Recent posts

#1

26.7 Series / Re: os-frr: no route map for r...

Last post by hharry - Today at 03:18:45 AM

frr 10.6.1 ( currently used in both OPNsense and VYOS), supports  RIP routing to 'redistribute bgp route-map route_map_name'

I'm successfully used this in VYOS / FRR for years now.

It's an obvious OPNsense GUI config builder limitation, not implemented, even though FRR clearly supports it....

@ednt, you'll need to raise a github request to have it implemented in OPNsense GUI config builder...-> https://github.com/opnsense/core/issues

#2

26.7 Series / Re: os-frr: no route map for r...

Last post by pfry - Today at 02:24:55 AM

[...]redistribute bgp route-map Only_Default[...]

I'd expect that form to be available, but I'd have to have a good reason to redistribute much of anything into RIP.

Do you have another potential default route for RIP clients not through the firewall? If not, perhaps "default-information originate" into RIP would work.

#3

26.7 Series / Re: VLAN devices are on LAN IP...

Last post by tonys - Today at 02:03:39 AM

I went back to my original configuration as posted in the beginning of this thread (listed from the SSH login to OPNSense):

*** OPNsense.home.lan: OPNsense 26.7.1_1 (amd64) ***

 DMZ (igc2)      -> v4: 192.168.30.1/24
 Guest (vlan01)  -> v4: 192.168.20.1/24
 IoT (vlan02)    -> v4: 192.168.40.1/24
 LAN (igc0)      -> v4: 192.168.1.1/24
 WAN (igc1)      -> v4/DHCP4: x.x.x.x

From one of my LAN devices (192.168.1.63), I attempted pings to the Guest (192.168.20.1) and IoT (192.168.40.1) vlans and there is no connectivity as expected. This means there are no leaks that could lead to bleeding FROM the LAN TO the Guest or IoT networks. Unfortunately, I still have no devices connecting on either vlan - all devices are getting LAN IPs. I don't see how to check for bleeding from the Guest or IOT vlans to the LAN since I can't get any device onto either vlan.

This is bad - the Guest and IoT devices have complete access to my LAN. How do I check for leakage if I can't get any devices to connected to either VLAN?

#4

26.7 Series / Re: No Web_GUI if LAN is DHCP ...

Last post by nero355 - Today at 01:38:12 AM

Don't. Simple as that.

Why not? Im using opnsense for god knows how long, and i allow webgui access only on LAN interface. And my LAN interface has DHCPv4 server running on it. Never ever had issues accessing it. These options exist for a reason.

+1 here :)

But in this topic the LAN Interface is a DHCP Client instead of Server which I think is really weird and no one should ever configure it like that !!!



However there is another reason to not bind the webGUI to the LAN or simply just one Interface :
If the single Interface the webGUI is bound to goes DOWN and then UP again it can become unreachable until you reboot OPNsense.

But...

Since the webGUI (and also SSH by the way!) is also bound to Localhost both via IPv4 and IPv6 my opinion is that this should not occur ?!

#NeedsTesting :)

[The Custom Feed Hurdle:]

#5

Q-Feeds (Threat intelligence) / What new feeds would you like ...

Last post by Q-Feeds - August 05, 2026, 11:04:06 PM

Dear community,

It's been a while since we've posted an update, but we've got a pretty big one in the pipeline. Right now, our setup is limited to three distinct feeds which don't leave much room for granular choice:

• Malware IP list
• Malware DNS list
• Phishing URL list (on request / requires proxy capabilities)

(Don't worry, these aren't going anywhere!)

The Custom Feed Hurdle: Initially, we wanted to build a custom feed generator allowing users to filter by threat scores, MITRE mappings, etc. However to be completely honest, it takes a massive toll on our infrastructure if 4,000+ users/companies are constantly compiling and pulling entirely unique feeds. We aren't quite there yet. It is still on our to do list though.

Our Plan B (Pre-Defined Feeds): Instead, we are rolling out a wider variety of curated, pre-defined feeds. Given that we pull from a 15M+ IOC database (You can browser it in our TIP / IOC browser), what distinguished feeds would actually add value to your OPNSense firewalls?

Some ideas we're tossing around:

• Risk tier splits (e.g., separating by High, Medium, and Low risk thresholds)
• Specific MITRE ATT&CK techniques or vectors
• Threat actor focused feeds

Drop your ideas or use cases below.

#6

Q-Feeds (Threat intelligence) / Re: New Login Location Alert -...

Last post by Q-Feeds - August 05, 2026, 11:02:09 PM

Sorry for the late reaction and thank you for this feedback. Granular controls like you describe might become difficult and feels risky. We don't like whitelisting very much ;-) Will have a look on what we can do.

#7

26.7 Series / Re: Kea-dhcp4,problem. No conn...

Last post by av8r - August 05, 2026, 11:00:35 PM

Yes sir, everything on Proxmox LXC is correct. When I disable firewall in settings it works as intended.
I have the daemon ip's in the alias and have the ALLOWED to reach the server IP as well.

#8

Q-Feeds (Threat intelligence) / Re: Q-Feeds flagging xxx.xxx.x...

Last post by Q-Feeds - August 05, 2026, 10:59:57 PM

Obviously sorry for the inconvenience. But the only way to get this solved in the future within an hour (and often sooner) is indeed to let us know via our false positive reporting in the TIP.

#9

Q-Feeds (Threat intelligence) / Re: Passkeys added to secure ...

Last post by Q-Feeds - August 05, 2026, 10:58:10 PM

Thumbs up to you

Thank you!!

#10

26.7 Series / Re: No Web_GUI if LAN is DHCP ...

Last post by Nullman - August 05, 2026, 10:49:45 PM

Don't. Simple as that.

Why not? Im using opnsense for god knows how long, and i allow webgui access only on LAN interface. And my LAN interface has DHCPv4 server running on it. Never ever had issues accessing it. These options exist for a reason.