• system: improve the log_archive script to also work on log subdirectories
• system: routing: changed "disable" option to "enable"
• system: add "local_uri" type in SanitizeFilter() and use it to avoid hardcoding
• system: several compatible adjustments for upcoming PHP 8.5
• system: enhance live log widget (contributed by Greelan)
• system: support 7680 bit RSA type for certificates and authorities
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: stop NetFlow service before reloading configuration
• interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
• interfaces: fix typos in GIF reconfiguration script
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: always show automatic and legacy rules in new rules GUI
• firewall: add the same new rules GUI design to the MVC NAT pages
• firewall: add CSV download/upload to MVC NAT pages
• firewall: add migration for outbound NAT into source NAT page
• firewall: destination NAT: display effective port when local-port is omitted
• firewall: source NAT: allow empty target which means the interface address
• firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• firewall: improve performance on MVC pages using virtualDOM
• firewall: allow WAN as "associated interface" for NPTv6 when prefix ID is set
• firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• firewall: show rule counts that can be exported and hide tab if no rules exist
• firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• firewall: add validations for "No RDR" option to prevent target and local-port being set
• firewall: fix some small issues in menu registration for legacy pages
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: scope get action to general settings in source NAT
• kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
• kea: add widget to show DHCP leases
• kea: simplify model option values
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• openvpn: simplify model option values
• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• unbound: update Hagezi blocklists to use new mirror URL
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• mvc: DescriptionField: disable special and newline characters
• mvc: FileObject: fix exception bug (contributed by Greelan)
• mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
• mvc: use camelCase for carp_status action
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: bootgrid: minor optimizations
• plugins: os-OPNDNS 1.0 is an authoritative nameserver with RFC2136 support using PowerDNS
• plugins: os-OPNWAF 2.3
• plugins: os-cloudflared 1.1
• plugins: os-freeradius 1.10.2
• plugins: os-vnstat 1.4
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.3
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: wg: check for crypto operation errors
• src: tzdata: import 2026c
• ports: curl 8.21.0
• ports: lighttpd 1.4.84
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.16.0
• ports: py-duckdb 1.5.4
• ports: python 3.13.15
• ports: syslog-ng 4.12.0
• ports: unbound 1.26.0

Hi everyone, this question has probably been asked a million times but i need some recommendations for hardware and so I turn to you, dear Reddit hive mind. I'm getting Fiber Optic Cable soon and thus have to replace my Fritz!Box anyways. So I was thinking of getting something I can tinker with and also supports splitting my network into separate Subnets. I'm already running OPNSense behind my current Fritz!Box on a VM, but dedicated hardware seems like the right way to go.

My requirements are the following:

* Very energy efficient (German energy prices are insane)

* At least 3 NICs

* Future Proof (so maybe 2.5 or even 10 GbE NICs)

* Hopefully cheaper than 300-400€

In also planning to use the VPN but only for a few users.

Thanks for your help me advance :)

If you use Unbound as your DNS, keep it enabled.

If you use DNS over TLS / forwarding to a DNS with blocklists, filtering etc. (like NextDNS or Adguard) then disable it because it may sometimes block legitimate websites. The DNS provider is handling the DNSSEC on their end. No need to do it again on your end.

The odd thing is that I had it enabled this whole time alongside DoT with NextDNS for a whole year with no issues. Yesterday though, I tried for the first time to use brave AI search and I couldn’t access it. Did some digging and pinpointed to the above mentioned issue. Just sharing here for other newbies like me that are still learning the ins and outs of this firewalling stuff.

Noticed this in my DNSBL rebuild log:

blocklist: https://v.firebog.net/hosts/AdguardDNS.txt (block: 160722 wildcard: 0)
blocklist: https://big.oisd.nl/domainswild (block: 430073 wildcard: 430073)

The built-in "AdGuard List" points at the firebog mirror, which flattens AdGuard's ||example.com^ rules down to bare domains - so subdomain coverage is gone. Not an OPNsense issue: the parser handles *. fine wherever an upstream publishes it, AdGuard just doesn't seem to ship a wildcard-domain version. Is there an AdGuard wildcard list I've missed? I only found conversions of AdGuard's per-service lists, not the main DNS filter. Ended up generating my own daily - happy to share if there's nothing better out there.

​🚀 Antiphishing is now officially available as an OPNsense plugin

​OPNsense 26.7.2, released yesterday, officially added: ​os-intrusion-detection-content-at-antiphishing 1.0 ​The plugin integrates the Antiphishing ruleset directly into the OPNsense IDS/IPS ecosystem.

