Sony Bravia firmware update (Error 2200) only fails behind OPNsense

[BRSM]

Hello,

An unusual issue has been observed with a Sony Bravia Google TV.

Environment
OPNsense 26.7.x
Intel N305 appliance
Intel I226-V NICs
WAN behind a FRITZ!Box (configured as exposed host)
IPv4 only
MTU 1500
Sony Bravia Google TV
Problem

The TV reports Error 2200 when checking for firmware updates.

Observed behaviour:

Connected directly to the FRITZ!Box → firmware update succeeds.
Connected behind OPNsense → Error 2200.

Everything else works normally:

Internet access
Google Play
YouTube
App downloads
Streaming services

Only the firmware update fails.

Tests already performed

The following have been tested without changing the behaviour:

Different DNS servers
Unbound DNS
DNS blocklists disabled
Suricata / IDS / IPS disabled
Wired Ethernet and Wi-Fi
Different VLANs
Simplified firewall rules
GeoIP rules disabled
Static Port Source NAT
ECN disabled
IPv6 disabled
MTU verified
Hardware offloading disabled
Packet captures

Packet captures show:

DNS resolution succeeds
TCP connections establish successfully
TLS handshakes complete successfully
Certificates are exchanged
Application data is exchanged

No obvious:

retransmissions
MTU issues
checksum errors
TCP resets
failed SYNs

The PF state table also appears normal during the update attempt.

System statistics

The WAN interface reports no errors.

TCP statistics show:

very low retransmission rate
no checksum errors
no PMTU blackhole detection
no abnormal TCP behaviour
Additional observation

Temporarily disabling PF (pfctl -d) changes the timing slightly—the TV remains longer on "Searching for latest software..."—but still ends with Error 2200.

Question

Has anyone encountered a similar issue with Sony Bravia / Google TV firmware updates behind OPNsense or FreeBSD/pf?

Given the results above, there is currently no clear indication of a general networking problem. Any suggestions for further debugging would be greatly appreciated.

[nero355]

WAN behind a FRITZ!Box (configured as exposed host)

So you have got Double NAT then basically ?

Why not get rid off it and only use OPNsense for NAT ?



For what's it worth :

- Android TV box Nvidia Shield TV 2017
- LG WebOS TV from 2018

Both work just fine behind OPNsense : Updates/Upgrades of the firmware and everything else too! :)