r/opnsense

Hi! I'm about to expose my server's services with SWAG reverse proxy. I know i can setup geolite2 on either OPNSense or SWAG. My goal would be to allow only IPs in my own country to "pierce through" my OPNSense firewall.

If I allow only IPs from my country on OPNsense, I'm scared I won't be able to access servers and services from other countries (ie: losing access to Aliexpress). However, when i enforce that on SWAG, it will only allow connections from my country directly on my services without worrying about losing access to services in other country. In return, with SWAG, i can't block them globally.

If it won't break anything when set up on OPNSense, can I just simply whitelist my own country? Or do i have to select every region one by one?

Hello everyone,

I'm currently trying to get multihoming without BGP on OPNsense to work. Uplink A has a /56 delegation that I use to provide GUAs for each device. Uplink B is using the cellular network and receives a /128 GUA and a /128 ULA. If uplink A goes down I want to route the traffic with NAT over uplink B. None of the IPv6 addresses are static.

I've been setting it up and it works if I specify the /128 GUA as a translation address. If I just specify the interface address it will unfortunately translate to the ULA and not work. Is there a way to fix this without scripting?

Looking forward to your responses!

Hi all, i'm working on automating some stuff within my home lab, primarily through automated nix deployments.

one small roadblock i currently have towards my goal of being able to take a nix config fully from a configuration on my workstation to a running set of services on a VM on my proxmox cluster is that my homelab is actually closer to 6 homelabs, experimenting with various things (i actually use my homelab as a lab to learn new skills, not just to make storing my "linux iso's" or w/e easier).

sadly, im stuck with my main residential router, which doesn't support basic features like using a larger subnet, using multiple subnets or using VLANs.

so currently, i am running a double-NAT setup with an opnsense box behind my main router, my "home net" is on the main network, and the opnsense box effectively condenses my entire home lab down to one ip.

this *fully* works, i have it set up to work completely fine, though it took some doing. learnt a *lot* about NAT and firewalls trying to get everything working correctly especially since my proxy is on the main net with multiple newt vpns on various subnets to reach the different servers that need public internet publishing, which all has to work "locally" but through NAT.

i've already gotten my deployment pipeline to the point where the server is created with the desired configuration and subsequently moved on proxmox to the correct network/vlan (all servers are prepped by booting an ISO that has a predetermined IP on the local net, since deployment of the config happens over ssh).

problem is: once this happens, i no longer have access to the server over ssh because now it's on a different subnet behind NAT.

this is easily resolved by opening a port on the opnsense router, i already took this into accounts so all my configs have a port noted in case they need to go through the opnsense router.

the actual thing i cannot seem to figure out is: how do i set up a NAT destination rule and its accompanying firewall rule automatically as part of a deployment pipeline?

it's totally fine for this router to have a bunch of ssh ports open btw, since well... its behind *another* firewall that basically only has http, https, email and VPN ports available, all bound to specific servers. there's no way to reach any of these ports from the internet.

basically: what's the best approach to having an automated workflow of some kind make changes to the NAT configuration/firewall configuration? preferably something that doesn't need its own server to run on, but if i must, i will.

if this is not possible at all and someone knows of another way to automatically gain ssh access from my main workstation to all deployed servers on the various opnsense subnets (assuming those servers are already set up with proper keys, sshd configs etc), do also let me know about those.

Hi, anyone running OPNsense in a Proxmox VM what are your speeds like? Have you passed the NICs through? Did you follow any tuning guides?

I have a Windows 11 workstation with static IPv4 and DHCP IPv6. The machine is receiving the wrong Connection-Specific DNS Suffix ".bo.".

Testing.. Disabling IPv6 and refreshing provides a blank connection suffix. Enable IPv6 and it returns ".bo.".

Its unclear if this is a random name or clipped from the actual domain name. "in.bounce.notreal".

