"Recent posts
#51
Zenarmor (Sensei) / Re: Am I missing something or ...
Last post by Greg_E - November 11, 2026, 06:07:01 PMWhat I'm seeing is that features are greatly expanding, but not everyone wants or needs those features. I'm going to ask you for a tiered license with very basic blocking like in the free version, but more profiles and multithreaded, then add more features and tiers above it. As it looks right now, I'm priced out of the basic things that I want, sure every feature would be cool, but I bet I never have time to implement 75% of it. I need to check back to my email because I have a person working with me to try and find a plan that fits what I can pay. Budgets in education are especially tight right now, at least where I work.
As far as having a Forti competitor goes, as long as you don't have baked in admin accounts and some of the other emergency fixes that they've needed, you might have a winner there. I'm not fond of Forti devices, seem to have too many exploits too often.
As far as having a Forti competitor goes, as long as you don't have baked in admin accounts and some of the other emergency fixes that they've needed, you might have a winner there. I'm not fond of Forti devices, seem to have too many exploits too often.
#52
26.7, 26.10 Series / Re: [Solved] UPNP fatal error ...
Last post by franco - November 11, 2026, 05:12:06 PMBoth port and plugin should be hotfixed now. May take a bit for all mirrors to pick it up.
Cheers,
Franco
Cheers,
Franco
#53
26.7, 26.10 Series / [Solved] UPNP fatal error afte...
Last post by Cljackhammer - November 11, 2026, 04:50:52 PMI followed the instructions in the Reddit thread that Franco posted and the issue was resolved. This issue has been resolved.
#54
26.7, 26.10 Series / Re: UPNP fatal error after upg...
Last post by Cljackhammer - November 11, 2026, 04:44:25 PMOkay. Thanks Franco. I removed the default_min_port=1024 and friendly_name=OPNsense UPnP IGD & PCP from the configuration file and the service started. I'm not sure if this will negatively impact anything. I'll wait to hear back from the Opnsense team.
#55
26.7, 26.10 Series / Re: UPNP fatal error after upg...
Last post by franco - November 11, 2026, 04:40:18 PMWe're working through the sloppy submissions to the port and plugin now and hotfix as we progress.
https://www.reddit.com/r/opnsense/comments/1xtjd8f/comment/19shbpitagx35/
Cheers,
Franco
https://www.reddit.com/r/opnsense/comments/1xtjd8f/comment/19shbpitagx35/
Cheers,
Franco
#56
26.7, 26.10 Series / [Solved] UPNP fatal error afte...
Last post by Cljackhammer - November 11, 2026, 04:20:23 PMErrorminiupnpd Error reading configuration file /var/etc/miniupnpd.conf
2026-11-11T10:16:53-05:00Errorminiupnpd invalid option in file /var/etc/miniupnpd.conf line 9 : friendly_name=OPNsense UPnP IGD & PCP
2026-11-11T10:15:53-05:00Errorminiupnpd Error reading configuration file /var/etc/miniupnpd.conf
2026-11-11T10:15:53-05:00Errorminiupnpd invalid option in file /var/etc/miniupnpd.conf line 9 : friendly_name=OPNsense UPnP IGD & PCP
Now the service does not start.
2026-11-11T10:16:53-05:00Errorminiupnpd invalid option in file /var/etc/miniupnpd.conf line 9 : friendly_name=OPNsense UPnP IGD & PCP
2026-11-11T10:15:53-05:00Errorminiupnpd Error reading configuration file /var/etc/miniupnpd.conf
2026-11-11T10:15:53-05:00Errorminiupnpd invalid option in file /var/etc/miniupnpd.conf line 9 : friendly_name=OPNsense UPnP IGD & PCP
Now the service does not start.
#57
Announcements / OPNsense 26.7.9 released
Last post by franco - November 11, 2026, 03:36:45 PMHey there,
The 26.7 series gets another installment with a few nice feature additions
and UX revamps! There are 4 new security advisories on GitHub for the
core as well as numerous fixes throughout the components as they are being
reported. Of special note is that this update brings a number of performance
improvements throughout the system.
