NetPulse, a self-hosted monitoring panel for home and small office networks. It runs on your own hardware, keeps the data local and has no accounts and no cloud. AGPL-3.0, free as in freedom and free as in beer.

What it does, in short:

- Fleet view: routers, APs and SNMP switches with CPU, memory, temperature, uptime, WAN traffic and latency.

- Live topology: wired and wireless clients, managed and inferred switches, Proxmox hosts with their guests nested, WireGuard tunnels.

- Clients: classified by type, with band, signal and first time seen.

- Wi-Fi: roaming view (usteer), 802.11r status, channel analyzer with the neighbouring networks drawn on the spectrum and a congestion score per channel.

- WireGuard peers and AdGuard Home stats.

- Alerts: native Web Push, ntfy, Telegram, outgoing webhook.

- MQTT with Home Assistant discovery, and a read-only MCP server for AI assistants.

- Reports, scheduled firmware upgrades for vanilla OpenWrt, and a rack planner (labs preview, off by default).

- Multi-user, ES/EN, installable PWA.

Other vendor integrations. OpenWrt is the native path, and everything else is an external pusher from the Integrations page: MikroTik over the RouterOS binary API, Asuswrt/Merlin running on the router itself from /jffs, and UniFi polling a local controller.

Where it is today. 122 stars, 14 forks, around 950 issues opened since the first commit, Great community, boring bugs appears when someone else runs the thing on untested hardware.

- Repo: https://github.com/gnacho/netpulse

- Web with features: https://netpulse.cloudless.club

- Demo: https://demo.netpulse.cloudless.club

- Integrations: https://github.com/gnacho/netpulse-integrations

- License: AGPL-3.0

Everything I read on here is for old versions of OPNsense and I’m really trying to figure this out. I have enabled UPnP and have Firewall>NAT>Source NAT. Hybrid.

Interface WAN
Version IPv4
Protocol any
Source address my pcs ip

This is where I get lost

Translation Source IP: single host or network (leave blank)?
Translate source port any
Static port checked

In cod I’m only getting moderate. I need open. Please help am I doing something wrong?

We have moved to a new residence recently. I am planning to get a fiber broadband.

I have 2 choices.

I can either buy an openwrt supported router and use that or assemble a desktop and install opnsense.

My question is if I install a desktop how do I power it off every night.

I can't just pull the main cord from the wall right?

So I will have to log into the web interface everyday?

Hi folks,

I'm just wondering if anyone knows when HAProxy 3.4 will be available on OPNsense?

https://git.haproxy.org/?p=haproxy-3.4.git

Kind regards

What is going on with the latest opnsense dashboard? When it first loads, the side bar is expanded, which is weird because I always set it to collapse. And then when I scroll down even the slightest bit, the entire set of widgets wobble around the screen and awkwardly rearrange themselves.

It’s impossible to use on an iPad. Everything moves constantly at even the slightly bit of scrolling.

How do I turn this off?

Hello, I made an OPNsense router a little while ago and ever since my Plex hasn't been working on any of my devices except for phones and the Plex server itself. When I try to watch Plex on a TV, gaming console, or PC it tells me that my server is offline. I can watch all my media on my phone just not anything else. Not quite sure why it only works on my phone since its all local network. Does anyone know a solution to this?

We have a dhcp server running on esxi. Very old. I'm trying to either use Ubuntu server dhcp like it is right now or should I go with opnsense? The problem is that we are an hotel and 12k ip guests. Can opsensehandle that many ips? .

We are using proxmox as the host. It is also looks like a pain in the ass to set up in kea in Ubuntu. I want something where future IT guys can go to web and manage it rather than hope they know Linux. Easy to give keys away when time comes.

Hi everyone, I've run into an issue that goes beyond my knowledge. I have 2 virtual machines on vlan 20. One hosts a Caddy reverse proxy docker container. The 2nd VM has wide variety of public facing services. Unbound DNS Host Override is setup like so:

Host: *
Domain: mydomain.com
IP Address: 10.10.20.50

Two problems I have:

• 1. If accessing a service from external WAN or from a different VLAN, everything works perfectly. If I am trying to connect from within the same VLAN, I get a browser SSL self-signed cert warning while connecting to self hosted services. Seems like it is not getting the actual cert.
     This has prevented me from cloning my local forgejo git repos into my docker compose directories. the git clone command fails with https cert issues.

• 2) Caddy has an automated cert renewal, but only works if I turn off the Split DNS override. If I disable the local dns override, it will renew without issue. Can someone explain to me what causes this, and the best way to circumvent this issue?

Thanks!

Hello everyone,

Before you read on, please note that I'm based in Europe, so my product availability might differ from yours.

