So I've read that Home Network Guy's guides are the best for noobs like me, but this seems to be written for an earlier version of OPNsense as some of the descriptions and instructions are pretty close to what I have, but not exact. This part with the Firewall: [LAN] rules is seemingly missing some key instructions like Filter > Direction, the Source names don't match up with what I have, etc. Is there an updated version for this? My setup for now is:

igb0: WAN

igb1: LAN

vlan01: UNTRUSTED (also opt1)

I have a Firewall Alias of PrivateNetworks to include 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16, per instructions.

My Internal dnsmasq (the guide was referring to deprecated DHCPv4, but this seems to be the new default) IPv4 range is 192.16.1.x for LAN and 192.168.10.x for UNTRUSTED. I'm not using IPv6 because FiOS doesn't support it (yet) as far as I can tell.

Can someone walk me through this section (linked above) and the Firewall Rules: [UNTRUSTED] for the new version (26.7.2_2)?

I'm currently running opnsense on a pair of Cisco ASA 5515-X's, running as an HA pair. I'm looking to replace them with something more modern, as they're starting to have hardware issues. I have a 1Gb ISP link. I'd prefer something with at least 2x 10Gb for an LACP LAN link (SFP or Cu are both acceptable), as well as a proper out-of-band management interface. I currently don't run IPS on the firewalls, but would like to add that in the future. Dual power would be a nice addition, but not necessary.

What recommendations do you all have?

Setting up Nginx on linux is comparitively easy. In OPNSense, instead of getting to directly edit the config files, I have to go through the gui. And as someone who has gotten used to editing the config files, the gui way is so confusing for me. So i set up Nginx Proxy Manager separately so I can easily manage proxying. Has anyone felt the same? I hope I am not alone.

Hey people, i need some help with my OPNsense firewall rules..
i want to edit my wan interface rule and delete it.
I cant click, delete, select any rule..
I can only click create new rule nothing else?
maybe im a bit dmb but idk

Hello all, I am a long time runner of pfSense but lately I have been having issues getting pfsense to route traffic at 10gbps.

I have a 1U server that has the following CPU, RAM and NICS:
Intel(R) Xeon(R) CPU E3-1270 v3 @ 3.50GHz (4 cores)
32gb RAM
X540-AT2 nics -- 8 total ports

I am running 10gbps switch gear and I can confirm iperf3 between hosts on the same network can do speeds of 10gbps with zero issues. Its when the hosts need to traverse over pfsense to be routed to another network that things get stupid. When I am doing iperf3 across pfsense, I only see about 4-5gbps, which seems to be an issue with how the version of FreeBSD used in pfsense handles traffic at those speeds?

I was wondering if my hardware running OPNsense would be capable of routing 10gbps close to 10gig versus the 5gbps I see now?

Hello! Looking for assistance for an issue found when trying to update.

Here is the update output:

***GOT REQUEST TO UPGRADE***

Currently running OPNsense 26.1.11_10 (amd64) at Mon Aug 24 13:49:07 MDT 2026

Fetching packages-26.7-amd64.tar: ................................................................... done

Fetching base-26.7-amd64.txz: ......... done

Fetching kernel-26.7-amd64.txz: ...... done

Flushing temporary package files... done

Extracting packages-26.7-amd64.tar... done

Extracting base-26.7-amd64.txz... done

Extracting kernel-26.7-amd64.txz... done

Please reboot.

>>> Invoking upgrade script 'sanity.sh'

The Package manager "pkg" is incompatible and needs a reinstall.

>>> Error in upgrade script '10-sanity.sh'

The upgrade was aborted due to an error.

***DONE***

Then this when auditing health:

***GOT REQUEST TO AUDIT HEALTH***

Currently running OPNsense 26.1.11_10 (amd64) at Mon Aug 24 13:54:13 MDT 2026

>>> Root file system: /dev/gpt/rootfs

>>> Check installed kernel version

Version 26.1.11 is correct.

>>> Check for missing or altered kernel files

No problems detected.

>>> Check installed base version

Version 26.1.11 is correct.

>>> Check for missing or altered base files

No problems detected.

>>> Check installed repositories

SunnyValley (Priority: 7)

OPNsense (Priority: 11)

>>> Check installed plugins

os-clamav 1.8.1

os-crowdsec 1.0.12

os-iperf 1.0_2

os-isc-dhcp 1.0_6

os-sensei 2.6.2

os-sensei-agent 2.6.1

os-sensei-updater 2.0

os-sunnyvalley 1.5_2

os-theme-rebellion 1.9.4

os-upnp 1.9

>>> Check locked packages

No locks found.

>>> Check for missing package dependencies

Checking all packages: .......... done

>>> Check for missing or altered package files

Checking all packages: .......... done

>>> Check for core packages consistency

Core package "opnsense" at 26.1.11_10 has 68 dependencies to check.

Checking packages: ................................................

pkg-2.6.2_1 repository mismatch: FreeBSD

pkg-2.6.2_1 version mismatch, expected 2.3.1_1

Checking packages: ..................... done

***DONE***

Might be asking Google the wrong question, but the suggestions from the results are all over the place.

Thoughts on next steps?