We have added "authority" annotations for the privilege selection and user
overview. They aim to explain how much access to the system is granted to
the user in principle: the default is "administrative" as even though single
privileges appear to be low privileges they are not as administrative (root)
tasks are being carried out by the underlying daemons and software. The
"limited" label means the user does not have access to root processes and
the "unrestricted" label means that the component being accesses has no
bounds to system access which may be part of its intended feature scope
such as XMLRPC sync. We have also marked the static PHP pages as
"unrestricted", because in reality they have historical privilege separation
weaknesses that the MVC pages no longer have. This approach will also help
shape how we accept security advisories and set their severity.
Here are the full patch notes:
o system: dashboard: refactor widget system and introduce cloneable widget types
o system: suppress local logging by default and add it as an option for remotes
o system: add validation error for attempted user scope change
o system: fix certificate widget off by one in remaining days calculation
o system: use standard throwReadOnly() on notification dismiss action[1] (reported by Janik Besendorf)
o system: implement "source networks" check in hasPrivilege()[2] (reported by Janik Besendorf)
o system: add "authority" option to ACLs to explain the effective control over the system for each privilege given
o system: add dropdown field type for backup providers (contributed by Greelan)
o system: invalidate sysctl cache on apply
o system: fix MAILTO cron statement
o system: validate uploaded picture types
o reporting: health: improve graph metadata, formatting and widget support
o interfaces: pass interfaces correctly to IPsec, Unbound during reconfiguration
o interfaces: read "lock" property using empty() in legacy page
o interfaces: fix track6 assoc_pd comparison typo (contributed by Konstantinos Spartalis)
o interfaces: use default icon color for disabled interfaces
o Interfaces: add support for TAP devices
o interfaces: hostwatch: split off automatic discovery entries from neighbor menu under its canonical service name
o interfaces: hostwatch: look up hostnames via reverse DNS API
o interfaces: revisit PPP config access
o interfaces: move "devices" array out of $ifcfg for reset
o interfaces: introduce interfaces_device_wait() for PPP reuse
o interfaces: backend call for interfaces_ppps_configure()
o interfaces: add return values to PPP configuration
o interfaces: extend line ending validation to other PPP fields as well[3] (reported by dead-lamer)
o interfaces: fix faulty handling of "dhcp6-ia-pd-len" during assignments save
o firewall: decorate paginated rules only
o firewall: avoid loading the rule model twice while the initial grid request is in progress
o firewall: be more selective which searches get decorated as well
o firewall: only getPriority() once and reuse it
o firewall: fix query performance regression due to introduction of automatic rules display
o firewall: fix alias cleanup for external aliases (contributed by Florian Punz)
o firewall: fix performance regression in aliases
o firewall: source NAT: use getWellKnown() and properly validate port ranges
o firewall: prepare new style scrub support in rules parser
o firewall: use row API to handle global collapse/expand state for rules
o firewall: remove unused getAntiLockout() function
o captive portal: further restrict roaming to IPv6 client sessions
o captive portal: account for Idle-Timeout in Access-Accept
o captive portal: add configurable CORS policy per zone
o captive portal: add limit in template parsing[4] (reported by Janik Besendorf)
o intrusion detection: use Suricata-optimized ruleset for URLhaus (contributed by 0nnyx)
o intrusion detection: support Suricata datasets in rule metadata
o kea: add simple shared_networks option to subnets
o firmware: fetch dashboard widget RSS feed from backend
o radvd: add optional lifetime setting for PREF64 (contributed by BPplays)
o unbound: fix locking in blocklist fetcher
o backend: support indefinite TTL in configd
o backend: make all long TTLs indefinite
o backend: introduce legacy_firewall_model() and legacy_firewall_settings() helpers
o lang: translation updates for multiple languages
o mvc: ApiControllerBase: introduce basic locking in configd stream handle
o mvc: OptionField: optimize option caching
o ui: prefix edit/new/copy dialog with associated icon
o ui: delegate bootgrid cell handlers
o ui: add a clear button to the bootgrid search field (contributed by Alok K. Dhir)
o plugins os-acme-client 4.18[5]
o plugins: os-caddy 2.2.3[6]
o plugins: os-freeradius 1.10.3[7]
o plugins: os-frr 2.1[8]
