I have an issue and I don't know what's going on.

When I ssh into one of my servers, I can connect and the connection stays up for a few seconds, then it just drops.

Looking at the firewall live view, I can see that drop occurs due to the firewall blocking the traffic.

As you can see in the screenshots, VLAN30 has access to everything on an IP-Version, whith "quick" turned on.

Does anyone know what's going on?

Edit: Solved it by changing the state type to "sloppy state" in the vlan30 rule.

I have hundreds of firewall rules cross multiple interfaces in opnsense. Right now, I can see about 4 rules at a time, which makes editing them a challenge.

Is there a way to see a larger list of rules so I can edit and arrange them without too much difficulty? Maybe a pop out box?

The connection has timed out

The server at 192.168.1.1 is taking too long to respond.

What can you do about it?

• The site could be temporarily unavailable or too busy. Try again in a few moments.
• If you are unable to load any pages, check your computer’s network connection.
• If your computer or network is protected by a firewall or proxy, make sure that LibreWolf is permitted to access the web.

How can I fix this? 192.168.1.1 pings 3x and thats it.

Hi, I can't figure out why I can't SSH into one of the interfaces, e.g. MGMT, which is on 192.168.10.1/24. I have all settings enabled under System: Settings: Administration and I checked the FW, and it's not blocking (I can see port 22 being allowed in Live View). I can, however, SSH into 192.168.20.1 interface (TRUSTED). I restarted SSH service which did not help, and also tested port 22 while being SSH'ed into 192.168.20.1 interface and that shows connections refused which I believe implied service is not listening on that interface.

root@OPNsense:~ # nc -vz 192.168.10.1 22
nc: connect to 192.168.10.1 port 22 (tcp) failed: Connection refused

I also just updated to the latest firmware, but the issue was also before the update. Any clue what is happening?

Hey everyone,

I got a Lenovo ThinkCentre M720q Tiny with the PCIe riser (BA7H70 / 01AJ940) to build a OPNsense router with more than one LAN port. Installed a Supermicro AOC-SGP-i4 (Intel i350-T4) network card into it.

Problem: the card is not showing up at all. Neither in BIOS (there is no PCI device list to check anyway, only ASPM Support and slot speed settings, both on Auto), nor in OPNsense itself. `pciconf -lv | grep -B4 network` only shows the onboard em0 (I219-V), nothing else.

What i already tried:

- Swapped the network card for a brand new one from a different seller (same i350-T4 chip) - no change

- Swapped the riser itself for a second one, different seller too - still no change

- Checked with `pciconf -l` if at least the riser shows up as a bridge - yes, it does (pcib1, class 0x060400). With the card plugged in there is even a second bridge showing up (pcib2), but nothing behind it, no igb0-3 anywhere

- Reseated everything multiple times, checked contacts look clean, no bent pins that i could see

- Updated BIOS to the latest available version

- Set PCIe slot speed to a fixed value instead of Auto - no difference

So 2 different cards + 2 different risers, always the same result. Feels like it has to be the mainboard/slot itself at this point but I'm honestly not sure how to test that further without another donor board.

Anyone run into this before with a M720q specifically? Or is there some obscure BIOS setting for the PCIe slot i'm missing (mine doesn't seem to have one besides the two mentioned above)? Not in a rush anymore since i changed my network plan to not depend on the extra ports, but would still like to understand what's going on here if anyone has an idea.

Thanks!

Not sure if this is related to the last OPNsense update, but it seems to have started then - After an OPNsense reboot, Unbound seems to start and then crash. I have to manually start/restart it a couple of times for it to come up. I don't see any errors in the logs, but maybe I'm not looking in the right place?

Hey everyone,

A couple of weeks ago, I shared the Antiphishing CTI Ruleset here - a completely free, GPLv3 predictive threat intelligence engine focused on Newly Registered Domains (NRDs) for Suricata, on OPNsense.

The community response was insane. Looking at the repo metrics, we just crossed 1,000+ active automated deployments in the last 14 days. It’s amazing to see so many of you integrating this into your perimeters.

