Looking for testers Q-Feeds plugin

[Seimus]

You don't need to uninstall the old one.

I did the install just over the old one, it should seamlessly upgrade it.

To remove it you can run

Code Select Expand

pkg remove
 instead of

Code Select Expand

pkg add
Regards,
S.

[Lurick]

Dang, I was hopeful but that still shows the same behavior even on stock theme
For logs I see this in the Web GUI log tab:
 (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.82/src/gw_backend.c.533) connect() /var/lib/php/tmp/php-fastcgi.socket-1: Connection refused

For backend I see:
[34c6aa36-3191-4630-92d7-cb4980e92036] Script action stderr returned "b'/bin/sh: /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py: not found'"

and

[8f76feea-fd1b-40e5-9b0a-9c4a4e852bfd] Script action failed with Command '/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py stats ' returned non-zero exit status 127. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 89, in execute subprocess.run(script_command, env=self.config_environment, shell=True, File "/usr/local/lib/python3.11/subprocess.py", line 571, in run raise CalledProcessError(retcode, process.args, subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py stats ' returned non-zero exit status 127.

[Lurick]

One last question, on the Firmware > Plugins page I see
os-q-feeds-connector (misconfigured)

Is that anything to worry about?

[Seimus]

Thats normal, once its put into the Core e.g proper repos it will not show anymore.

Regards,
S.

[Q-Feeds]

Yes the 50K is hardcoded because as you mentioned it takes some time and resources to parse the logs as for now.

Gives sense, but keep in mind even those 50K can for some users peg the CPU during load, cause not everybody is running official DEC HW or N100.
I would suggest here to create similar filtering as its in the official logs. Basically we can filter from last day, week, month, all. This is as well very good for Tshoots, or if I want to check back in history.

............

Thank you for these great ideas! Some were already on the roadmap indeed; like the subcategories and whitelisting. I've added the filtering functionality to the backlog as wel, that might indeed solve the CPU load challenge.

[Q-Feeds]

Dang, I was hopeful but that still shows the same behavior even on stock theme
For logs I see this in the Web GUI log tab:
 (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.82/src/gw_backend.c.533) connect() /var/lib/php/tmp/php-fastcgi.socket-1: Connection refused

.........

Hmm interesting. Perhaps a reinstall of the plugin does the trick, like Seimus suggested ?
Otherwise could you provide us with the output of the following commands:

/usr/local/opnsense/scripts/qfeedsctl.py fetch_index -v
/usr/local/opnsense/scripts/qfeedsctl.py fetch -v
/usr/local/opnsense/scripts/qfeedsctl.py firewall_load -v

[Q-Feeds]

Finally got around to installing this, and bought a plus license. Nothing much to add beyond the feedback already given - very impressed!

Agree with Seimus comments on VPN endpoints above

I don't think I've seen a comment for these:

-The manual/setup instructions don't explicitly tell you to enable logging for the rules you set up - that might not be obvious for less experienced users.

-Also when talking about Source/Destination and Block/Reject it says "For your LAN (source) rule you could use Reject" - per the rule examples is that not Rule 1 / Destination (rather than source)? 

How long before we might be able to utilise Domains and URLs feeds in OPNSense?

First of all thank you very much for your trust and support!

Your documentation feedback is spot on and we will update it soon.

You can already use DNS if you're running AdGuard or Pi-hole. As mentioned, we're also adding this feature to the plugin. It requires some core changes, which is why it's taking a bit longer. We plan to release it later this year, though we can't give an exact timeline yet.

[Lurick]

Dang, I was hopeful but that still shows the same behavior even on stock theme
For logs I see this in the Web GUI log tab:
 (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.82/src/gw_backend.c.533) connect() /var/lib/php/tmp/php-fastcgi.socket-1: Connection refused

.........