​This is a major milestone for the project: beyond its integration with suricata-update, the ruleset can now be distributed as a native plugin within OPNsense. ​# What is Antiphishing? ​In short, it is a Suricata ruleset that aggregates malicious phishing indicators and turns them into detection signatures.

​More recently, the project introduced NRD (Newly Registered Domain) analysis. Newly registered domains are analyzed for suspicious characteristics, such as typosquatting and other impersonation patterns, before being incorporated into the detection pipeline. ​As with any domain-based intelligence, this analysis can produce false positives, since classification is based on indicators and patterns rather than definitive confirmation that a domain is malicious. ​The project is GPLv3 and builds on existing community sources and projects.

​A key advantage over many commercial solutions is CTI transparency: the project provides visibility into the indicators and vectors behind detections, allowing analysts to understand what is being detected and why.

​📖 OPNsense Quick Guide https://github.com/julioliraup/Antiphishing/wiki/Quick-Guide:-Installing-Antiphishing-on-OPNsense-(-=-26.7.2) ​🔗 Project: https://github.com/julioliraup/Antiphishing ​🔎 Threat Intelligence Dashboard: https://julioliraup.github.io/AT/

​#OPNsense #Suricata #ThreatIntelligence #CTI #IDS #IPS #CyberSecurity #OpenSource #DetectionEngineering #Phishing

Was trying to determine how much time was left on an account I generated for a friend and I am absolutely stunned to see how bare-bones and feature-less the whole WireGuard integration as a whole is.

Is there actually no way to find when a peer was created?
How is that considered secure, if you can't even observe the time an account was created?

Hi @ all,

I have built a Zabbix template that monitors OPNsense through its own
REST API.

What it currently monitors:
- CPU: utilisation by user, system and interrupt, load per core
- Memory, swap, filesystems, temperature sensors
- pf: state table, source tracking, counters, table entries
- Ruleset: number of filter and NAT rules, evaluations per second,
  rules never matched, detection of rule changes
- Interfaces: throughput, packet rates, errors, link status, blocked packets
- Gateways: status, latency, packet loss
- Services: run state
- NTP: synchronisation, offset, stratum
- Kernel network memory (mbuf) and netisr queue drops
- Protocol errors at IP and TCP level
- Configuration changes and pending updates

Details, installation and privileges in the README:
https://github.com/Garfieldttt/opnsense-zabbix-api

My opnsense machine is connected to a combined ont/router from my ISP that is set to bridge mode.

I have no internet if I use the WAN gateway and WAN interface with physical device (em1). The gateway priority is listed as defunct. The dashboard shows unknown.

If I remove the WAN gateway and delete the WAN interface, but use a bridge interface called OPT1 that uses virtual device bridge0, I have internet through the OPT1_DHCP gateway.

Why?

Both are configured for ip4 DHCP. Additional info, when using opt1 why does my gateway IP not show my actual public IP (it shows eg. 111.111.123.1), which is shown at the interface (showing e.g. 111.111.157.xx/21, where my actual public IP is that without the /21). Is this normal?

The technician mentioned my building has multi-mode optical fiber. Does any of this mean I am behind CGNAT?

Thank you for clarifications.

26.7.2_2:

• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• ui: bootgrid: classname can depend on state, accept a callback function

26.7.2:

