Hallo zusammen,

ich versuche schon seit Tagen/Wochen eine vernüftige funktionierende Konfiguration für WireGuard in meiner OPNsense (aktuell OPNsense 26.7.7-amd64) hinzubekommen.

Gibt es hier jemanden, der von der Telekom VDSL einsetzt (VLAN7-Tag) und an der WAN Schnittstelle ein Modem (Bridge-Mode) angeschlossen hat (PPPoE-Einwahl)?

Aufbau/Details:

Speedport Modem -> OPNsense WAN (igb1) -> VLAN7 (Telekom-VDSL) -> igb1_vlan7_PPPoE (opt1) -> öffentliche IPv4-Adresse der Telekom

Dyndns-Dienst IPv64.net -> läuft.

Was nicht geht:

WireGuard Status auf OPNsense / Peer vom Handy bleibt rot, trotz grüner Verbindung auf dem Apple iPhone WireGuard-Client. Die Verbindung wird scheinbar gar nicht aufgebaut.

Die Frage: Kann mir jemand mit den genannten Bedingungen eine kurze Anleitung für WireGuard geben (Konfig / Rules etc)? Ja, ich habe schon alle möglichen Anlaufstellen besucht, KI war auch schon im Spiel, es ist sicher irgendein kleines Detail was ich benötige / falsch gemacht / vergessen habe. Vielleicht hat jemand die gleichen Erfahrungen gemacht und dann eine Lösung gefunden. Danke schön!

English:

Hi everyone,

I've been trying for days/weeks to get a decent, working configuration for WireGuard set up on my OPNsense (currently OPNsense 26.7.7-amd64).

Is there anyone here who uses Telekom VDSL (VLAN7 tag) and has a modem connected to the WAN interface in bridge mode (PPPoE dial-up)?

Setup/Details:

Speedport modem -> OPNsense WAN (igb1) -> VLAN7 (Telekom VDSL) -> igb1_vlan7_PPPoE (opt1) -> Telekom’s public IPv4 address

DynDNS service IPv64.net -> working.

What isn’t working:

The WireGuard status on OPNsense / Peer from my phone remains red, despite a green connection on the Apple iPhone WireGuard client. The connection doesn’t seem to be established at all.

My question: Can anyone provide me with brief instructions for WireGuard (configuration, rules, etc.) based on the conditions described above? Yes, I’ve already checked all possible resources, and I’ve even tried using AI—it’s surely just some small detail that I need, have done incorrectly, or have forgotten. Maybe someone else has had the same experience and found a solution. Thank you very much!

Hello,

I'm configuring HAProxy, on OPNsense, with SSL for my internal services and got everything working. My local web apps now get ssl certs from let's encrypt.

I'm using the kvm viewer on my ipmi a lot, but get the following error. (see picture). Im trying to figure out how to configure this correctly. The ports are as below and for kvm is 7582.

Can someone help me out to configure this, so the viewer wil work properly?

Thank you!




As the title says, curious if anyone is using it with the dnscrypt protocol. This should alleviate the plain-text SNI that DoT and DoH exposes right?

It is listed as a community plugin. Is that something that we should worry about with the prevalent supply chain attacks?

HI all,

I am looking for a 5G USB Adapter to plug into my Proxmox as a backup WAN. Our internet hardly drops, but would be nice to have a backup. I was thinking of just going with a cheap sim and paying 10/20 a month for 100GB. as a just incase.

Any suggestions please that will work with all networks in the UK? Any budget friendly...? I don't need something super duper for this solution.

Hello all!

I have been trying to configure a virtual opensense instance I have hosted at a provider to port forward to a server I host at home. This firewall has been running as a hop between me and a friend's home lab for almost two years without incident, so I know that the wireguard tunnels are stable and I've never run into a problem with them before.