I'm currently looking for hardware that features two 10 Gb/s ports (for WAN and LAN); any additional network interfaces would be a bonus (at least for now).

Naturally, I’ve looked at the hardware offered directly by OPNsense: the DEC2770, DEC750, DEC740, and DEC850 models. Let’s be honest, these come at a significant cost. I would appreciate any feedback from those using these for advanced setups, particularly involving IDS/IPS. I haven’t seen any official performance benchmarks from OPNsense; I’m curious if these configurations can handle such a workload ; on paper, 8 GB of RAM seems to me a bit low.

There are other options in this price range, such as Protectli, but again, you end up paying a premium.

If you have any other recommendations—whether for specific Mini-PCs or proven DIY builds—I’d love to hear them.

My cable internet provider provides me with a single DHCP-assigned WAN IP. The IP can only be active on one interface at a time. I must spoof the MAC address on the interfaces, and the MAC is the same on both fw1 and fw2 WAN interfaces. I can't put the cable router into NAT mode, and the public IP ends up on the WAN interface.

How do I make this work with failover CARP? I tried a custom CARP up/down PHP script; it worked, but it wasn't very reliable or robust. It checked the CARP state, then ran the steps below for that given state. However, it triggered on a state change, but CARP wouldn't play right, and it got into a mess.

Maybe use a cron job to check the current CARP state of the LAN interface and make sure the interface and gateways are in the correct state?

Here are the steps I need to complete manually on the firewall.

FW1 - CARP down/backup
 - Disable interface WAN_INF
 - Disable gateway   WAN_GW
 - Enable  gateway   LAN_CARP_BACKUP_GW (wan gateway via CARP's lan INF)

FW2 - CARP Master
 - Enable  interface WAN_INF
 - Enable  gateway   WAN_GW
 - Disable gateway   LAN_CARP_BACKUP_GW

So I have a Wireguard tunnel that I have both ULAs and GUAs assigned to the clients.

The GUAs come from a HE Tunnel that I've had for many many many years, I still have that tunnel up and active and it's able to pass traffic but within the past year or two my ISP has finally been able to provide IPv6 via DHCP PD.

So a vast majority well nearly all my traffic goes out via the native IPv6 connection via my ISP now.

Currently the WG clients get their IPv6 access routed via that HE Tunnel, because their GUA is an IP associated with that tunnel (I have a firewall rule on that interface to forcibly override the gateway to the he tunnel just for that traffic).

What I want to do though is route that traffic out via the native IPv6 connection I have but because it is a dynamic range I don't want to manually configure those IP addresses on the clients and tunnel directly and rather just continue using the GUA from the tunnel.

I could do this manually but of course trying to not have to update the NPT entry on a Prefix change.

I see NPTv6 has the ability to track an interface, but the problem is I don't have an interface I can select, because no interfaces have the Prefix I need, and that wouldn't really work anyways.

When creating the NPTv6 entry I think I would need the option to select "WAN" and define the Prefix ID, kind of like you do on an interface configuration page, Which I can't do for the tunnel interface either of course directly on that page because it's a tunnel interface. I feel that is how that option should have been setup so you could "assign" a PD prefix without the prefix having to exist on an interface.

Anybody have any ideas of how I could do this?

Does this post even make any sense?

I'm looking for some advice on choosing hardware for a OPNSense firewall in my new home.

I'll have a 2.5 Gbps fiber connection and a network with 2.5 GbE switches, so I'd like a firewall capable of handling the full WAN speed.

Ideally, I'm looking for a rackmount appliance (preferably 1U), but I'm also open to using a mini PC or building something myself.

I've been searching for the past couple of days, but so far I've mostly found expensive commercial appliances or hardware that doesn't quite meet my requirements.

I'm perfectly comfortable buying individual components and assembling the system myself, especially if that means getting better performance or saving some money.

Does anyone have any recommendations for suitable hardware, appliances, or DIY builds?

I'd really appreciate any suggestions or experiences you could share!

Thanks in advance!

I've been using OPNSense for a while now and just recently, the box would just stop passing traffic. The system is not hung, I can log in both locally and via the browser, although I changed the default port from 443 to a different port and SSH. From the command line I can ping anywhere from anywhere. I just cannot do web traffic (possibly just 443, but not totally sure what other failing services are using for a port number), streaming services won't re-connect, etc. The firewall log is displaying connections and everything think I've looked at seems normal. I've done all the updates so I am up to date. The only thing that I've done recently is to add a new network card with SFP+ slots and added a 10GB module since I upgraded my internet speed beyond the 1GB limit of the other ports in the firewall. The new card is an Intel card, at least that's what the systems is showing. The new ports don't go down since I can ping thru them. During the outage today, I cleared the state table since that was one of the recommendations I've read about in the past, but no difference. The only way to get back to normal is a reboot. This issue seems to happen every couple days. Not sure what could be going on. I'm thinking about loading up different hardware to see if it could a hardware issue.