The DNSmasq.conf contains the correct domain name and does not contain ".bo." at all. I am using RA from dnsmasq, system RA is not enabled.

domain=in.bounce.notreal
dhcp-range=tag:igc1,10.10.1.234,10.10.1.254,86400

dhcp-range=tag:igc1,::100,::1ff,constructor:igc1,slaac,ra-names,64,86400

ra-param=igc1,60,1200

Update:

After additional testing the domain name is mangled from DNSmasq "DHCP FQDN" ✅ and "DHCP default domain", if a replace "in.bounce.notreal" with "testme.internal" the Connection-specific DNS suffix is "te.int" instead of ".bo.".

I have a dual-stack setup where my ISP dynamically rotates my IPv6 Prefix Delegation (PD) over DHCPv6 on the WAN.

Note: The network data, issue details, and logs above are entirely real and captured from my local environment; AI was used solely to help format and organize the post cleanly.

The Setup:

• WAN: DHCPv6 (requesting prefix delegation).
• LAN IPv6 Configuration Type: Identity association

IPv6 LAN config

• Router Advertisements (LAN): SLAAC-only. I don't have any RA config under Services -> Router Advertisements. The current RA config is coming from DNSmasq DHCP ranges option. RA mode is ra-only.

DNSmasq DHCPv6 ra-only mode

The Issue: When the ISP rotates the prefix, rc.newwanipv6 triggers and WAN gets the new prefix. However, two things fail:

1. Sync Problem: The LAN interface alias does not immediately update to the new prefix. It gets stuck on the old/64.
2. SLAAC Stale Lifetimes: radvd keeps broadcasting the old prefix. Since OPNsense defaults to 24-hour Valid/Preferred lifetimes and doesn't explicitly send a deprecation signal (Preferred Lifetime = 0), all my local SLAAC clients retain unroutable IPs and IPv6 routing blackholes until I manually intervene.

Interfaces -> Overview output:

See that IPv6 on WAN and LAN is different 1d32 vs 1d36

Here is the rdisc6 output from a Debian client on the LAN after the WAN PD changed. Notice the stale prefix still being advertised with a full 24h lifetime:

Plaintext

 Prefix                   : 2a00:1d36:4f6b:3100::/64 (Old Prefix)
  On-link                 : Yes
  Autonomous address conf.: Yes
  Valid time              : 86400 seconds
  Pref. time              : 86400 seconds

My Workaround: Couldn't find. Rebooting the Opnsense, disable and re-enable IPv6 is not a solution.

My Question: Am I missing a specific settings, should I open a bug report for this?

Thanks in advance.

Ciao a tutti,

leggo da molto tempo e sono in Italja, ma è la prima volta che scrivo su reddit (vi chiedo scusa se dovessi commettere errori...migliorerò con l'esperienza 😂).

Ho cambiato casa e... è tempo di costruire una rete degna di questo nome.

L'abitazione è parzialmente cablata in cat5e, ma svolgerò un upgrade nel corso delle prossime settimane.

Le mie esigenze sono quelle di gestire una ftth principale (2.5/1Gbps con Aruba + un possibile backup dello stesso tipo con skywifi); l'idea sarebbe quella di gestire le due connessioni in failover (ipotizzando anche una terza rete di backup basata su tecnologia LTE o 5G).

Ho immediatamente pensato a opnsense e, inizialmente, ero orientato a un M920Q usato della Lenovo, in particolare perché, montando opnsense su proxmox, potrei lasciare spazio (e risorse) per adguard o altre amenità che voglio implementare man mano.

Sto, però, ultimamente sviluppando la paura del "e se di botto si spegne e devo sostituirlo al volo con altro...che faccio? Crolla opnsense, ma anche tutto il resto!"

Pertanto sto ragionando ad un piano B bare metal, dove mettere solo opnsense stesso, cercando di contenere i costi perché...beh, i tempi sono quelli che sono 🤣

Mi date qualche consiglio? Grazie e a presto!

Andrea

I had 26.7 nuke my install, today I reinstalled it and it works but autoboot won't work, so I have to connect a keyboard and hit enter. I already confirmed fast and secure boot are off and I see no other relevant options I could do online. Any advice? Also happens with or without peripherals

With the upcoming Aliexpress deals, I'm looking for a new hardware to migrate (and upgrade) from pfs to opnsense. I'm looking to purchase a Topton from Ali, but am open to other reliable brands or stores). Needs to be small form factor with decent heat dissipation. I'll buy ram/ddr separately. I'll be running the basics, but will want room for additional packages (suricata, dns blocker, etc.). Am I good with N100, or should I get a 150 or 200 instead?