Hmm interesting. Perhaps a reinstall of the plugin does the trick, like Seimus suggested ?
Otherwise could you provide us with the output of the following commands:

/usr/local/opnsense/scripts/qfeedsctl.py fetch_index -v
/usr/local/opnsense/scripts/qfeedsctl.py fetch -v
/usr/local/opnsense/scripts/qfeedsctl.py firewall_load -v

Sure, reinstall didn't fix it sadly

root@firewall:/usr/local/opnsense/scripts/qfeeds # ./qfeedsctl.py fetch_index -v
send: b'GET /licenses.php HTTP/1.1\r\nHost: api.qfeeds.com\r\nUser-Agent: Q-Feeds_OPNsense\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nConnection: keep-alive\r\nAuthorization: Basic {redacted}\r\n\r\n'
reply: 'HTTP/1.1 200 OK\r\n'
header: Date: Sat, 11 Oct 2025 13:04:45 GMT
header: Server: Apache/2
header: X-Content-Type-Options: nosniff
header: Strict-Transport-Security: max-age=63072000; includeSubDomains
header: Upgrade: h2,h2c
header: Connection: Upgrade, Keep-Alive
header: Vary: Accept-Encoding,User-Agent
header: Content-Encoding: gzip
header: X-XSS-Protection: 1
header: X-Frame-Options: SAMEORIGIN
header: X-Content-Type-Options: nosniff
header: Referrer-Policy: no-referrer-when-downgrade
header: Feature-Policy: geolocation 'self'; vibrate 'none'
header: X-Download-Options: noopen
header: X-Permitted-Cross-Domain-Policies: master-only
header: X-DNS-Prefetch-Control: on
header: Strict-Transport-Security: max-age=31536000
header: Permissions-Policy: geolocation=*, midi=(), sync-xhr=(self "https://qfeeds.com" "https://www.qfeeds.com"), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=(), fullscreen=(self "https://qfeeds.com" "https://www.qfeeds.com")
header: Content-Length: 733
header: Keep-Alive: timeout=2, max=100
header: Content-Type: application/json
downloaded index to /var/db/qfeeds-tables/index.json
root@firewall:/usr/local/opnsense/scripts/qfeeds # ./qfeedsctl.py fetch -v
skipped /var/db/qfeeds-tables/malware_ip.txt [2025-10-11T13:00:00Z]
skipped /var/db/qfeeds-tables/malware_domains.txt [2025-10-11T13:00:00Z]
skipped /var/db/qfeeds-tables/phishing_urls.txt [2025-10-11T13:00:00Z]
root@firewall:/usr/local/opnsense/scripts/qfeeds # ./qfeedsctl.py firewall_load -v
load feed malware_ip [no changes.]
root@firewall:/usr/local/opnsense/scripts/qfeeds #

I did have to use:
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py
instead of
/usr/local/opnsense/scripts/qfeedsctl.py
to run the three commands

[gtwop]

Lurick, you have company I have the same problem.

Have done: pkg remove/pkg add

The problem remains.

[Q-Feeds]

I did have to use:
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py
instead of
/usr/local/opnsense/scripts/qfeedsctl.py
to run the three commands

Aah yes that was my mistake. The commands show the expected behavior.. you've tried a reboot already I guess ?

Or this "service configd restart"

[Lurick]

I did have to use:
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py
instead of
/usr/local/opnsense/scripts/qfeedsctl.py
to run the three commands

Aah yes that was my mistake. The commands show the expected behavior.. you've tried a reboot already I guess ?

Or this "service configd restart"

service configd restart didn't fix it but a firewall reboot did :)

[yeraycito]

Installed and working

[gtwop]

Reboot worked here too, all three tabs show and working properly.

Thanks

[Q-Feeds]

Glad it worked out in the end !

[passeri]

Having worked through my process mentioned earlier, I have Q-Feeds working on my edge Opnsense on 25.7.5, and blocking stuff, apparently usefully. Now to questions around purchasing.

I notice on the Q-Feeds dashboard that I have access to Premium IPs, Domains, and URLs. The first of those, IPs, is available in the Plus (99€) package but URLs and Domains require the full Premium package, 249€. That is, after a Plus purchase and expiry of the testing phase, blocking will be worse than it is now. Is it possible to distinguish what proportion of current blocks are based on which list (/ tier)?

The tier for Plus includes support and allows 1-49 users, more people than the average family. Have you considered a tier without support for 1-5 users, a common home setup and licensing tier?