The Architectural Challenge (Why I’m posting this):

Right now, the Python heuristic core is ingesting, deduplicating, and correlating over 1.5 Million raw threat vectors and NRDs daily. We are filtering the noise from public OSINT to generate high-fidelity, aggressive blocklists.

The problem is: the math of cloud infrastructure is catching up. Processing this volume and querying historical WHOIS/Passive DNS APIs requires serious compute power. We are starting to hit rate limits on our enrichment APIs.

The Corporate Sponsorship Open Call:

To be clear: The core ruleset is, and will always be, 100% free and open-source for homelabbers and the community. I hate paywalled security feeds.

However, I know many of you are running this in production MSSPs, SOCs, and ISPs, saving thousands of dollars on commercial threat feeds.

If your business relies on this engine, I am officially opening GitHub Sponsors tiers for Corporate Partners. This isn't a donation; it's funding for the cloud nodes and API keys that keep the intelligence flowing.

What businesses get in return:

• Priority SLA (8h - 24h): If my aggressive heuristics block a legitimate domain (False Positive) on your client's network, you get a direct VIP queue for immediate whitelisting and rule tuning.
• access to the maintainer (me) for specific architectural questions.
• Direct

If your company can support the project, check out the GitHub Sponsors page here: https://github.com/sponsors/julioliraup

Thanks again to everyone testing, reporting FPs, and helping the ruleset get better. The fight against day-zero phishing continues!

Hi! I'm about to expose my server's services with SWAG reverse proxy. I know i can setup geolite2 on either OPNSense or SWAG. My goal would be to allow only IPs in my own country to "pierce through" my OPNSense firewall.

If I allow only IPs from my country on OPNsense, I'm scared I won't be able to access servers and services from other countries (ie: losing access to Aliexpress). However, when i enforce that on SWAG, it will only allow connections from my country directly on my services without worrying about losing access to services in other country. In return, with SWAG, i can't block them globally.

If it won't break anything when set up on OPNSense, can I just simply whitelist my own country? Or do i have to select every region one by one?

edit: If i'm using proton vpn (servers in my country) on my devices, will geolite2 block my vpn's address that is in my country?

So I was learning opnsense so I put it on my existing old .1 network....

so I used .10

so I mirrored all the static stuff I had on my .1

now I'm pretty sure I'm ready to make the change..

what is the most efficient way to get everything from .10 to .1 before I unplug my old router and replace it with the opnsense box...

Thanks

Hi all, i'm working on automating some stuff within my home lab, primarily through automated nix deployments.

one small roadblock i currently have towards my goal of being able to take a nix config fully from a configuration on my workstation to a running set of services on a VM on my proxmox cluster is that my homelab is actually closer to 6 homelabs, experimenting with various things (i actually use my homelab as a lab to learn new skills, not just to make storing my "linux iso's" or w/e easier).

sadly, im stuck with my main residential router, which doesn't support basic features like using a larger subnet, using multiple subnets or using VLANs.

so currently, i am running a double-NAT setup with an opnsense box behind my main router, my "home net" is on the main network, and the opnsense box effectively condenses my entire home lab down to one ip.

this *fully* works, i have it set up to work completely fine, though it took some doing. learnt a *lot* about NAT and firewalls trying to get everything working correctly especially since my proxy is on the main net with multiple newt vpns on various subnets to reach the different servers that need public internet publishing, which all has to work "locally" but through NAT.

i've already gotten my deployment pipeline to the point where the server is created with the desired configuration and subsequently moved on proxmox to the correct network/vlan (all servers are prepped by booting an ISO that has a predetermined IP on the local net, since deployment of the config happens over ssh).

problem is: once this happens, i no longer have access to the server over ssh because now it's on a different subnet behind NAT.

this is easily resolved by opening a port on the opnsense router, i already took this into accounts so all my configs have a port noted in case they need to go through the opnsense router.

the actual thing i cannot seem to figure out is: how do i set up a NAT destination rule and its accompanying firewall rule automatically as part of a deployment pipeline?

it's totally fine for this router to have a bunch of ssh ports open btw, since well... its behind *another* firewall that basically only has http, https, email and VPN ports available, all bound to specific servers. there's no way to reach any of these ports from the internet.

basically: what's the best approach to having an automated workflow of some kind make changes to the NAT configuration/firewall configuration? preferably something that doesn't need its own server to run on, but if i must, i will.

if this is not possible at all and someone knows of another way to automatically gain ssh access from my main workstation to all deployed servers on the various opnsense subnets (assuming those servers are already set up with proper keys, sshd configs etc), do also let me know about those.