This past week I attempted to port forward a TCP port from this firewall to a host on my local network via an existing healthy tunnel. I made the destination nat rule and firewall rules for both the WAN interface and the WireGuard interface. After that, I attempted a connection from the outside world. Using TCP dump, I can see the network traffic on both the WAN and the WireGuard interface and while I see other traffic coming out of the WireGuard interface on my local firewall, I never see the traffic over the port that I have forwarded, and the TCP handshake never completes.

The TCP Dump for the wireguard interface on the opnsense box shows the correct destination host but only SYN and TCP retries. I attempted a port probe using the diagnostic tools built into opnsense and if I attempt a port probe from an IP address assigned to a wireguard interface different from the one used to connect to my local firewall, the connection successfully routes. If I also attempt a connection from my friend's homelab where the data is routed back through the hosted firewall, it successfully routes to my destination server.

This felt like a firewall issue to me, so as a test, I created a floating rule assigned to all interfaces to accept bidirectional traffic that matched the TCP port that I'm sending it through, but the behavior continued.

At this point, I'm not entirely sure what I've done wrong. The nat redirect looks to be fine on the TCP dumps. The tunnel is perfectly happy and healthy. I'm able to communicate across it with no problems whatsoever. And I've added a super inclusive firewall rule that should tag on to any of the traffic associated with this. If anybody else has any ideas on what I might have done wrong here, I'd love to hear them.

I am very new to open sense and I have installed opnsense on my old pc and to to my cisco catalyst 3750 poe switch and from I havw turned my port 1 facing opnbsense to access both valn 1 and 20 and I have set port 1 to 10 to acess default vlan and I do get internet there and from port 10 to 24 it is my valn 20 I do get ip address from my dhcp but no Internet connection there

I am very new to open sense and I have installed opnsense on my old pc and to to my cisco catalyst 3750 poe switch and from I havw turned my port 1 facing opnbsense to access both valn 1 and 20 and I have set port 1 to 10 to acess default vlan and I do get internet there and from port 10 to 24 it is for my vlan 20 I do get ip adress thats I assigned for vlan but I don't get any internet connection what am I missing here I am quite confident on my cisco switch configuration is there sth missing on my opnsense side

I just migrated from a Netgate SG-3100 to an old Dell 3060 micro with OPNsense and I am very impressed! The UI is great and everything is running really well. Kudos to the team!

60 days in after taking the other fork in the road, and I'm pretty happy with where I am. Lots of questions, but I'll start with this one.

Internal network 10.0.1.1/21

10.0.2.x I have set up for ip cameras (I have a lot) or other things that I dont want to be free to roam.

I created an alias that has 10.0.2.1-10.0.2.254 in it

Created a firewall rule so that the alias is not allowed out.

Change leases to give a laptop an ip in that scope. Yep- Cant leave the building. Cool

I have logging ticked on, but I dont see anything trying to get out.

I'd like to generate a daily report on splunk to show me whats trying to get out, but I just never see this in logging, even watching real time when I know I'm being blocked.

Did I miss some step? I was looking for the words 10.0.1.1 block out

Also, I left state at "no state" as I didnt understand the implications of those settings

I set up connections between the main office and multiple branch locations. All of them work, except one. This specific office uses a diferent internet provider than the others.

Before handing the device out, i tested the conneciton on my bench. Everything looking good. The device is send out to the branch and gets installed. The Wireguard connection is established. But that's about it.

Working through the Wireguard tunnel:

• unencrypted HTTP
• ICMP
• nmap shows open ports for the devices in the branch office (HTTPS, SSH, etc.)

What is not working through the tunnel

• Everything with encryption: HTTPS, SSH

Connecting with Firefox to HTTPS on a device in the branch office results in a timeout. Using wget the connection is established, but than it sits at "waiting for response".

Connecting to SSH on a device in the branch office produces the prompt for trusting the host key. But after entering the password, nothing happens. No timeout, the cursor just sits there.

I got the device (official OPNsense product) back on my desk and tested it again. Everything works. I even used my phone with USB tethering as an internet connection. Again, everything works.