o plugins: os-upnp 1.10[9]
o plugins: os-openvpn-legacy now denies read-only runtime changes (contributed by Janik Besendorf)
o src: revert "ice: fix link speed after changing cable type"
o src: aq: assorted backports from stable/15
o src: axgbe: fix receive buffers without split-header mode
o src: bnxt: assorted backports from stable/15
o src: carp: fix global demotion counter to VRRP advertisements
o src: e1000: separate DH89xxCC memory errors
o src: ena: upgrade ena-com to freebsd v2.8.5
o src: iflib: do not ring the transmit doorbell when nothing is pending
o src: igmp: refresh the ip header pointer after m_pullup()
o src: netinet6: allocate correct size for ip6_fwdtag struct (contributed by pletch)
o src: netinet6: fix check for pktinfo outgoing ifindex in route cache
o src: netlink: fix unsigned overflow on a truncated message
o src: p9fs: fix p9fs_vget_common() panics
o src: pf: allows TCP RST packets in the backwards window if ACK matches
o src: pf: check extension and AH header length
o src: pf: do not corrupt neighbour advertisements when translating
o src: pf: do not hash pool address pointers into rule hashes
o src: pf: do not leak a source hash row lock in the netlink dump
o src: pf: do not loop on an address that is cleared twice in pfr_clr_astats()
o src: pf: drain the overload task before VNET rules are freed
o src: pf: first-match-wins for nat rules, even in anchors
o src: pf: fix a crash on sendfile()
o src: pf: free a table entry that cannot be routed
o src: pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()
o src: pf: free the packet rate counter of a rule
o src: pf: leave the epoch to purge unlinked rules
o src: pf: modify pfik_flags atomically
o src: pf: parse the GETSTATES state ID as 64 bits
o src: pf: register the netlink family only while the VNETs are set up
o src: pf: set the reassembly flags under the rules lock
o src: pf: take the rules read lock in pf_handle_getrule()
o src: pfil: avoid potential mbuf tag leak
o src: pfsync: use result of m_pullup()
o src: re: harden re_watchdog() recovery and log controller state
o src: re: re-arm the TX doorbell when re_txeof() leaves a non-empty ring
o src: re: recover TX completions whose MSI was swallowed in re_intr_msi()
o src: re:: quiesce RTL8168G+ and reset before freeing buffers in re_stop()
o ports: dnspython 2.9.2[10]
o ports: expat 2.10.0[11]
o ports: krb5 1.22.3[12]
o ports: libucl 0.10.0
o ports: openssh 10.6p2[13]
o ports: openvpn 2.7.9[14]
o ports: phpseclib 3.0.58[15]
o ports: pkg port epoch is now set to avoid catching a newer and potentially incompatible version from FreeBSD
o ports: python 3.13.18[16]
o ports: sqlite 3.54.1[17]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-2w8j-hpp2-8rfj
[2] https://github.com/opnsense/core/security/advisories/GHSA-2f7g-25f3-55v7
[3] https://github.com/opnsense/core/security/advisories/GHSA-f35q-c34m-pfw3
[4] https://github.com/opnsense/core/security/advisories/GHSA-r23v-737v-6r5h
[5] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.7/net/freeradius/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.7/net/upnp/pkg-descr
[10] https://dnspython.readthedocs.io/en/stable/whatsnew.html
[11] https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes
[12] https://web.mit.edu/kerberos/krb5-1.22/
[13] https://www.openssh.com/txt/release-10.6p2
[14] https://github.com/OpenVPN/openvpn/blob/v2.7.9/Changes.rst
[15] https://github.com/phpseclib/phpseclib/releases/tag/3.0.58
[16] https://docs.python.org/release/3.11.18/whatsnew/changelog.html
[17] https://sqlite.org/releaselog/3_54_1.html
The 26.7 series gets another installment with a few nice feature additions
and UX revamps! There are 4 new security advisories on GitHub for the
core as well as numerous fixes throughout the components as they are being
reported. Of special note is that this update brings a number of performance
improvements throughout the system.
We have added "authority" annotations for the privilege selection and user
overview. They aim to explain how much access to the system is granted to
the user in principle: the default is "administrative" as even though single
privileges appear to be low privileges they are not as administrative (root)
tasks are being carried out by the underlying daemons and software. The
"limited" label means the user does not have access to root processes and
the "unrestricted" label means that the component being accesses has no
bounds to system access which may be part of its intended feature scope
such as XMLRPC sync. We have also marked the static PHP pages as
"unrestricted", because in reality they have historical privilege separation
weaknesses that the MVC pages no longer have. This approach will also help
shape how we accept security advisories and set their severity.
