Recent posts

#1

General Discussion / Re: Help needed to update boot...

Last post by BrandyWine - Today at 08:12:09 PM

It is using 15.1 release. But you need to manually update your boot loader in FreeBSD after the OS upgrade. There is no automation for that at all.

15.1-rc3 is said to have the bootloader fix in it. So I thought OPNsense 26.7.2 could use rc3, this way going from less than 26.7 you could get directly to the fixed rc3.

But it's a bit baffling, rc3 is said to be fixed, but the notes for rc3 still says you need to manually copy in a bootloader?

https://lists.freebsd.org/archives/freebsd-stable/2026-June/004124.html

#2

26.1, 26,4 Series / Re: Use Wireguard from Inside ...

Last post by Bob.Dig - Today at 08:09:52 PM

In that case you can use e.g. a host override in Unbound, pointing my.public.vpngw to the OPNsense WAN instead of the external router's WAN.

True, but many WireGuard-apps don't update the address if it is already running.   

#3

26.1, 26,4 Series / Re: Use Wireguard from Inside ...

Last post by Patrick M. Hausen - Today at 07:56:35 PM

For some people, the WireGuard Endpoint is not the WAN-IP of Sense, for instance if you have another router in front of that.

OK, but e.g. Fritzbox categorically refuses to do hairpin NAT. In that case you can use e.g. a host override in Unbound, pointing my.public.vpngw to the OPNsense WAN instead of the external router's WAN.

#4

General Discussion / Tailscale advertised routes no...

Last post by endurium - Today at 07:40:43 PM

I'm running Tailscale in a Proxmox container that's also hosting my OPNSense VM which hosts a wired LAN on it's LAN interface (192.168.1.1) and a WiFi AP on it's WLAN interface at 192.168.3.1. Tailscale is connected to OPNSense LAN via ip 192.168.1.10 has been configured to advertise both LAN and WLAN subnets but with Tailscale connected on my remote device (iPad) I can only browse devices on the LAN subnet but not the WLAN.

Both LAN and WLAN firewall rules allow in and out traffic on both interfaces so it's not the firewall rules blocking Tailscale, I can ping 192.168.1.1 from the LXC container and also ping 192.168.3.10 (whgere the AP is connected) so there's issue with traffic flow there. Via a session on 192.168.3.10 I'm able to ping 192.168.1.10 so the WLAN AP can see the Tailscale server LXC. The subnet routes have been approved in the Tailscale machines management page.

I can't see what else to do in Tailscale to sort out this issue, so I'm guessing I need to do something in OPNSense?

Can anyone please help?

#5

General Discussion / Super strange Bridge issue wit...

Last post by clst - Today at 07:33:59 PM

Bridge is on 4 ports and working generally fine.

I have set up filtering on the bridge instead of the ports as per the guide.

Now the issue is: The phone works fine, can be called, UDP and TCP packet travel along nicely. But every time I try to call an external number (other internal extensions work great): It looks like the packets for initiating the connection get silently dropped.

During troubleshooting I tried a Linux softphone on the same port and it works fine. Plugging the non-working phone into a switch connected to OPNSense also works fine. And now the weirdest part: as soon as I toggle System - Advanced - Disable Firewall to disable all packet filtering. The phone can make calls.
I checked the MTU and it's fine. I checked with and without the block port 0 rule. Devices from the Wifi on the OPNSense box also work (but sadly that phone has no Wifi).

I am totally baffled. I have all checkboxes enabled for logging in advanced. And there are zero dropped packets in the log. I have a rule to allow interface LAN (the bridge) to LAN anything right at the top:

Code Select Expand

pass log quick on bridge0 inet from {any} to {any} keep state label "f8e58ab2-ea70-4831-a28f-1392c52478d4" # LAN bridge ALLOW ALL
all rules in /tmp/rules.debug have log enabled. And there is nothing to see in the live view. Not even an rdr from a rogue NAT rule.
The log on the Asterisk box doesn't show anything out of the ordinary. The SIP messages to actually connect the call just never arrive.

Does anyone have a hint?

I tried doing a packet log from the phone, but the firmware crashed, lol.
Packet log on the OPNSense box?

OPNsense 26.1.11_6-amd64

#6

26.7 Series / Re: OPNsense Protectli boot fa...

Last post by Patrick M. Hausen - Today at 07:11:58 PM

Install the os-smart plugin to get smartmontools and a dashboard widget in OPNsense.

#7

26.7 Series / Re: OPNsense Protectli boot fa...

Last post by CursedGravity - Today at 06:37:17 PM

Why? it's lasted me over 5 years now.  what do you use or recommend?
It doesn't look like smartctl is installed for me.

#8

26.7 Series / Re: Services widget

Last post by keeka - Today at 06:02:01 PM

I'd like to see an option to exclude static leases for the Kea dashboard widget.

#9

26.1, 26,4 Series / Re: Use Wireguard from Inside ...

Last post by nero355 - Today at 05:39:47 PM

For some people, the WireGuard Endpoint is not the WAN-IP of Sense, for instance if you have another router in front of that.

OK, but no one mentioned something like that ?!

And to be honest you have got to pick a very shitty ISP to have such an issue :
- For xDSL there is the DrayTek 167 or so Modem/Router which you could use in Bridge Modem configuration.
- For Cable a lot of ISPs offer a Bridge Mode of the Modem/Router they give to their customers.
- For Fiber connections there are multiple options :
Option A =>
AON connections are a matter of either inserting your SFP/SFP+ module into your OPNsense Router's SFP/SFP+ NIC or a Switch with SFP/SFP+ Ports and adding a little magic to get that connection to your OPNsense Router.
Option B =>
GPON/XGS-PON connections usually have simple Bridged ONTs if the ISP is not giving out "All-in-One" solutions.
And if it is you can usually buy a Bridged ONT from them or get one yourself and let them activate it on their network.

If all that fails then you are out of luck I guess... :)

#10

26.7 Series / Re: Services widget

Last post by nero355 - Today at 05:30:17 PM

The DHCP widget could also save a considerable amount of vertical space if the IP address and hostname were on the same line instead of separated.

The wasted space needs to removed on this one :

And then it's fine IMHO :)

This :

Is not a real improvement when it comes to the wasted vertical space ;(