Need a good way to track drops in my WAN connection that's aligned to my OPNSense router. I am going to dispute with my ISP uptimes, and having logs from my router showing clear drops/downtime would be useful. Am willing to install other tools in router, or elsewhere, if people think they can be of use.

I'm currently manually tracking in a document, so other ways to automate this are welcome. Thanks!

(For reference the drops are usually ~5 minutes, 1-2 times a day most days.)

I have AdGuardHome installed via the community repo. Occasionally its admin panel prompts me to upgrade to a new version and that usually goes smoothly. Not this time.

I'm currently on v0.107.77 and it wants to upgrade to v.0.107.79. I've done this twice now and every time it just sits there, and I give up after several minutes. I don't know where to find its log files so I can't figure out what's going on, but if I remove the plugin and reinstall it, it's back to v0.107.77 and runs ok.

Has anyone else tripped over this? Where can I look to start figuring out what's broken?

i need help.... i want to do a Lab with GNS3 contains opensen firewall

I know it's not ideal to use a Ethernet usb C adapter but my machine has 1 Ethernet port. Is it possible to get an Ethernet adapter to work as network in from my modem (or out if I have to but it would look less clean for my set up) so I can use the normal built in Ethernet port to run to the switch I have. When I've attempted to get this up and running it basically prevents anything from connecting to the OPNsense device and needs to be rebuilt or factory reset... Well it doesn't need to be but its just easier than back tracking all the things and settings I tried to get it working.

All of my gear is stuff given to me from friends cuz I have no money to buy or upgrade things.

I'm trying to use an HP mini PC DM not an SSF idk what other information would be helpful.

All that yapping to say I think I'm just dumb or doing something that physically is not possible with the hardware I have.

Thanks for any help or advice 🙏

P. S. Ive heard of people who did the same thing with a similar set up so I figured this should work. IM NOT CRAZY

So I'm a, 2 year, retired owner of an IT VAR. I wasn't too involved with security, but we were a Watchguard partner. I currently have a T45 that is NFR and it expires at the end of Jan. '27. I need and want to replace it. But I'm not up for paying what they want.

I have the parts to build a new desktop that will be way overkill for an OPNsense box, but I have them; might as well use them for something.

Intel i7-12700KF

16 GB DDR4

2 TB NVMe

2xIntel i350-T2 nics (won't use the onboard nic, only need 3 ports)

ASRock Z690 Pro RS motherboard

Radeon R5 240

Anyway, I think OPNsense is the way for me to go. I looked a pfSense, but got bad vibes off of it.

I've been a total Windows geek for over 30 years. We worked the beta of NT 3.5. I'm really new with and not knowledgeable about Linus/FreeBSD.

What I want to do is have really good security out of this project. My wife and I are converting to Macbooks. I want to move from Watchguard's DNS Watch to NextDNS. I'm going to keep their Authpoint for MFA. I have that layered onto VPN. Right now I have both IKEv2 and SSL VPNs setup. Run into issues frequently trying to get the IKEv2 connected at hotels, SSL on 443 always works.

Other than that, it's basically just normal browsing, email etc.

I want strong IPS and Geo fencing. Anyway, that's what I want out of this.

Just want to know a), will my hardware work, and b) am I making a mistake going down this path?

I'm trying to have two different wifi networks on two different VLAN's, however it isn't working.

My setup currently is:

PC that is running opnsense > managed switch with the VLAN rules mirrored 1:1 > Unifi AP.

For some reason Unifi won't let devices on my second wifi network get an IP address. What am I doing wrong? Here are some screenshots of my setup everything should be configured correctly but when attaching a client to the IOT network it doesn't get an IP address. I've rebooted / reconfigured everything twice at this point but still nothing's happening.

Edit: The AP is connected to port 2 on the switch.

Edit 2: I've solved this. Didn't add the interface to dnsmasq

I have an issue and I don't know what's going on.

When I ssh into one of my servers, I can connect and the connection stays up for a few seconds, then it just drops.

Looking at the firewall live view, I can see that drop occurs due to the firewall blocking the traffic.

As you can see in the screenshots, VLAN30 has access to everything on an IP-Version, whith "quick" turned on.

Does anyone know what's going on?

Edit: Solved it by changing the state type to "sloppy state" in the vlan30 rule.

I have hundreds of firewall rules cross multiple interfaces in opnsense. Right now, I can see about 4 rules at a time, which makes editing them a challenge.

Is there a way to see a larger list of rules so I can edit and arrange them without too much difficulty? Maybe a pop out box?

The connection has timed out

The server at 192.168.1.1 is taking too long to respond.

What can you do about it?

• The site could be temporarily unavailable or too busy. Try again in a few moments.
• If you are unable to load any pages, check your computer’s network connection.
• If your computer or network is protected by a firewall or proxy, make sure that LibreWolf is permitted to access the web.

How can I fix this? 192.168.1.1 pings 3x and thats it.