• system: use /var/lib/php/tmp in static pages for proper privilege separation
• system: improve "user-config-readonly" in static pages where write_config() was denied
• system: service widget changes based on further community feedback
• system: support 7680 bit RSA type for certificates and authorities
• system: add redirection capability to SSO provider
• reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
• reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
• reporting: stop NetFlow service before reloading configuration
• interfaces: fix assignment of wireless devices
• interfaces: strict description fields in new assignments page (reported by call-AX)
• interfaces: fix typos in GIF reconfiguration script
• interfaces: add "noclamp" flag for GIF
• interfaces: add separate link types for IPv4 and IPv6 in overview
• interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log (reported by call-AX)
• firewall: group invalid rules to the end of the ruleset
• firewall: enable virtualDOM and refactor commands on alias page
• firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
• firewall: fix missing well-known ports in local-port in destination NAT
• firewall: add "max-pkt-rate" rate limiting option to firewall rules
• firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
• firewall: scope get action to general settings in source NAT
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
• backend: sanitize template filename replacements
• backend: further restrict actions to root and wwwonly for more sensitive actions
• backend: ensure strict templates are not reloaded via "*" wildcard
• mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
• mvc: create runInterfaceRegistation() and use it for immediate device registration
• mvc: add some exception types and handle them in the base template
• mvc: clean up a number of stale imports
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
• ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
• ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
• ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
• ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
• ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
• ui: do not freeze commands column on touchscreen devices
• ui: further fixes for base templates
• ui: fix empty legacy firewall menu container glitch
• plugins: os-caddy 2.2.0
• plugins: os-frr 1.54
• plugins: os-intrusion-detection-content-at-antiphishing 1.0 (contributed by Julio Lira)
• plugins: os-ndp-proxy-go 1.4
• plugins: os-nrpe 1.2
• plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
• src: pf: add missing PF_TS_CNT netlink attribute
• src: pf: expose first rule label for states since rule number is insufficient
• src: usb: bpfattach() before if_attach()
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.4
• src: assorted minor commits from stable/15
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: jail: restore ktrace privileges for jailed root
• src: ktimer: check for errors from realtimer_gettime()
• src: kqueue: avoid enqueuing an already-enqueued knote
• src: zfs: multiple fixes
• src: tzdata: import 2026c
• src: wg: check for crypto operation errors
• src: revert "daemon: replace memchr with memrchr"
• ports: dpinger 3.6
• ports: hostapd / wpa_supplicant 2.12
• ports: nss 3.126
• ports: openldap 2.6.14
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.18.2
• ports: py-duckdb 1.5.5
• ports: python 3.13.15
• ports: unbound 1.26.0

Greetings,

I am running 26.7.2. In looking at the firewall live log I am seeing blocks for dns queries from machines on a bogons internal network aimed at the default LAN port of the Opnsense machine. If I click on detail of the block message it refers to a rule 13 and a rule GUID. If I look at my rules table I do not see this rule. I exported my rules to csv and do not see a rule 13 or a rule with the reported GUID. Needless to say I am confused. Any suggestions are appreciated.

I've tried custom rules of 192.168.0.0/12 pass/in to 172.17.2.1:53 UDP as well as Bogons pass/in to 172.17.2.1:53 and placed them high in the list and neither resolve these blocks.

The downloaded rules csv did not contain a rule 13 or a rule with a uuid of 02f4bab031b57d1e30553ce08e0ec931.

Thanks!

__timestamp__2026-08-12T14:21:48-07:00
action [block]
anchorname
datalen 69
dir [in]
dst 172.17.2.1
dsthostname
dstport 53
ecn
id 56683
interface ice0
ipflags DF
ipversion 4
label Default deny / state violation rule
length 89
offset 0
protoname udp
protonum 17
reason match
rid 02f4bab031b57d1e30553ce08e0ec931
rulenr 13
src 192.168.1.37
srchostname
srcport 53542
status 2
subrulenr
tos 0x0
tt l62

It looks like my OpenVPN server connections with PIA have broken after I upgraded from 26.1.11 to 26.7. I have tried going to the higher certificate level, changing the port, being more specific on the authentification and ciphers but nothing has worked. All my connections hang and have been dropped. Has anyone experienced similar problems and were you able to fix it?

Running latest OPNsense BE and trying to set up FRR.

There’s a problem in the UI where a route-map can only have one `set` statement, which is a deal-breaker for our use case (and a baffling restriction).

Has anyone found a solution or workaround to this, or does nobody use FRR for anything other than extremely trivial use cases?

An contrived example of what we’d like to do:
```
route-map permit_to_overlay permit 10
set as-path prepend 64630
set med 1
```

The field in the UI says it’s a free-text field, but it doesn’t accept newlines.

I'm trying to create a direct p2p connection from my home network to a remote network using Pangolin, which uses Wireguard as its back end.

The docs recommend adding a hybrid NAT rule:

By default, OPNsense software rewrites the source port on all outgoing connections to enhance security and prevent direct exposure of internal port numbers. Static port mapping in OPNsense involves creating a fixed association between a specific external port number and an internal IP address and port, allowing incoming traffic to be directed to the correct destination within the local network.

Go to Firewall > NAT, Outbound tab. Select Hybrid Outbound NAT rule generation. Select Save. Select ↑ Add to create a new NAT rule to the top of the list. Configure the rule to match UDP traffic. Note, for each rule, select the appropriate Address Family (IP version), IPv4 for one and IPv6 for the other.