The problem, there are so many variations and I'm looking for a good deal. Can anyone recommend a specific hardware at good price. Direct link appreciated.

Hi guys,I came here looking to answer one question and also if any of you can share his experience, first the question, as the title describes I am blocked by my isp to enable bridge mode so I can use opnsense as the main brain, so the question is, is there any way to enabled without them permission? ( i know the answer my depends on the model of the router but before sharing that wanna hear your experience)

Second, can anyone share your experience on using it either way as a doble NAT, I was reading this is possible and they explained that some apps might not work but I want some real experience from people with this configuration if they even exist, or do you consider not even useful to try this.

TIA.

Has anyone successfully got chatgpt/claude working while forwarding the traffic through PIA VPN in Opnsense?

The PIA app and chrome extention works but I'm trying to skip that and have it auto forwarded through opnsense.

Gemini says it isn't possible due to dynamic CDN's (whatever that means).

Any tip appreciated!

For the life of me, I cannot figure this out. I have absolutely read and followed the documentation for this process, and the local query still will not resolve. I know the query forwarding is set up right along with the port assignment of 53, and 53,053. I’ve turned off allow fall back to system servers. It doesn’t mention that in this in the documentation, but under the interface option in dnsmasq, do I somehow need to select the loop back interface there, which is not currently an option. Any other ideas?

What can a user of OpnSense do to harden against NatJack attacks? NatJack.io lists some things but I was curious if there are some OpnSense specific hardening strategies.

26.7.2_2:

• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• ui: bootgrid: classname can depend on state, accept a callback function

26.7.2:

• system: use /var/lib/php/tmp in static pages for proper privilege separation
• system: improve "user-config-readonly" in static pages where write_config() was denied
• system: service widget changes based on further community feedback
• system: support 7680 bit RSA type for certificates and authorities
• system: add redirection capability to SSO provider
• reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
• reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
• reporting: stop NetFlow service before reloading configuration
• interfaces: fix assignment of wireless devices
• interfaces: strict description fields in new assignments page (reported by call-AX)
• interfaces: fix typos in GIF reconfiguration script
• interfaces: add "noclamp" flag for GIF
• interfaces: add separate link types for IPv4 and IPv6 in overview
• interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: group invalid rules to the end of the ruleset
• firewall: enable virtualDOM and refactor commands on alias page
• firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
• firewall: fix missing well-known ports in local-port in destination NAT
• firewall: add "max-pkt-rate" rate limiting option to firewall rules
• firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
• firewall: scope get action to general settings in source NAT
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• backend: sanitize template filename replacements
• backend: further restrict actions to root and wwwonly for more sensitive actions
• backend: ensure strict templates are not reloaded via "*" wildcard
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: create runInterfaceRegistation() and use it for immediate device registration
• mvc: add some exception types and handle them in the base template
• mvc: clean up a number of stale imports
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
• ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
• ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
• ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
• ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
• ui: do not freeze commands column on touchscreen devices
• ui: further fixes for base templates
• ui: fix empty legacy firewall menu container glitch
• plugins: os-caddy 2.2.0
• plugins: os-frr 1.54
• plugins: os-intrusion-detection-content-at-antiphishing 1.0 (contributed by Julio Lira)
• plugins: os-ndp-proxy-go 1.4
• plugins: os-nrpe 1.2
• plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
• src: pf: add missing PF_TS_CNT netlink attribute
• src: pf: expose first rule label for states since rule number is insufficient
• src: usb: bpfattach() before if_attach()
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.4
• src: assorted minor commits from stable/15
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: jail: restore ktrace privileges for jailed root
• src: ktimer: check for errors from realtimer_gettime()
• src: kqueue: avoid enqueuing an already-enqueued knote
• src: zfs: multiple fixes
• src: tzdata: import 2026c
• src: wg: check for crypto operation errors
• src: revert "daemon: replace memchr with memrchr"
• ports: dpinger 3.6
• ports: hostapd / wpa_supplicant 2.12
• ports: nss 3.126
• ports: openldap 2.6.14
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.18.2
• ports: py-duckdb 1.5.5
• ports: python 3.13.15
• ports: unbound 1.26.0

