Recent posts

#71

26.7 Series / Re: [CALL FOR TESTING] PPP(oE...

Last post by Patrick M. Hausen - September 23, 2026, 06:18:27 PM

PPPoE with dedicated physical port, no VLAN, tag added by DSL modem. Applied cleanly, no noticeable issues.

#72

26.7 Series / Re: [CALL FOR TESTING] PPP(oE...

Last post by meyergru - September 23, 2026, 06:13:03 PM

Just applied and rebooted that - came up fine just as usual. PPPoE over VLAN setup.

#73

Hardware and Performance / Re: Upgrade from J6413 Questio...

Last post by meyergru - September 23, 2026, 06:05:00 PM

Maybe shop around on the used market for something nice with 4 x Intel and something like the Intel N100 SoC for a good price ??
Or maybe something totally different that turns out to be a steal somehow ^_^

Alas, the "cheap" hardware options have left the building a while ago :-(

#74

Virtual private networks / Re: Validating the WireGuard V...

Last post by meyergru - September 23, 2026, 06:01:06 PM

I think the main problem with the diagram is that it mixes different abstraction layers and then shows them as if they were consecutive hops in the packet path.

For example:

• The gateway and the VLAN interface are not really separate hops. From the client's point of view, the gateway normally is an IP address on the OPNsense VLAN interface.
• A WireGuard interface, instance and peer are not three consecutive network elements either. The instance provides the WireGuard interface, while the peer is configuration belonging to that instance.
• The firewall is not one single box which the packet passes only once. Filtering happens at specific interfaces/directions and state tracking is involved.
• With WireGuard there are also two packet layers: the inner IP packet and the outer encrypted UDP packet.

Very simplified, outbound traffic would look more like:

Code Select Expand

Client
-> VLAN
-> OPNsense VLAN interface
-> firewall / routing decision
-> WireGuard interface
-> WireGuard processing / peer selection / encryption
-> WAN interface
-> ISP / Internet
-> remote WireGuard peer

And incoming traffic:

Code Select Expand

remote WireGuard peer
-> Internet / ISP
-> WAN
-> firewall (encrypted UDP packet)
-> WireGuard processing / decryption
-> WireGuard interface
-> firewall / routing (inner IP packet)
-> VLAN interface
-> Client

So I would probably either draw a packet-flow diagram, or a configuration-object diagram showing the relationships between VLANs, interfaces, WireGuard instances and peers.

Mixing both concepts into one left-to-right chain is what makes the current diagram somewhat misleading.

#75

Virtual private networks / Re: os-softether-devel (miscon...

Last post by fhloston - September 23, 2026, 05:56:57 PM

after the switch to 26.7 i observe daily issues with the tunnel seemingly being established but passing no traffic. only after a "service softether_server restart" will the tunnel pass traffic again.

anyone else or is it just me?

#76

Virtual private networks / Validating the WireGuard VPN C...

Last post by marsk - September 23, 2026, 05:38:19 PM

Hi,

To better understand what I was actually configuring in the OPNsense web UI, I created a logical diagram to help me.
The diagram (Attached file) shows how traffic flows through OPNsense when using a WireGuard VPN.

However, I need help verifying that the diagram is correct. Could you please verify it for me?

//marsk

#77

Hardware and Performance / Re: 10G but reaching only 5-5....

Last post by ou1 - September 23, 2026, 05:19:02 PM

I'm curious to know if you ever end up getting better performance out of the DEC750. Here is my thread about the same topic.

https://forum.opnsense.org/index.php?topic=50846.0

And the only way I managed to max out my internet connection:

https://forum.opnsense.org/index.php?topic=50846.msg268263#msg268263

#78

Tutorials and FAQs / Re: OPNsense on Older Lenovo T...

Last post by nero355 - September 23, 2026, 04:15:30 PM

I have not seen ONE installer that cares about disk partition alignment, and they all tend to default to 8 byte alignment.

Parted for Linux should do it correctly from what I have heard ?!

What have you seen going wrong so far ?

#79

Hardware and Performance / Re: Upgrade from J6413 Questio...

Last post by nero355 - September 23, 2026, 04:09:13 PM

I found a mini pc from Beelink with an Intel Wildcat 304 on board and 2 LAN ports. One is a Realtek RTL8127 (10Gbe) and the other is the tried & true Intel I226-V (2.5Gbe).

but had some legitimate concerns regarding the Realtek NIC.

Please just don't buy that thing as long as it's going to run something FreeBSD based and especially something as important as your Router/Firewall on your network !!

I see soo many topics here with all sorts of issues with RealTek NICs that it's simply not worth the trouble it might give you in the future :(

Maybe shop around on the used market for something nice with 4 x Intel and something like the Intel N100 SoC for a good price ??
Or maybe something totally different that turns out to be a steal somehow ^_^

#80

26.7 Series / Re: Documentation about Firewa...

Last post by bamf - September 23, 2026, 03:57:36 PM

Sorry the normalization documentation was merged and updated a bit too early and reflects the upcoming version already.

Ah! :) Thanks for the clarification.