Recent posts

#1

Tutorials and FAQs / Re: The hidden risks of runnin...

Last post by (MARLOO) - October 15, 2026, 11:54:27 PM

Thanks for the write-up. One practical addition: moving the reverse proxy into a DMZ is only useful if the DMZ has a strict per-VLAN policy.

Instead of allowing DMZ -> any, create aliases for the specific backends and ports the proxy needs. Put the explicit allow rules before the general deny rules:

Pass  DMZ -> web_backends : TCP 80,443
Block DMZ -> management_nets : any
Block DMZ -> all other RFC1918 destinations : any

Then verify the isolation from the proxy VM/LXC:

nc -vz 10.10.20.10 8006   # Proxmox management, should fail
nc -vz 10.10.30.10 5432   # database, should fail

Only the explicitly authorized backend connections should succeed. That turns "proxy in DMZ" into a real, testable security boundary.

For management interfaces, avoid exposing them through the same public reverse proxy. WireGuard, a separate management VLAN and—where possible—out-of-band access are safer than relying on hidden hostnames or secret IPv6 addresses.

#2

Tutorials and FAQs / Re: OPNsense aarch64 firmware ...

Last post by Maurice - October 15, 2026, 11:49:08 PM

OPNsense 26.7.7 aarch64 packages and sets released.

#3

26.7 Series / Re: how to recover using an ol...

Last post by (MARLOO) - October 15, 2026, 11:34:03 PM

The router is currently working again with 25.7.11 and an old configuration (from February) that needed only minor adjustments.  In a while, I'll use the spare machine to create a copy and to figure out if the rules can be converted.  Maybe I can document what happens then.

No spare physical machine is needed: a VM with isolated virtual WAN/LAN networks is enough to import the configuration and test the migrated rules safely.

Also, the backup plugins mentioned above from  cookiemonster are real: install os-sftp-backup or os-git-backup from System → Firmware → Plugins, then configure them under System → Configuration → Backups. The available plugins are listed on the plugins page.

------------------------------------------------------------------------------------------------------------------------------------------------------------------
@defaultuserfoo

I think this thread has gradually shifted away from solving the original issue and toward a broader discussion about backup habits, past decisions, and what users should have known in advance. That is understandable, especially when someone has experienced a disruptive failure, but it risks turning a potentially useful troubleshooting thread into a polemic.

A support forum is most useful when the discussion remains focused on facts, reproducible steps, and solutions that other users can verify or apply. Statements such as "the migration does not work" are difficult to act upon without more detail.

There is also a difference between criticizing a past decision and contributing to the community.
------------------------------------------------------------------------------------------------------------------------------------------------------------------

#4

26.7 Series / Re: how to recover using an ol...

Last post by cookiemonster - October 15, 2026, 08:55:07 PM

> I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.
> Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

Maybe but then every page with a suitable plugin for it would have to have a similar hint, then it all becomes information overload.
System > Configuration > Plugins lists them, just like the documentation says it https://docs.opnsense.org/manual/firmware.html

#5

26.7 Series / Re: Monit RootFS broken for ZF...

Last post by tracerrx - October 15, 2026, 08:50:54 PM

No, I mean instead of using RootFS (which has always worked for me until 26.7.7 upgrade), I followed the directions in the post and am now having to use the script to monitor ZFS.  I was just replying to myself in case others have this issue.

#6

Zenarmor (Sensei) / Re: Seeing a new "threat" in m...

Last post by Greg_E - October 15, 2026, 07:58:41 PM

Hmmm... I have no apple products on my system, and these are popping up from known IP addresses that are reserved for client workstations. Could it happen if someone plugs their phone in to charge?

Either way, I guess I will not block it and I'll have to see if I can change the category to something that won't throw a flag.

#7

Zenarmor (Sensei) / Re: Seeing a new "threat" in m...

Last post by Patrick M. Hausen - October 15, 2026, 06:14:11 PM

The Omni Group is a reputable software company targeting Mac OS and IOS with quality applications like OmniGraffle or OmniOutliner. The former is Visio on steroids. Just "insanely great" as some CEO used to say. I use it regularly - from network diagrams at work to poster layouts for my local chapter of the German Tolkien Society.

They offer a sync service to go with their apps so you can easily switch from Mac to iPad and back.

[i]

#8

26.7 Series / Re: how to recover using an ol...

Last post by nero355 - October 15, 2026, 06:13:41 PM

That's up to you.  You probably weren't using Debian when they created the problem.