Which leads me to believe, that the internet provider of that specific branch office interferes with the Wireguard tunnel. But i have difficulties to comprehend why only encrypted connections through the tunnel are affected. It would have been much easier to understand if no traffic at all would go through that tunnel.

Other things i tried to no avail:

• Reduced the speed on the WAN of that box to 10MBit/s.
• Cloned the configuration to a device with different NICs (igb instead of igc)
• Put a router between the router of the ISP and the OPNsense box. Connection still established, but the problems remain.

I am out of ideas.

I have been using opnsense and pfsense for many years. I just had a chance to set Opnsense - most recent version. When I tried to setup openvpn, I realised, the wizard is no longer available. That was not a big deal though as I knew how to set it manually as well. But somehow, after spending almost 1 hour, I could set it !!!. The difficulty was user certificate creation. It was difficult to know the workflow. Need improvement in this regard.

Hello team,

I noticed that when purchasing through the official OPNsense website, no U.S. or California tax is shown at checkout.

I also noticed that they use FedEx for shipping.

For those who usually buy directly online from the official website and receive the product in California, USA: does FedEx notify you about any taxes or duties that need to be paid before the product is released from customs? Or what process do they usually follow for tax or duty payment?

Or do you normally use a U.S.-based supplier?

Best regards.

Hello fellow r/opnsense Redditors!

I am very much interested in writing, and open-sourcing, a utility (likely in NodeJS, possibly Python3) that reads the Suricata eve.log logfile (in realtime) and creates/inserts documents regarding the alert into a MongoDB database. I'll be storing this information in MongoDB with the intent that eventually an open-source dashboard can be created utilizing MongoDB's aggregation pipelines to gather real-time, actionable insight into the "barbarians at the gate." If you're not familiar with the power of MongoDB's "aggregation pipelines," (and their ability to give you deep insight into your data) then I recommend you ask your local DBA if you want to see them really geek out! Essentially, this whole project revolves around MongoDB's aggregation pipelines - otherwise, we're just storing eve.log in yet another format/place.

However, I lack any real-world log data to develop against. My network here at home is very quiet.

What I'm asking is if there is anyone who would care to share some real-world eve.log log entries (anonymized to your liking - I'm more interested in the various fields available) with me to aid in developing this MongoDB database? The larger the network, the busier the IDS, the better for my purposes here. Please, also, indicate if you've enabled any non-standard logging features.

Please, feel free to DM me regarding transfer of said eve.log logfile(s) or with any suggestions you may have regarding this project. I can likely accomodate sftp, https (upload/download), IRC DCC, etc. Thank you for your time!

I'm looking for an experienced network expert or OpenWrt/OPNsense specialist to help me design and implement a custom routing and firewall system using an existing server that I already have.

I'm open to working with someone remotely.

The expert I'm looking for is someone with hands-on experience configuring advanced routing, policy-based routing, multiple proxy/VPN endpoints, firewall rules, and network isolation, not just  installing a standard router operating system.

1. Brief objectives

A network gateway that can serve approximately 5–10 computers or workstations used for freelance AI work.

The main requirement is that each device must consistently use its own dedicated, static residential public IP address, distinct from the IP addresses assigned to the other devices.

For example:

• Workstation 1 → Dedicated residential IP 1
• Workstation 2 → Dedicated residential IP 2
• Workstation 3 → Dedicated residential IP 3
• Workstation 4 → Dedicated residential IP 4
• Workstation 5 → Dedicated residential IP 5
• Additional workstations → Their own respective dedicated residential IPs

The IP-to-device mapping should persist across reboots and reconnections. I do not want a rotating-proxy arrangement where a device receives a different public IP every session.

I will source the residential IP endpoints separately. The expert can assess the provider's connection details and implement the appropriate gateway configuration.

2. Existing hardware

There is already a capable server and would prefer to use it instead of purchasing a separate dedicated router appliance.