Here are the full patch notes:
o system: dashboard: refactor widget system and introduce cloneable widget types
o system: suppress local logging by default and add it as an option for remotes
o system: add validation error for attempted user scope change
o system: fix certificate widget off by one in remaining days calculation
o system: use standard throwReadOnly() on notification dismiss action[1] (reported by Janik Besendorf)
o system: implement "source networks" check in hasPrivilege()[2] (reported by Janik Besendorf)
o system: add "authority" option to ACLs to explain the effective control over the system for each privilege given
o system: add dropdown field type for backup providers (contributed by Greelan)
o system: invalidate sysctl cache on apply
o system: fix MAILTO cron statement
o system: validate uploaded picture types
o reporting: health: improve graph metadata, formatting and widget support
o interfaces: pass interfaces correctly to IPsec, Unbound during reconfiguration
o interfaces: read "lock" property using empty() in legacy page
o interfaces: fix track6 assoc_pd comparison typo (contributed by Konstantinos Spartalis)
o interfaces: use default icon color for disabled interfaces
o Interfaces: add support for TAP devices
o interfaces: hostwatch: split off automatic discovery entries from neighbor menu under its canonical service name
o interfaces: hostwatch: look up hostnames via reverse DNS API
o interfaces: revisit PPP config access
o interfaces: move "devices" array out of $ifcfg for reset
o interfaces: introduce interfaces_device_wait() for PPP reuse
o interfaces: backend call for interfaces_ppps_configure()
o interfaces: add return values to PPP configuration
o interfaces: extend line ending validation to other PPP fields as well[3] (reported by dead-lamer)
o interfaces: fix faulty handling of "dhcp6-ia-pd-len" during assignments save
o firewall: decorate paginated rules only
o firewall: avoid loading the rule model twice while the initial grid request is in progress
o firewall: be more selective which searches get decorated as well
o firewall: only getPriority() once and reuse it
o firewall: fix query performance regression due to introduction of automatic rules display
o firewall: fix alias cleanup for external aliases (contributed by Florian Punz)
o firewall: fix performance regression in aliases
o firewall: source NAT: use getWellKnown() and properly validate port ranges
o firewall: prepare new style scrub support in rules parser
o firewall: use row API to handle global collapse/expand state for rules
o firewall: remove unused getAntiLockout() function
o captive portal: further restrict roaming to IPv6 client sessions
o captive portal: account for Idle-Timeout in Access-Accept
o captive portal: add configurable CORS policy per zone
o captive portal: add limit in template parsing[4] (reported by Janik Besendorf)
o intrusion detection: use Suricata-optimized ruleset for URLhaus (contributed by 0nnyx)
o intrusion detection: support Suricata datasets in rule metadata
o kea: add simple shared_networks option to subnets
o firmware: fetch dashboard widget RSS feed from backend
o radvd: add optional lifetime setting for PREF64 (contributed by BPplays)
o unbound: fix locking in blocklist fetcher
o backend: support indefinite TTL in configd
o backend: make all long TTLs indefinite
o backend: introduce legacy_firewall_model() and legacy_firewall_settings() helpers
o lang: translation updates for multiple languages
o mvc: ApiControllerBase: introduce basic locking in configd stream handle
o mvc: OptionField: optimize option caching
o ui: prefix edit/new/copy dialog with associated icon
o ui: delegate bootgrid cell handlers
o ui: add a clear button to the bootgrid search field (contributed by Alok K. Dhir)
o plugins os-acme-client 4.18[5]
o plugins: os-caddy 2.2.3[6]
o plugins: os-freeradius 1.10.3[7]
o plugins: os-frr 2.1[8]
o plugins: os-upnp 1.10[9]
o plugins: os-openvpn-legacy now denies read-only runtime changes (contributed by Janik Besendorf)
o src: revert "ice: fix link speed after changing cable type"
o src: aq: assorted backports from stable/15
o src: axgbe: fix receive buffers without split-header mode
o src: bnxt: assorted backports from stable/15
o src: carp: fix global demotion counter to VRRP advertisements
o src: e1000: separate DH89xxCC memory errors
o src: ena: upgrade ena-com to freebsd v2.8.5