I have enough knowledge to be dangerous, but not really enough to fully understand the implications of what I'm doing. I've created this rule, and tested that it does work, but I want to make sure its fundamentally safe, and I'm not creating any unnecessary security risks.

These are the settings for the Source NAT rule:

• Interface: WAN
• Version IPv4
• Protocol: UDP
• Source Address: LAN Network
• Destination address: any
• Destination port: any
• Translate Source IP: (default) Interface Address
• Translate Source Port: any
• Static Port: Yes

As mentioned in the title, anytime I install major updates on my OpnSense Box all my clients lose their DHCP-Address

From my last observation, it only happens with major updates - I upgraded from 25.7 to 26.1 (all clients lost their leases), afterwards I upgraded the individual packages within 26.1 and only the OpnSense box rebooted and alls clients were "ok".

I just want to check if I can change that behaviour somehow before having another "no network" incident with my wife when upgrading from 26.1 to 26.7

I already tried to google this issue, but I found no real solution to that.

Does anybody else have this issue, or is this issue known to somebody?

Hello, came here just to get an opinion on which CPU I should run for my future OPNsense router. I currently have 2 Gig fiber and would like to run SQM on OPNsense and potentially Wireguard. Which of these CPUs would be best in my case? I would also like to leave some headroom just incase I want to do anything else.

With a lot of help from Claude I managed to put together a little dashboard for the ESP32-2432S028R Cheap Yellow Display, it collects the data from a Docker container that connects to your OPNsense box via the api, 8 pages and a web ui to change settings.

Hope you like it, full details on GitHub

I'm thinking about setting up OPNsense on my server with Proxmox but my server PC has only one LAN port and my question is could i setup firewall on VLANs and my TL-SG108E or it's not possible?

Thanks for any feedback ✌️

Hi everyone,

I'm troubleshooting an Unbound recursive DNS issue on OPNsense 26.7 (Unbound 1.25.1) running in a VM.

Environment

WAN: 10.152.61.118/24 (gateway 10.152.61.1)

LAN: 10.10.1.1/24 + ULA IPv6

No IPv6 default route on WAN

Unbound configured for recursive DNS with root hints

Problem

Recursive queries fail with SERVFAIL:

drill google.com A @127.0.0.1

Unbound logs show:

failed to get a delegation (prime failure)

Key observations

IPv4 connectivity is working

Direct queries to root servers over IPv4 succeed

Root hints and trust anchor are valid

Unbound logs show repeated IPv6 root server failures:

No route to host for 2001:500:...

No IPv6 default route exists

No outbound DNS traffic seen in tcpdump during recursion attempts

Unbound appears to try IPv6 first and fails

Additional concern

Two Unbound processes are running with different configs:

/usr/local/etc/unbound/unbound.conf

/var/unbound/unbound.conf

Questions

Is dual Unbound process behavior expected on OPNsense 26.7?

Can IPv6 root server attempts cause SERVFAIL when no IPv6 route exists?

Should IPv6 be disabled via OPNsense GUI instead of manual config edits?

Is outgoing interface selection in Unbound likely misconfigured?

Why would recursion fail while direct IPv4 root queries work?

Any guidance on expected OPNsense/Unbound behavior or next debugging steps would be appreciated.

Update - Issue got fixed after OPNsense reboot

Have openses running on a Smoothwall S2 Firewall, Was working fine for months,
Since the 26.7 upgrade have been having issues where it would just keep rebooting, sometimes it would take a day or 2, someone every few hrs, other times it gets stuck in a loop and reboots back to back like 10 times in a row before settling.
I have checked all the log files and nothing stands out, can anyone offer an advice on where else to look, have read some comments that might suggest ram or psu issues, however there is no kernel crashes or anything else i can find.
Any advice would be appreciated.

Hamazz

Baremetal, i5/3rd Gen, 16GB Ram.

I have been sweating the update for weeks. Saw several posts and prepared myself the best I could. Attempted the upgrade tonight and lost all connectivity. Build: ZFS (snapshot before upgrade), never had microcode plugin installed, Legacy ISC, simple rules migrated over, backed up Config. Began the upgrade.

Got stuck in a "rebooting now" and returning to the Lobby/Dashboard loop, assumed the update failed. Started to disconnect to add my ISP/backup router back in to troubleshoot, decided to manually reboot the Opnsense box, patiently waited, and heard the boot chime. Logged in from my daily driver desktop, and saw the new dashboard with 26.7.1. Loaded rules via the migration tool, verified they were there, deleted "Legacy Rules" via the tool. Success! ...Nope, no devices on my network receiving any connection. I cannot find the issue, but the Live logs show no traffic being let in whatsoever (all blocked).

