"Recent posts
#1
26.7 Series / Re: chrony port open?
Last post by Lucid1010 - Today at 01:54:26 AMQuote from: Patrick M. Hausen on September 16, 2026, 03:11:23 PM127.0.0.1 is the loopback interface. It is not reachable from anywhere but the firewall itself.
Yes. I'd just like to disable the local port as well.
#2
German - Deutsch / Re: Routing über falsches gate...
Last post by rthoene - Today at 01:34:20 AMVielen Dank, aus dieser Anleitung und einer Hilfestellung aus dem Netz habe ich die OPNsense konfiguriert.
Und: Die OPNsense funktioniert optisch auch entsprechend!
Vorher war PLDT der Hauptzugang (weil Glasfaser), und wenn die PING-Zeiten bei PLDT hoch gingen (2000 ms kommen da schon mal vor...), dann hat OPNsense auch in der Anzeige/Dashboard korrekt umgestellt!
Aber: Mein(e) Rechner wurde trotzdem dann weiterhin über das nun praktisch nicht benutzbare PLDT geroutet.
Hierbei machte es keinen Unterschied, ob Sticky connections aktiv oder nicht aktiv war.
Nun ist Starlink die Hauptverbindung (niedrigere Prio), das wird auch korrekt angezeigt. Trotzdem wird mein Rechner weiter über PLDT geroutet.
Das kann ich nur verhindern, wenn ich PLDT, also das Failback Gateway, gänzlich abschalte (selbst dann dauert es noch einige Zeit, bis OPNsense diesen Port nicht mehr verwendet).
Und ein abgeschaltetes Fallback Gateway ist ja nicht ganz der Sinn eines abgeschalteten Fallback Gateway...
Und: Die OPNsense funktioniert optisch auch entsprechend!
Vorher war PLDT der Hauptzugang (weil Glasfaser), und wenn die PING-Zeiten bei PLDT hoch gingen (2000 ms kommen da schon mal vor...), dann hat OPNsense auch in der Anzeige/Dashboard korrekt umgestellt!
Aber: Mein(e) Rechner wurde trotzdem dann weiterhin über das nun praktisch nicht benutzbare PLDT geroutet.
Hierbei machte es keinen Unterschied, ob Sticky connections aktiv oder nicht aktiv war.
Nun ist Starlink die Hauptverbindung (niedrigere Prio), das wird auch korrekt angezeigt. Trotzdem wird mein Rechner weiter über PLDT geroutet.
Das kann ich nur verhindern, wenn ich PLDT, also das Failback Gateway, gänzlich abschalte (selbst dann dauert es noch einige Zeit, bis OPNsense diesen Port nicht mehr verwendet).
Und ein abgeschaltetes Fallback Gateway ist ja nicht ganz der Sinn eines abgeschalteten Fallback Gateway...
#3
26.7 Series / Re: Crashes, and Kea DHCP Serv...
Last post by computer_freak_8 - Today at 12:32:37 AMQuote from: nero355 on September 16, 2026, 03:03:22 PMPost the output here and I will have a look for you too!
If the output looks good I would do a filesystem check (fsck or ZFS scrub) and the Health Check that OPNsense provides to make sure there is no corruption left behind.
Shoot! So at ~21 hours I bumped the keyboard, "Esc" key got wedged under the monitor, which exited the memtest and rebooted.
So I ran SMART checks (all supported test passed) and swapped the machine back.
If you have recommendations for Linux-y (Ubuntu is my go-to Live distro) commands to do the ZFS checks you can recommend, I'll do that at some point. (Or whatever the health check thing you mentioned is. Or if I can run the commands from the running OPNsense system - attempting to avoid a "Live" BSD though, just from my own comfort level.)
Also, might not be relevant, but at some point overnight (~3am local time), my "temporary" firewall stopped passing traffic, lights on NIC were good but no DHCP received on WANs, not responding to anything on LAN (or any other VLANs). I suspect this was because I YOLO'd it and didn't install os-realtek-re, but I guess we may never know, as I installed the package while troubleshooting the outage (lots of alerts to my phone), rebooted, and went back to bed.
#4
26.7 Series / OPNsense HA + BGP with our own...
Last post by brunorafa - Today at 12:15:38 AM**Title:** OPNsense HA + BGP with our own ASN and /24 — what architecture is recommended?