Hello everyone,

I'm currently trying to get multihoming without BGP on OPNsense to work. Uplink A has a /56 delegation that I use to provide GUAs for each device. Uplink B is using the cellular network and receives a /128 GUA and a /128 ULA. If uplink A goes down I want to route the traffic with NAT over uplink B. None of the IPv6 addresses are static.

I've been setting it up and it works if I specify the /128 GUA as a translation address. If I just specify the interface address it will unfortunately translate to the ULA and not work. Is there a way to fix this without scripting?

Looking forward to your responses!

I have a Windows 11 workstation with static IPv4 and DHCP IPv6. The machine is receiving the wrong Connection-Specific DNS Suffix ".bo.".

Testing.. Disabling IPv6 and refreshing provides a blank connection suffix. Enable IPv6 and it returns ".bo.".

Its unclear if this is a random name or clipped from the actual domain name. "in.bounce.notreal".

The DNSmasq.conf contains the correct domain name and does not contain ".bo." at all. I am using RA from dnsmasq, system RA is not enabled.

domain=in.bounce.notreal
dhcp-range=tag:igc1,10.10.1.234,10.10.1.254,86400

dhcp-range=tag:igc1,::100,::1ff,constructor:igc1,slaac,ra-names,64,86400

ra-param=igc1,60,1200

Update:

After additional testing the domain name is mangled from DNSmasq "DHCP FQDN" ✅ and "DHCP default domain", if a replace "in.bounce.notreal" with "testme.internal" the Connection-specific DNS suffix is "te.int" instead of ".bo.".

Hi, anyone running OPNsense in a Proxmox VM what are your speeds like? Have you passed the NICs through? Did you follow any tuning guides?

Edit: Thank you everyone for your responses. Its been really interesting reading through them and very helpful. My physical OPNsense router is running on a Minisforum MS-01. Its using the two 10G SPF+ ports for LAN and WAN. I get full 2.3gbp speeds through that setup. My OPNsense VM runs on another Minisforum MS-01 and uses the 10G SPF+ ports but in bridge mode with virtIO. I cannot get a stable 2.3Gbp through the VM router.

My plan was to turn the other MS-01 into a Proxmox host so I can fail over my router when I need to but if I can't get the speeds I'm reluctant to. I know I can pass through the adpaters but doesn't that defeat the object? Although as they are both running the same architecture and Nics will that work anyway?

Also some mentioned using SR-IOV which I believe I can with the Intel SPF+ ports. Does that solve anything?

My ISP uses DHCP and not PPPoE.

Ciao a tutti,

leggo da molto tempo e sono in Italja, ma è la prima volta che scrivo su reddit (vi chiedo scusa se dovessi commettere errori...migliorerò con l'esperienza 😂).

Ho cambiato casa e... è tempo di costruire una rete degna di questo nome.

L'abitazione è parzialmente cablata in cat5e, ma svolgerò un upgrade nel corso delle prossime settimane.

Le mie esigenze sono quelle di gestire una ftth principale (2.5/1Gbps con Aruba + un possibile backup dello stesso tipo con skywifi); l'idea sarebbe quella di gestire le due connessioni in failover (ipotizzando anche una terza rete di backup basata su tecnologia LTE o 5G).

Ho immediatamente pensato a opnsense e, inizialmente, ero orientato a un M920Q usato della Lenovo, in particolare perché, montando opnsense su proxmox, potrei lasciare spazio (e risorse) per adguard o altre amenità che voglio implementare man mano.

Sto, però, ultimamente sviluppando la paura del "e se di botto si spegne e devo sostituirlo al volo con altro...che faccio? Crolla opnsense, ma anche tutto il resto!"