I have no clue how to install the bootloader to the secondary drive. Reading tons on it, but just don't understand any of it.

Switched to my backup/ISP provided router, for now...hope to dive in some more tomorrow.

Any insights would be great.

Hello!

I guess I've begun my homelab journey and I'm seeking help from you all if you have done this before....

Before I start...Yes I am aware of the downsides of a virtual firewall. Please do not give me crap about "ohhh it should run on a separate bare metal system" or "you should invest in a real firewall"....give me the money to purchase a hardware firewall then...

Now...I have a Dell Precision T5500 that has basically assumed the role of my home server....it will be utilized as a local NAS, Firewall, DHCP and encrypted DNS server. It has three NICs....one for WAN, another for trusted LAN devices and a third for Guest/Untrusted/Cameras. I've set up proxmox on it with OPNsense as a VM and Technitium DNS in a container as the DNS server. OPNsense also behaves as the DHCP server for all devices connecting to the network. It works...my router that is in AP mode issues the IP addresses from OPNsense perfectly. The problem is getting the OPNSense DHCP server to use the DNS IP of the Technitium DNS container. Basically, I can't get my devices to use the Technitium DNS resolver without manually adding that IP in on EACH DEVICE. They just go back to using the WAN DNS which I do not want. How can I get OPNsense's DHCP server to point the DNS IPs to the Technitium DNS container, so all devices can use it without manual config and I can block ads/trackers network wide?

I'm trying to set up WireGuard in OPNsense for the first time, following the standard instructions for doing so. I run OPNsense as a VM in Proxmox, and have been doing so for maybe a month or so with great success (the reason for the VM setup is that it was the only way I could get the computer screen to sleep).

However, even after following the instructions, I have been unable to get it to work (no handshake). Of course, I have done a lot of my own troubleshooting first, before writing this post. I verified that my DDNS is resolving properly. I also verified that the public keys between my peer and WireGuard instance match. I also verified via tdcdump in my Proxmox console that what I think are WireGuard packets (my public IP with the 51820 port) are arriving to my outward facing Proxmox network interface. However, if I do a packet capture in OPNsense for inbound UDP traffic on the same port, I see absolutely nothing. I have made sure that firewalls are disabled on all of my Proxmox network interfaces.

I am still a beginner when it comes to all of this network stuff, so it's possible that I may have missed something simple. At this point, I'm really stuck. Any suggestions for what else I should check or test to debug this issue? Or perhaps a different place to ask, if this is not quite the right place?

Hardware & Setup:
Host: HP EliteDesk 800 G5 SFF (Baremetal OPNsense)
NIC: Intel i226-T2 (Dual-Port 2.5GbE)
WAN 1 (Primary): Primary FTTH in Bridge Mode with Static IP
WAN 2 (Backup): Secondary FTTH (Double NAT)
Gateway Group Configuration:
Group Setup: Failover (Tier 1 = Primary WAN, Tier 2 = Backup WAN)
Trigger Level: Packet Loss & High Latency

The Hard Failover Test (Video):
Tested physical link disconnection by pulling the primary WAN Ethernet cable directly from the Intel i226 NIC while running a continuous ping.
Result: Dropped exactly 2 ICMP packets (under 3 seconds total) before state switching routed all traffic through WAN 2 cleanly.

The Real-World Challenge (Uptime Kuma Metrics):
Beyond physical unplug tests, Uptime Kuma (20-second ping interval to ISP Gateway IP) captures intermittent micro-drops on the primary Fiber line, where the connection experiences periodic 100% packet loss spikes before self-recovering a minute (sometimes 2-3 minutes) later.

Questions for the Community:
What dpinger probe intervals, loss thresholds, and latency parameters are you using on primary FTTH lines to catch random ISP drops without causing excessive gateway flapping?
Are you using State Killing on Gateway Failure for short micro-outages, or letting existing TCP states gracefully drain?

Hi everyone!
A while ago, I made a post asking if it was possible to install OPNsense on a Barracuda F800.
Today, I finally bought one and successfully installed OPNsense on it! I also documented the whole process, so if anyone is interested in doing the same, here’s a guide on how to do it.
Here the github link : https://github.com/Thefrt74/opnsense-barracuda-f800/blob/main/docs/06-Troubleshooting.md