Hi everyone, this question has probably been asked a million times but i need some recommendations for hardware and so I turn to you, dear Reddit hive mind. I'm getting Fiber Optic Cable soon and thus have to replace my Fritz!Box anyways. So I was thinking of getting something I can tinker with and also supports splitting my network into separate Subnets. I'm already running OPNSense behind my current Fritz!Box on a VM, but dedicated hardware seems like the right way to go.

My requirements are the following:

* Very energy efficient (German energy prices are insane)

* At least 3 NICs

* Future Proof (so maybe 2.5 or even 10 GbE NICs)

* Hopefully cheaper than 300-400€

In also planning to use the VPN but only for a few users.

Thanks for your help me advance :)

• system: improve the log_archive script to also work on log subdirectories
• system: routing: changed "disable" option to "enable"
• system: add "local_uri" type in SanitizeFilter() and use it to avoid hardcoding
• system: several compatible adjustments for upcoming PHP 8.5
• system: enhance live log widget (contributed by Greelan)
• system: support 7680 bit RSA type for certificates and authorities
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: stop NetFlow service before reloading configuration
• interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
• interfaces: fix typos in GIF reconfiguration script
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: always show automatic and legacy rules in new rules GUI
• firewall: add the same new rules GUI design to the MVC NAT pages
• firewall: add CSV download/upload to MVC NAT pages
• firewall: add migration for outbound NAT into source NAT page
• firewall: destination NAT: display effective port when local-port is omitted
• firewall: source NAT: allow empty target which means the interface address
• firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• firewall: improve performance on MVC pages using virtualDOM
• firewall: allow WAN as "associated interface" for NPTv6 when prefix ID is set
• firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• firewall: show rule counts that can be exported and hide tab if no rules exist
• firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• firewall: add validations for "No RDR" option to prevent target and local-port being set
• firewall: fix some small issues in menu registration for legacy pages
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: scope get action to general settings in source NAT
• kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
• kea: add widget to show DHCP leases
• kea: simplify model option values
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• openvpn: simplify model option values
• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• unbound: update Hagezi blocklists to use new mirror URL
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• mvc: DescriptionField: disable special and newline characters
• mvc: FileObject: fix exception bug (contributed by Greelan)
• mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
• mvc: use camelCase for carp_status action
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: bootgrid: minor optimizations
• plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS
• plugins: os-OPNWAF 2.3
• plugins: os-cloudflared 1.1
• plugins: os-freeradius 1.10.2
• plugins: os-vnstat 1.4
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.3
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: wg: check for crypto operation errors
• src: tzdata: import 2026c
• ports: curl 8.21.0
• ports: lighttpd 1.4.84
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.16.0
• ports: py-duckdb 1.5.4
• ports: python 3.13.15
• ports: syslog-ng 4.12.0
• ports: unbound 1.26.0

I have a Proxmox cluster with a Layer 3 underlay using FRR OpenFabric. The Proxmox nodes act as VXLAN VTEPs, and Proxmox SDN provides overlay VNets for VM connectivity across the cluster. Ceph runs over the underlying routed fabric.

I switched over to VLANs for my network, and when switching and starting my VMs, I noticed that I was no longer able to ping the network from my VPN connection or from any VM that doesn’t have the myvnet1 bridge. Before, I was able to ping it from anywhere.

I have a pfSense firewall running as a VM in my cluster, and it has the myvnet gateway. I have also added the tagged VLAN to its double-NAT interface, which is vmbr0, the same as on my Proxmox nodes.

What’s interesting, though, is that if I add the route in Proxmox, I’m able to ping it from Proxmox correctly.

The test

pve$ ip addr add 10.16.1.254/24 dev myvnet1

pve$ ping 10.16.1.1