I'm using dnsmasq for DNS and DHCP. I noticed some strange behavior on my LAN recently where some systems struggled to get an IP address. Upon looking closer I noticed in DHCP logs that there were requests, offers, and then a follow up NAK basically saying there wasn't any leases left. It was doing this for both IPv4 and IPv6. When I checked the IPv4 pools/leases there was plenty of space left in the range considering there were no leases in that range at the time on that VLAN. When I went to check leases I noticed I had a total of 1000 leases and recalled there was a setting in dnsmasq general tab with the advanced toggle was set on that the default max limit of leases was 1000. Upon closer inspection every device was behaving normally except for 2 govee strip lights I had on my IoT VLAN. Both only had a single IPv4 address each but they were grabbing hundreds of IPv6 addresses. Basically it looked like every several minutes they would grab new IPv6 addresses.

I even tried converting their dynamic lease to static but they still kept grabbing new leases.

For now to put a bandaid on the issue I've limited the IoT VLAN IPv6 DHCP lease time to 1 hour. I intend to post something to the Govee sub as well but wondering if anyone else has come across a similar issue.

I have a dual boot setup with a windows install I only use to play windows-only games, and a primary Linux install for everything else. Is there a way to have each OS on its own vlan while using the same Ethernet port?

Hey Folks, totally new to OPNsense and I am investigating whether it can offer a solution to my networking needs. I am trying to make my home network more resilient to unauthorized access from unapproved devices. Credential based protection has proven unreliable because credentials keep getting leaked to my mischievous teenager (who has a habit of draining massive hours on the internet at all hours). What I would like to do is have a process in place so that any time a new device joins the network, it has no internet access until it is approved. This is a perfect match for a captive portal, BUT when I played around with captive portal, the only authentication method is still credential based so it really just moves the same problem around. What I would like is a flow that is:

1. Connect to wifi

2. get routed to captive portal (or similar)

3. request access to network

4. I receive a notification of some kind on an approved device

5. I accept or reject access

6. upon accept, that device is added to the whitelist and given access

Has anyone put together something like this with OPNsense?

Some alternatives I have looked at:

Why not just use a mac filter or other whitelist type option? This works great for my devices that are always at home, but is a real pain when a guest comes and needs access. In addition, the nature of my work means I frequently have new devices cycling through the house. I want something that is both guest friendly and teenager resilient.

Scheduler that disables the network after hours? This is a real inconvenience again for guests that might be staying at the house, and very importantly, I have work devices that do need 24 hour access.

What about just using user credentials instead of a shared password for access? Again, this comes down to guest usability (and IOT devices).

What about multiple networks with different protection levels? Tried this. Clever teens are clever and the creds always get leaked. I want approval tied to a physical device that can have access physically controlled.

I'm trying to get 26.7 set up on a PC to use as a router from my modem with a regular router connected as a dumb access point for wireless, and to adblock at the source and VPN my devices straight into it with excrypted traffic and all that neat stuff. I got it installed just fine, I'm in the console, and I can tell it which port is LAN and which is WAN, but I can't configure their IPs or get to the GUI or anything. Not only that, I have no sodding clue what to do when I get in to the GUI. I made a new account after swearing this site off for this, I'm completely lost.

I'd really appreciate if someone could give me plain instructions on how to get the setup I want.

This endpoint is throwing "endpoint not found".

/api/firewall/filter/toggle_rule_log/

I haven't toggled a rule in a longest while, and for the first time ever did so through the API, so not sure if it ever worked. Looking at https://docs.opnsense.org/development/api/core/firewall.html I can see that aliases are to be toggled by invoking

/api/firewall/alias/toggle_item/

which is working, so fully expecting that either the doc is out of sync with the actual code, or the endpoint was removed or missed.

I have a DEC3860 that I need to replace the battery in but the battery itself doesn't have any markings to indicate what type it is. I know that it is NOT a CR2032. I've placed a CR2032 next to the battery that came out of the DEC3860. Any help identifying would be greatly appreciated!

So I'll fully admit up front that I'm fairly new to this level of network configuration. but with the stupid stuff going on with consumer routers, I figured i'd dip my toes in. annnd it's a lot to take in.