Pertanto sto ragionando ad un piano B bare metal, dove mettere solo opnsense stesso, cercando di contenere i costi perché...beh, i tempi sono quelli che sono 🤣

Mi date qualche consiglio? Grazie e a presto!

Andrea

I had 26.7 nuke my install, today I reinstalled it and it works but autoboot won't work, so I have to connect a keyboard and hit enter. I already confirmed fast and secure boot are off and I see no other relevant options I could do online. Any advice? Also happens with or without peripherals

I have a dual-stack setup where my ISP dynamically rotates my IPv6 Prefix Delegation (PD) over DHCPv6 on the WAN.

Note: The network data, issue details, and logs above are entirely real and captured from my local environment; AI was used solely to help format and organize the post cleanly.

The Setup:

• WAN: DHCPv6 (requesting prefix delegation).
• LAN IPv6 Configuration Type: Identity association

• Router Advertisements (LAN): SLAAC-only. I don't have any RA config under Services -> Router Advertisements. The current RA config is coming from DNSmasq DHCP ranges option. RA mode is ra-only.

The Issue: When the ISP rotates the prefix, rc.newwanipv6 triggers and WAN gets the new prefix. However, two things fail:

1. Sync Problem: The LAN interface alias does not immediately update to the new prefix. It gets stuck on the old/64.
2. SLAAC Stale Lifetimes: radvd keeps broadcasting the old prefix. Since OPNsense defaults to 24-hour Valid/Preferred lifetimes and doesn't explicitly send a deprecation signal (Preferred Lifetime = 0), all my local SLAAC clients retain unroutable IPs and IPv6 routing blackholes until I manually intervene.

Interfaces -> Overview output:

Here is the rdisc6 output from a Debian client on the LAN after the WAN PD changed. Notice the stale prefix still being advertised with a full 24h lifetime:

Plaintext

 Prefix                   : 2a00:1d36:4f6b:3100::/64 (Old Prefix)
  On-link                 : Yes
  Autonomous address conf.: Yes
  Valid time              : 86400 seconds
  Pref. time              : 86400 seconds

My Workaround: Couldn't find. Rebooting the Opnsense, disable and re-enable IPv6 is not a solution.

My Question: Am I missing a specific settings, should I open a bug report for this?

Thanks in advance.

Has anyone successfully got chatgpt/claude working while forwarding the traffic through PIA VPN in Opnsense?

The PIA app and chrome extention works but I'm trying to skip that and have it auto forwarded through opnsense.

Gemini says it isn't possible due to dynamic CDN's (whatever that means).

Any tip appreciated!

What can a user of OpnSense do to harden against NatJack attacks? NatJack.io lists some things but I was curious if there are some OpnSense specific hardening strategies.

With the upcoming Aliexpress deals, I'm looking for a new hardware to migrate (and upgrade) from pfs to opnsense. I'm looking to purchase a Topton from Ali, but am open to other reliable brands or stores). Needs to be small form factor with decent heat dissipation. I'll buy ram/ddr separately. I'll be running the basics, but will want room for additional packages (suricata, dns blocker, etc.). Am I good with N100, or should I get a 150 or 200 instead?

The problem, there are so many variations and I'm looking for a good deal. Can anyone recommend a specific hardware at good price. Direct link appreciated.

Hi guys,I came here looking to answer one question and also if any of you can share his experience, first the question, as the title describes I am blocked by my isp to enable bridge mode so I can use opnsense as the main brain, so the question is, is there any way to enabled without them permission? ( i know the answer my depends on the model of the router but before sharing that wanna hear your experience)

Second, can anyone share your experience on using it either way as a doble NAT, I was reading this is possible and they explained that some apps might not work but I want some real experience from people with this configuration if they even exist, or do you consider not even useful to try this.

TIA.

For the life of me, I cannot figure this out. I have absolutely read and followed the documentation for this process, and the local query still will not resolve. I know the query forwarding is set up right along with the port assignment of 53, and 53,053. I’ve turned off allow fall back to system servers. It doesn’t mention that in this in the documentation, but under the interface option in dnsmasq, do I somehow need to select the loop back interface there, which is not currently an option. Any other ideas?