o src: iflib: do not ring the transmit doorbell when nothing is pending
o src: igmp: refresh the ip header pointer after m_pullup()
o src: netinet6: allocate correct size for ip6_fwdtag struct (contributed by pletch)
o src: netinet6: fix check for pktinfo outgoing ifindex in route cache
o src: netlink: fix unsigned overflow on a truncated message
o src: p9fs: fix p9fs_vget_common() panics
o src: pf: allows TCP RST packets in the backwards window if ACK matches
o src: pf: check extension and AH header length
o src: pf: do not corrupt neighbour advertisements when translating
o src: pf: do not hash pool address pointers into rule hashes
o src: pf: do not leak a source hash row lock in the netlink dump
o src: pf: do not loop on an address that is cleared twice in pfr_clr_astats()
o src: pf: drain the overload task before VNET rules are freed
o src: pf: first-match-wins for nat rules, even in anchors
o src: pf: fix a crash on sendfile()
o src: pf: free a table entry that cannot be routed
o src: pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()
o src: pf: free the packet rate counter of a rule
o src: pf: leave the epoch to purge unlinked rules
o src: pf: modify pfik_flags atomically
o src: pf: parse the GETSTATES state ID as 64 bits
o src: pf: register the netlink family only while the VNETs are set up
o src: pf: set the reassembly flags under the rules lock
o src: pf: take the rules read lock in pf_handle_getrule()
o src: pfil: avoid potential mbuf tag leak
o src: pfsync: use result of m_pullup()
o src: re: harden re_watchdog() recovery and log controller state
o src: re: re-arm the TX doorbell when re_txeof() leaves a non-empty ring
o src: re: recover TX completions whose MSI was swallowed in re_intr_msi()
o src: re:: quiesce RTL8168G+ and reset before freeing buffers in re_stop()
o ports: dnspython 2.9.2[10]
o ports: expat 2.10.0[11]
o ports: krb5 1.22.3[12]
o ports: libucl 0.10.0
o ports: openssh 10.6p2[13]
o ports: openvpn 2.7.9[14]
o ports: phpseclib 3.0.58[15]
o ports: pkg port epoch is now set to avoid catching a newer and potentially incompatible version from FreeBSD
o ports: python 3.13.18[16]
o ports: sqlite 3.54.1[17]
Stay safe,
Your OPNsense team
--
[1] https://github.com/opnsense/core/security/advisories/GHSA-2w8j-hpp2-8rfj
[2] https://github.com/opnsense/core/security/advisories/GHSA-2f7g-25f3-55v7
[3] https://github.com/opnsense/core/security/advisories/GHSA-f35q-c34m-pfw3
[4] https://github.com/opnsense/core/security/advisories/GHSA-r23v-737v-6r5h
[5] https://github.com/opnsense/plugins/blob/stable/26.7/security/acme-client/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/26.7/www/caddy/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/26.7/net/freeradius/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/26.7/net/frr/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/26.7/net/upnp/pkg-descr
[10] https://dnspython.readthedocs.io/en/stable/whatsnew.html
[11] https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes
[12] https://web.mit.edu/kerberos/krb5-1.22/
[13] https://www.openssh.com/txt/release-10.6p2
[14] https://github.com/OpenVPN/openvpn/blob/v2.7.9/Changes.rst
[15] https://github.com/phpseclib/phpseclib/releases/tag/3.0.58
[16] https://docs.python.org/release/3.11.18/whatsnew/changelog.html
[17] https://sqlite.org/releaselog/3_54_1.html
#58
26.7, 26.10 Series / Re: issue with legacy firewall...
Last post by Monviech (Cedrik) - November 11, 2026, 03:25:59 PMTo be specific, it does not show up if there are no legacy firewall or NAT rules remaining.
So it doesnt track if a migration has been done or not with some kind of flag, it just reads remaining rules and decides on that to show or not.
So it doesnt track if a migration has been done or not with some kind of flag, it just reads remaining rules and decides on that to show or not.
#59
26.7, 26.10 Series / Re: issue with legacy firewall...
Last post by chemlud - November 11, 2026, 03:14:31 PMMigrated FW rules and ountbound NAT on two 26.7.8_2 (legacy plugin was installed) last week with the migration manager. If you need to migrate, the manager is there. After migrating it's gone. So...
#60
26.7, 26.10 Series / Re: ACME, sftp upload - New Cl...
Last post by bensommer - November 11, 2026, 02:23:28 PMThe connection test didn´t made it for me, that was the problem. Maybe I have this week some time to find out this behavior.