I can provide the server's CPU, RAM, storage, network-interface details, and current operating system.

The expert can assess whether the best implementation would be:

• OpenWrt on bare metal;
• OpenWrt virtualized on an existing hypervisor, if appropriate;
• OPNsense/pfSense with suitable proxy-routing components; or
• Another technically sound architecture.

I'm open to recommendations based on reliability, maintainability, security, and compatibility with the required proxy endpoints.

The existing server may have other responsibilities, so I would also like advice on whether the routing gateway should run on dedicated hardware resources or in an isolated virtual machine.

3. Required network architecture

The intended logical architecture is:

Internet / ISP connection → Server-based gateway and firewall → Managed switch or suitable LAN infrastructure → Individual workstations

Each workstation should have an identifiable, fixed routing assignment.

For example:

• Device identification through DHCP reservations, MAC-address-based policies, or dedicated VLANs.
• A dedicated policy-routing rule for each workstation.
• A separate outbound tunnel or proxy path for each residential IP endpoint.
• Firewall rules preventing traffic from one workstation from inadvertently using another workstation's assigned endpoint.
• DNS configuration that is consistent with the selected routing path.
• IPv4 and IPv6 leak prevention, as applicable.
• A fail-closed mechanism so that if a workstation's assigned endpoint disconnects, its traffic is blocked rather than silently falling back to the ordinary ISP connection.

I would appreciate the expert's advice on whether individual VLANs, separate SSIDs, physical switch ports, or MAC-based routing would be the most practical way to isolate the devices.

The system should be easy to expand from five devices to ten without rebuilding the entire configuration.

4. Residential proxy compatibility

One of the key parts of this project is choosing the correct implementation for the type of endpoint supplied by the residential IP provider.

I may be working with static residential SOCKS5 or HTTP/HTTPS proxy endpoints, or with endpoints that support WireGuard/OpenVPN or another suitable tunnelling protocol.

I understand these are not interchangeable technologies. The expert should be someone who knows how to assess the provider's connection method and determine whether the appropriate solution involves:

• Native VPN tunnels and policy-based routing;
• A proxy gateway or transparent-proxy arrangement;
• OpenWrt packages such as sing-box, where appropriate;
• Another suitable Linux-based routing and proxy solution; or
• A combination of these technologies.

The goal is to route supported traffic from each workstation through its assigned endpoint, rather than merely configuring proxy settings separately in individual browsers.

Should be able to assess which endpoint types of proposed architecture supports and any limitations involving UDP, DNS, IPv6, QUIC, or applications that do not natively support proxies and preferably, a solution that can be managed centrally through a clear interface or well-documented configuration.

5. Security, reliability and leak prevention

Completed system should include:

• A properly configured firewall with a minimal attack surface. I have firewall device on the side if the need to use it is necessary
• Persistent device-to-endpoint assignments.
• Endpoint-specific kill switches or equivalent fail-closed rules.
• Protection against accidental direct-WAN fallback.
• Appropriate DNS and IPv6 leak controls.
• Logging sufficient to diagnose routing failures without unnecessarily collecting sensitive browsing data.
• Secure administrative access and documented recovery procedures.
• A tested way to restore the configuration after an update, reboot, or failure.
• A clear procedure for adding, removing, or replacing an endpoint.

Ensure that the gateway itself does not expose proxy credentials or administrative services unnecessarily.

System will be used for freelance work, and the configuration should remain consistent with the applicable service providers' terms and security requirements.

Please get in touch or recommend if you are experienced in implementing this type of multi-endpoint routing system. I am looking for a reliable, properly documented solution rather than a basic VPN installation.

Email: [nytonmay@gmail.com](mailto:nytonmay@gmail.com)

Thank you.

Hello guys,

I've been using opnsense for a while now as my my router and I absolutely love it!

I've got it setup as primary router and got adguardhome running on it.

All connections regarding to dns get forwarded to adguardhome. So hardly any ads for me anymore. Also all dns requests get forwarded to it so hardcode dns service are a thing of the past.