Hi everyone,
I would like to get some advice on the recommended architecture for using **BGP with OPNsense HA**, with two physical firewalls, our own IPv4 /24 prefix, and **IPsec VPNs that need to work redundantly across both firewalls**.
Our environment has:
- 2 physical OPNsense firewalls;
- HA configured with **CARP + pfsync + configuration synchronization**;
- A **Master/Slave** architecture, where the Master handles normal operations and the Slave takes over in case of failure;
- **Both firewalls need to be able to take over and operate the IPsec VPNs** during a failover;
- Our **own ASN**;
- Our own **IPv4 /24 prefix**, which will be advertised to our ISP;
- Both firewalls have independent physical connections to the same ISP.
So, we have two independent physical links:
```text
ISP 10.52.70.1 <----> OPNsense 01 10.52.70.2
ISP 10.52.70.5 <----> OPNsense 02 10.52.70.6
```
For BGP, we have flexibility with our ISP and can use **either a single BGP session or two independent BGP sessions**, one for each firewall.
### Option 1 — Two BGP sessions
```text
ISP
/ \
BGP BGP
| |
10.52.70.1 10.52.70.5
| |
10.52.70.2 10.52.70.6
OPNsense 01 OPNsense 02
MASTER SLAVE
\ /
---- HA/CARP ---
```
This is the setup we are currently using.
Each physical firewall has its own BGP session with the ISP, using our ASN and advertising the same /24 prefix.
The HA failover itself works: when we put the Master firewall into **maintenance mode**, traffic successfully moves to the Slave firewall.
However, we are seeing a behavior that makes us question the BGP architecture: **even after traffic has moved to the Slave, some flows appear to return through the Master firewall**, resulting in asymmetric routing.
At the same time, we need the Slave to take over not only the normal traffic handled by the Master, but also the **IPsec VPNs**, keeping connectivity during the failover.
This is what led us to question whether using **two independent BGP sessions**, one on each firewall, is actually the recommended approach for an OPNsense HA pair, or whether we should use a single BGP session associated with the active/Master firewall.
### Option 2 — Single BGP session
The other possibility would be to use a single BGP session associated with the Master firewall, with the Slave taking over the BGP session during a failover.
Our main question is **which of these two approaches is considered the more appropriate/recommended architecture for OPNsense in a HA setup with two physical firewalls, our own ASN, our own /24 prefix advertised via BGP, and IPsec VPNs that need to operate redundantly**.
We would especially like to understand how the OPNsense/FRR project recommends structuring this type of setup.
Thank you!
Hi everyone,
I would like to get some advice on the recommended architecture for using **BGP with OPNsense HA**, with two physical firewalls, our own IPv4 /24 prefix, and **IPsec VPNs that need to work redundantly across both firewalls**.
Our environment has:
- 2 physical OPNsense firewalls;
- HA configured with **CARP + pfsync + configuration synchronization**;
- A **Master/Slave** architecture, where the Master handles normal operations and the Slave takes over in case of failure;
- **Both firewalls need to be able to take over and operate the IPsec VPNs** during a failover;
- Our **own ASN**;
- Our own **IPv4 /24 prefix**, which will be advertised to our ISP;
- Both firewalls have independent physical connections to the same ISP.
So, we have two independent physical links:
```text
ISP 10.52.70.1 <----> OPNsense 01 10.52.70.2
ISP 10.52.70.5 <----> OPNsense 02 10.52.70.6
```
For BGP, we have flexibility with our ISP and can use **either a single BGP session or two independent BGP sessions**, one for each firewall.
### Option 1 — Two BGP sessions
```text
ISP
/ \
BGP BGP
| |
10.52.70.1 10.52.70.5
| |
10.52.70.2 10.52.70.6
OPNsense 01 OPNsense 02
MASTER SLAVE
\ /
---- HA/CARP ---
```
This is the setup we are currently using.
Each physical firewall has its own BGP session with the ISP, using our ASN and advertising the same /24 prefix.
The HA failover itself works: when we put the Master firewall into **maintenance mode**, traffic successfully moves to the Slave firewall.
However, we are seeing a behavior that makes us question the BGP architecture: **even after traffic has moved to the Slave, some flows appear to return through the Master firewall**, resulting in asymmetric routing.
At the same time, we need the Slave to take over not only the normal traffic handled by the Master, but also the **IPsec VPNs**, keeping connectivity during the failover.