My point is :

There is no problem.

Not in Debian and not in OPNsense.

I don't know about OpenWRT.

Then research it :)

TP-Link is fine for simple stuff like unmanaged switches.
Anything that requires firmware more advanced than that you can only stay away from.

Almost bought one the other day and still might do it in the future : Nothing wrong with their products IMHO...

Ubiquityi totally sucks; they can't even write documentation.

I have other issues with them, but if you can live with those then they are fine too.
In Wall Accesspoints are AWESOME!!! :)

Aruba makes nice switches and access points, and I have an HP router that comes with outstanding documentation which I took out of service because it's too loud.  Apparently they have put Aruba stickers on their routers.  Maybe those would be an option, but they might be expensive.
Do they do wireguard now?

Another thing to research ;)

I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.

Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

The world is already dumbing down soo much...

Let's not go that far in OPNsense : Mmmkay ?!

Of course I can't know everything.

But you can research your options...

No, when the connection is gone, it's gone and I have to drive there to fix it.

Then you need some kind of OOB device or IPMI/iDRAC/iLO for your OPNsense in such cases :)

Recovering from a disaster is one thing; unexpectedly being forced to do the so-called migration of firewall rules is another thing.
I was told here that it'll take many years before the so-called migration is required.

You keep saying that, but I think you have mixed things up with ISC which will be useable for some years to come, but eventually needs to be migrated to DNSmasq/KEA before it completely disappears!

Other than that, I'm grateful for the help I'm getting here.

You are welcome! :)

#9

26.7 Series / Re: how to recover using an ol...

Last post by Patrick M. Hausen - October 15, 2026, 06:10:31 PM

I was told here that it'll take many years before the so-called migration is required

Yes - you can install the legacy rules plugin on 26.7 and continue to use the old UI and the old rules. I don't know how many years exactly are implied here, though.

#10

26.7 Series / Re: how to recover using an ol...

Last post by defaultuserfoo - October 15, 2026, 05:59:39 PM

It sucks that we can't automatically store the config on an ftp server or send it by email at least once daily when it has been changed.  If that were possible I would have set that up and I'd have the current config now.

Wrong statement: There are several plugins that provide configuration backup service. I personally use 'os-sftp-backup' and works perfectly. You even have 'os-git-backup', so you can trace every single modification in a git server.

I'm not aware of such plugins.  System: Configuration: Backups doesn't mention anything in that regard.

Maybe put a hint onto that page: "More backup options may be provided by plugins you can install."

[TL:DR] Do no blame others for your own lazyness/lack of knowledge.

That doesn't have anything to do with lazyness.  If a useful option had been there like it should, I'd have used it.  Of course I can't know everything.

Apart from that, you should always make a backup before any upgrade, so your last config would be on the last-1 version. Plus you should also take a snapshot, assuming your system uses zfs, which it's the recommended.

No, the backup is either from before the router was updated last time or from the last time before the configuration was changed, that's why the latest backups were from August last year and from February this year.  When the storage has become unbootable, having a snapshot isn't very helpful.  Updating wasn't the issue at all anyway.

Make a backup before and after you make important changes. It can also help to find which change was wrong by just making a 'diff' between them.

That's why I have the backup from February.

Gonna play with firewall rules? Have a backup before just in case you even get to lose connectivity with the machine. It will take almost no time to go back.

No, when the connection is gone, it's gone and I have to drive there to fix it.

If you follow those well-known basic advices, you won't have any problem recovering from even the total disaster. Of course, everyone is free to not make regular backups, snapshots before upgrades, or any prevention measure at all, but must be conscious of the risk it implies and don't cry if/when sh*it hits the fan.

Recovering from a disaster is one thing; unexpectedly being forced to do the so-called migration of firewall rules is another thing.  I was told here that it'll take many years before the so-called migration is required.  Don't blame me for being given wrong information and not being happy about that.

Last but not least, being polite with the people usually gets best results when asking for help.

I adjust to the politeness and situation I encounter.  When you feed people wrong information and let them find out the hard way, and when you handle crucial changes like the so-called firewall rule migration in such a bad way, and when you show a bad attitude by expecting everyone to always know everything, you can't be surprised when people are totally pissed off and may not be as polite as they otherwise might be.

Other than that, I'm grateful for the help I'm getting here.