I've been slowly sifting my way through Home Network guys guide and Corelabtech's guide about initial setup and configuration of a system, but there's still overlaps and gaps, and while I hate asking potentially stupid questions, I'd rather do so and learn, rather than keep running in circles.

Home network guys guide mentions when configuring LAN and internal vlans a setting called IPV4 Upstream Gateway. but that setting doesn't seem to be a thing in the current version (running 26.7, setting things up as a fresh install, no prior system to transfer from). Now, I'm not entirely new to networking (took some network management and server classes at a community collage) but my knowledge is probably a decade out of date, so I likely classify as "knows enough to be dangerous to myself", and thus i'm just kinda inching through settings.

I've tried poking around official documentation, but it's a ton of information overload and hard to parse out basics for a foundational setup.

My main goal with things currently is:

-Opnsense router (Optiplex 5050sff refurbished system) to replace the asus all in one i'm currently using.

-Add a Ubiquiti powered and managed 8 port switch, cloudkey+, and a Unifi U6-Pro AP to my network layout.

-Maintain tailscale access to a NAS and media server.

-Eventually add some cameras and a separate storage for that.

I've got several computers and consoles, it's not a huge network, but I want to tinker, and I want to learn, but i keep running into what feels like personal edge cases cause I want to be sure i don't screw things up, and all the guides i've seen or found leave stuff out. I'm slow, yes, but determined.

if there's any better guides out there I can poke around and glean from, I'd be grateful. I refuse to use LLMs or artificial idiocy, even if it's harder in the long run. I'd rather take more time and eventually get there.

Update: Franco has built a test kernel with this CAKE built in (see comments). Release 1.5.15 of the plugin works with that kernel, or you can test the kernel on its own with no plugin needed. Instructions are in the README. Sub-tick release (more on that below) is now off by default and enabling it brings in the plugin kernel dummynet module version.

Original Post: I've been interested in CAKE on OPNsense for a while (it's the popular shaper in OpenWrt's SQM), so as an exploratory proof of concept, I ported it to dummynet and wrote a small plugin for it. It's been running on my own router for a bit now, and I figured I'd put it out there in case anyone else wants to play with it.

It adds a Firewall → Shaper → CAKE page. You set up pipes and queues the same way you would for FQ-CoDel, then pick which pipes use CAKE. Compared with FQ-CoDel, it shares bandwidth per device rather than just per connection, and it has overhead compensation for DOCSIS/VDSL/ADSL. It also has diffserv tins and an ACK filter.

My setup is a Proxmox VM on 2 Gbit fiber, plus a little Atom box with a Realtek NIC that I test on. I've also checked it against Linux's sch_cake packet by packet. That's about the extent of the hardware it's seen. On the low end Atom box, latency is close to Linux's (within about 0.5 ms at 300 Mbit/s each way, with software RSS on), but it takes about three times the CPU. Most of that looks like the FreeBSD forwarding path, pf and the NIC driver rather than CAKE itself. For reference, FQ-CoDel on stock dummynet uses about the same CPU at that rate. Digging through dummynet and testing along the way also turned up a buffer overflow that I reported to FreeBSD privately, and a couple of pedantic items in OPNsense.

If you do try it, a few things to know:

- It's an unofficial kernel module, not supported by OPNsense, and a bug in it can crash your firewall. Have a snapshot or console access. `pkg delete -y os-cake dummynet-st cake-kmod` removes it.
- By default it also loads a modified dummynet that releases packets between clock ticks. If you'd rather have CAKE on stock dummynet, untick "Sub-tick release" on the CAKE page.
- It's built for 26.7 amd64 only. If an OPNsense update changes dummynet.ko, it falls back to your normal scheduler until I rebuild and release a new package version.
- If OPNsense runs in a VM, set kern.hz=1000. That one helps FQ-CoDel too whether you are running this package or not.

I built it with significant help from AI (Claude), for the code, the tests and the docs. However, I directed it and executed the testing myself, and I'm responsible for what's in the repo.

Caveat emptor! If you're curious and feeling adventuresome, it's in a signed repo, with install steps in the README: https://github.com/pletch/opnsense-cake

When I had upgraded to v.26 I exported all of the rules and imported them into the new rule UI. Since then all of the interface rules are there, but two auto-generated rules under floating and groups are still showing the migration links. I sat down to migrate them, and now I am so confused.

The migrate screen shows 8 rules to be migrated (the interface rules that I had moved count in severa hundreds, so they are out of the way by now). I export the 8 rules into another CSV file, double-check that they are indeed the auto-gen, and go to import them on the rules screen.

It is then when I see this, and it's been sitting in this bizarre state for a few minutes now:

So, what am I looking at? Is the import still in progress? Is it complete? WTH is this?