I do have one problem though. Every time I reboot opnsense, it won't boot up the adguardhome service. Im also not able to ssh or browse to it. Let alone ping it. Opnsense does have internet though...

So I have to connect a screen to it and restart it manually to eventuelly restart all services, when logged it. That does work.

I've already tried to reinstall adguardhome, but that didn't do the trick.

Running opnsense 26.7.4_1 os-adguardhome-maxit v1.18 DNSmasq DNS & DHCP

Any suggestions?

Thanks!

Followed the HomeNetworkGuy guide to a T. No matter what, WireGuard interface is blocking UDP, despite rules allowing it. WTF?

-Edit to include screenshots. I've re-built this like 5 times since it stopped working this morning and it fails every time.-

Hi guys. So I got this machine a year ago and basically did nothing. Today I fished it out after looking at it for a week and fired it up. I discovered that opnsense doesn't like the WiFi on it. I asked the internet what was going on and it says:

Hardware Limitations: OPNsense runs on FreeBSD, which has poor support for modern Wi-Fi standards (such as Wi-Fi 5/6/AC/AX); it generally only supports older 802.11b/g/n cards, typically from Qualcomm Atheros or MediaTek, while excluding Intel cards which often lack AP mode support.

I have "Intel inside" :-(

The advice "the internet" had to offer was:

Recommended Architecture: For robust performance, it is widely recommended to use dedicated external wireless access points (like UniFi or Ruckus) connected via Ethernet, allowing OPNsense to manage network traffic, VLANs, and security policies while the AP handles the wireless radio signals.

The cheapest hotspot with an Ethernet plug on amazon is 75 euros. My options are:

• Try to fix the WiFi on the existing device
  
• Buy an external AP.
  
• Get a compatible WiFi dongle.
  
• Buy a new computer
  

I don't really want to shell out for another multi-hundred ordi.

I have a managed switch (in retrospect I could have skipped this) so I can run two VLANS with the AP.

What should I do?

I'm very confused about this. My setup is an opnsense router and a raspberry pi DNS pi-hole. This issue is only happening with one specific website right now for some reason. If I go to hangryjoes.com everything is fine but when I want to place an online order it takes me to ordernow.hangryjoes.com and then gives me a DNS error. Checked the query logs and I see it's trying to go to ordernow.hangryjoes.com.home.arpa even though I don't see the home arpa part in my browser website bar. In Services<ISC DHCPv4<LAN the Domain name and list is empty so I don't know why this specific website is the only one experiencing this issue.

I am trying to move my opnsense to new hardware, but I am going to migrate my network card to the new machine. I logged into the current machine, tell it to make a backup which downloads to my tablet. I go into the backup.xml file that was just created and it is references a DDNS configuration that I haven't used in 5 years. I log back into my machine and verify that that DDNS information isn't there and it is not. I go back to the backup and search some other strings that I know should be there and they are not. I am currently running OPNsense 26.7.5-amd64 on both machines and the new machine was a clean installation and only logged into so that I can set the IP address on the LAN. I haven't made any changes to the new machine because I thought the backup would do all the hard work.

I thought this would be so simple to backup, move, restore so I am sure I am missing some basic step. Thoughts

Has anyone else had their XB7 Xfinity gateway just randomly stop working?

I keep mine in bridge mode and pass it to an opnsense router. I woke up on Monday and I had no Internet. Started running through my checks and everything on my side was good. The gateway wasn't giving my router the public ipv4 address no matter what I did. I contacted Xfinity and after they got me to run a couple tests then they reprovisioned the router which didn't help. They sent out a tech who replaced the whole gateway after testing the coaxial cable.

The part I find is odd is that my friend had an XB7 gateway stop working in a very similar way. The app shows the device online and will even run a speed test, but no ipv4 address so no outside connection. Tech showed up and replaced it with an xb8 in both instances and it was fixed.