgpt said to do set it to none to be able to put 192.168.99.1 on mgnt. I am a beginner so I don't know if that's the correct thing to do. My switch is set to 192.168.99.2, I wanted to be able to manage both opnsense and switch ui from vlan 99.
I originally had opnsense 26.7 which is why I used chatgpt because I couldn't update to the new version that I have now 26.7.8_2 the menu layouts and fixes were apparently different which was confusing and a reason why I'm lost with DNS.
For the DNS I got lost 😅 I installed Opnsense from a and was doing the setup but never actually connected to the internet yet only a handshake so far.. I don't know what the best setup would be for what I want..
The first time I tried the setup ai said use KEA DHCP and this time around DNsmasq dhcp. I know 0℅ about DNS and i couldn't say, I know that I was trying it with 9.9.9.9 quad9 but I got lost setting that up because everything else was messed up.. I got overwhelmed with stuff I don't know does what..
The kswitchengage was that floating rule that keeps going to WAN rules after clicking on apply when I make the rule on floating rules...
Here are some more screenshots, I think the unbound part you mentioned maybe what the ai said to change.. If that option is by default LAN the that's the one that was changed. Because mine has all the vlans.
Don't trust chatgpt seems to be the overall moral here 😅, in terms what's more important, just getting this set up properly. I don't want to use my ISP router, I want everything though the VPN and keep mgnt local, but if opnsense needs an update, how would that work offline, or is there another way to do that?
I've saved a back up like you said to do, the reason for Assignments>LAN not having IP was chatgpt said to do set it to none to be able to put 192.168.99.1 on mgnt. I am a beginner so I don't know if that's the correct thing to do. My switch is set to 192.168.99.2, I wanted to be able to manage both opnsense and switch ui from vlan 99.
I originally had opnsense 26.7 which is why I used chatgpt because I couldn't update to the new version that I have now 26.7.8_2 the menu layouts and fixes were apparently different which was confusing and a reason why I'm lost with DNS.
For the DNS I got lost 😅 I installed Opnsense from a and was doing the setup but never actually connected to the internet yet only a handshake so far.. I don't know what the best setup would be for what I want..
The first time I tried the setup ai said use KEA DHCP and this time around DNsmasq dhcp. I know 0℅ about DNS and i couldn't say, I know that I was trying it with 9.9.9.9 quad9 but I got lost setting that up because everything else was messed up.. I got overwhelmed with stuff I don't know does what..
The kswitchengage was that floating rule that keeps going to WAN rules after clicking on apply when I make the rule on floating rules...
Here are some more screenshots, I think the unbound part you mentioned maybe what the ai said to change.. If that option is by default LAN the that's the one that was changed. Because mine has all the vlans.
Don't trust chatgpt seems to be the overall moral here 😅, in terms what's more important, just getting this set up properly. I don't want to use my ISP router, I want everything though the VPN and keep mgnt local, but if opnsense needs an update, how would that work offline, or is there another way to do that?
#9
Tutorials and FAQs / Re: OPNsense aarch64 firmware ...
Last post by nero355 - Today at 03:31:47 PMQuote from: Maurice on November 01, 2026, 01:53:52 PM- If you have other funding ideas, feel free to discuss them here or contact me directly.Why not write a nice long extensive HowTo/Tutorial and explain everyone how they can do this themselves ??
#10
General Discussion / Re: Please Make a Donation to ...
Last post by nero355 - Today at 03:28:53 PMQuote from: unixpgmr on <strong>Today</strong> at 04:12:47 AMWhy do I have to create a Paypal account to make a monthly donation via credit card?To safe the OPNsense Team some money that would otherwise be lost on having a subscription with a company that handles Credit Card Payments I am guessing... ?! :)