This is what led us to question whether using **two independent BGP sessions**, one on each firewall, is actually the recommended approach for an OPNsense HA pair, or whether we should use a single BGP session associated with the active/Master firewall.
### Option 2 — Single BGP session
The other possibility would be to use a single BGP session associated with the Master firewall, with the Slave taking over the BGP session during a failover.
Our main question is **which of these two approaches is considered the more appropriate/recommended architecture for OPNsense in a HA setup with two physical firewalls, our own ASN, our own /24 prefix advertised via BGP, and IPsec VPNs that need to operate redundantly**.
We would especially like to understand how the OPNsense/FRR project recommends structuring this type of setup.
Thank you!
#5
Hardware and Performance / Re: amd-xgbe ("ax"): interface...
Last post by Patrick M. Hausen - September 16, 2026, 11:33:07 PMCode Select
man axp
[...]
DESCRIPTION
The axp driver enables PCI-E based 10G Ethernet controller inbuilt in the
AMD EPYC processors.
#6
General Discussion / Re: Block Local Network Connec...
Last post by nero355 - September 16, 2026, 11:28:40 PMQuote from: tangofan on September 16, 2026, 10:35:13 PMI found that I also needed an SNAT rule for NTP, so my Synology NAS would accept the response from the OPNsense NTP server. Other clients might require the same.It's basically like the Redirect DNS story : https://forum.opnsense.org/index.php?topic=9245.0
But for NTP Port 123 in this case :)
#7
Hardware and Performance / Re: amd-xgbe ("ax"): interface...
Last post by nero355 - September 16, 2026, 11:24:11 PMQuote from: patient0 on September 16, 2026, 06:32:55 PMThat type of NIC is in the Desico appliances, like the DEC7xx or DEC8xx. It's from AMD and usually baked into the SoC.OK, but is it this for example : https://www.amd.com/en/products/adaptive-socs-and-fpgas/intellectual-property/do-di-10gemac.html ?!
I am guessing the MAC is AMD and the actual chip does the PHY part ?!
#8
26.7 Series / Re: Feature Request - Ability ...
Last post by nero355 - September 16, 2026, 11:12:57 PMQuote from: s5n on September 16, 2026, 10:40:19 PMThat link is about a full-blown tty-style terminal plugin.True, but...
QuoteI think the thread starter is looking for a simple button solution with one single purpose.It's more or less the same thing and I think I have also seen messages from @franco saying that creating something like this would be very tricky and risky because of the possibility of partition layout mismatching with what the script expects...
All in all : I think this will never happen as long as FreeBSD doesn't have some kind of extremely reliable way to do it after updating/upgrading :)
#9
German - Deutsch / Re: OPNSense Anfänger braucht ...
Last post by viragomann - September 16, 2026, 10:40:28 PMQuote from: Chr1sly on September 16, 2026, 06:00:17 PMIch finde das Benutzerinterface zwar logisch, aber auch recht zerklüftet... Da waren die Zywalls schon irgendwie einfacher zu administrieren.Ja, die Benutzeroberfläche unterscheidet sich gewiss stark von diversen namhaften Firewalls und mag für einen Einsteiger komplex erscheinen. Ein Grund dafür ist auch, dass OPNsense oft mehr Optionen bietet, bzw. dass man Dinge gesondert einstellen kann oder muss, die andere FWs gar nicht berücksichtigen oder automatisch machen.
Scheint, dass die Lernkurve doch etwas steiler ist als zunächst gedacht.
Die OPNsense Docs erklären aber die grundlegenden Funktionen kurz und gut. Bemühe einfach die Websuche, um das Gefragte zu finden. Nachdem du schon Erfahrung mit anderen Firewalls hast, weißt du ja, wonach du suchen musst.
Wenn ich bspw. auf Ecosia die Begriffe "opnsense docs port weiterleitung" eingeben, bekomme ich in den ersten Ergebnissen die gewünschte Seite Network Address Translation.
Ich würde aber nach Möglichkeit englische Begriffe verwenden, da kommt die gesuchte Seite gleich als erstes Ergebnis.
#10
26.7 Series / Re: Feature Request - Ability ...
Last post by s5n - September 16, 2026, 10:40:19 PMQuote from: nero355 on September 16, 2026, 06:00:19 PMNot going to happen : https://forum.opnsense.org/index.php?topic=52134.msg268594#msg268594 :)
That link is about a full-blown tty-style terminal plugin. I think the thread starter is looking for a simple button solution with one single purpose.