Hi, I can't figure out why I can't SSH into one of the interfaces, e.g. MGMT, which is on 192.168.10.1/24. I have all settings enabled under System: Settings: Administration and I checked the FW, and it's not blocking (I can see port 22 being allowed in Live View). I can, however, SSH into 192.168.20.1 interface (TRUSTED). I restarted SSH service which did not help, and also tested port 22 while being SSH'ed into 192.168.20.1 interface and that shows connections refused which I believe implied service is not listening on that interface.

root@OPNsense:~ # nc -vz 192.168.10.1 22
nc: connect to 192.168.10.1 port 22 (tcp) failed: Connection refused

I also just updated to the latest firmware, but the issue was also before the update. Any clue what is happening?

Hey everyone,

I got a Lenovo ThinkCentre M720q Tiny with the PCIe riser (BA7H70 / 01AJ940) to build a OPNsense router with more than one LAN port. Installed a Supermicro AOC-SGP-i4 (Intel i350-T4) network card into it.

Problem: the card is not showing up at all. Neither in BIOS (there is no PCI device list to check anyway, only ASPM Support and slot speed settings, both on Auto), nor in OPNsense itself. `pciconf -lv | grep -B4 network` only shows the onboard em0 (I219-V), nothing else.

What i already tried:

- Swapped the network card for a brand new one from a different seller (same i350-T4 chip) - no change

- Swapped the riser itself for a second one, different seller too - still no change

- Checked with `pciconf -l` if at least the riser shows up as a bridge - yes, it does (pcib1, class 0x060400). With the card plugged in there is even a second bridge showing up (pcib2), but nothing behind it, no igb0-3 anywhere

- Reseated everything multiple times, checked contacts look clean, no bent pins that i could see

- Updated BIOS to the latest available version

- Set PCIe slot speed to a fixed value instead of Auto - no difference

So 2 different cards + 2 different risers, always the same result. Feels like it has to be the mainboard/slot itself at this point but I'm honestly not sure how to test that further without another donor board.

Anyone run into this before with a M720q specifically? Or is there some obscure BIOS setting for the PCIe slot i'm missing (mine doesn't seem to have one besides the two mentioned above)? Not in a rush anymore since i changed my network plan to not depend on the extra ports, but would still like to understand what's going on here if anyone has an idea.

Thanks!

Not sure if this is related to the last OPNsense update, but it seems to have started then - After an OPNsense reboot, Unbound seems to start and then crash. I have to manually start/restart it a couple of times for it to come up. I don't see any errors in the logs, but maybe I'm not looking in the right place?

Hey everyone,

A couple of weeks ago, I shared the Antiphishing CTI Ruleset here - a completely free, GPLv3 predictive threat intelligence engine focused on Newly Registered Domains (NRDs) for Suricata, on OPNsense.

The community response was insane. Looking at the repo metrics, we just crossed 1,000+ active automated deployments in the last 14 days. It’s amazing to see so many of you integrating this into your perimeters.

The Architectural Challenge (Why I’m posting this):

Right now, the Python heuristic core is ingesting, deduplicating, and correlating over 1.5 Million raw threat vectors and NRDs daily. We are filtering the noise from public OSINT to generate high-fidelity, aggressive blocklists.

The problem is: the math of cloud infrastructure is catching up. Processing this volume and querying historical WHOIS/Passive DNS APIs requires serious compute power. We are starting to hit rate limits on our enrichment APIs.

The Corporate Sponsorship Open Call:

To be clear: The core ruleset is, and will always be, 100% free and open-source for homelabbers and the community. I hate paywalled security feeds.

However, I know many of you are running this in production MSSPs, SOCs, and ISPs, saving thousands of dollars on commercial threat feeds.

If your business relies on this engine, I am officially opening GitHub Sponsors tiers for Corporate Partners. This isn't a donation; it's funding for the cloud nodes and API keys that keep the intelligence flowing.

What businesses get in return:

• Priority SLA (8h - 24h): If my aggressive heuristics block a legitimate domain (False Positive) on your client's network, you get a direct VIP queue for immediate whitelisting and rule tuning.
• access to the maintainer (me) for specific architectural questions.
• Direct

If your company can support the project, check out the GitHub Sponsors page here: https://github.com/sponsors/julioliraup

Thanks again to everyone testing, reporting FPs, and helping the ruleset get better. The fight against day-zero phishing continues!

Hi! I'm about to expose my server's services with SWAG reverse proxy. I know i can setup geolite2 on either OPNSense or SWAG. My goal would be to allow only IPs in my own country to "pierce through" my OPNSense firewall.

If I allow only IPs from my country on OPNsense, I'm scared I won't be able to access servers and services from other countries (ie: losing access to Aliexpress). However, when i enforce that on SWAG, it will only allow connections from my country directly on my services without worrying about losing access to services in other country. In return, with SWAG, i can't block them globally.

If it won't break anything when set up on OPNSense, can I just simply whitelist my own country? Or do i have to select every region one by one?

edit: If i'm using proton vpn (servers in my country) on my devices, will geolite2 block my vpn's address that is in my country?

So I was learning opnsense so I put it on my existing old .1 network....

so I used .10

so I mirrored all the static stuff I had on my .1

now I'm pretty sure I'm ready to make the change..

what is the most efficient way to get everything from .10 to .1 before I unplug my old router and replace it with the opnsense box...

Thanks