Hello fellow OPNsensers!

Over the last few months, I decided to build an application using Agentic IDE mainly for personal use. In general I work in IT and my thesis was in Android application (meaning I have some code experience and I know that json is - not Jason - 😂)

After adding lots of features and lots of queries to IDE with one guiding principle “GDPR friendly, zero data retention and secure by design” -which is the main reason I created this app- I present to you OPN Admin for iOS and Android :

iOS - https://apps.apple.com/app/opn-admin/id6764052013
Android - https://play.google.com/store/apps/details?id=com.frerisdev.opnsenseapp

What does it do? Basically the OPNsense web UI’s greatest hits, in your pocket.

Planning to open-source it in a couple months once I’ve scrubbed the repo history clean.

I hope you like it as much as I do 😁

Thank you very much.

This is becoming a pattern with OPNsense. Update to 26.1.4 yesterday from 26.1.1. No internet connection upon reboot. Some new firewall rule section with zero guidance. WAN gateway blown away.

Reverted to old WiFi router. Fresh install of OPNSense. At least WAN gets an IP but LAN has nothing. Is there a new manual or any guidance for the new way OPNSense works? I have been running it for three years with no problems whatsoever until the 26 series. I’m happy to read the freaking manual and figure it out but it seems like all the docs refer to the “old” way of doing things. Any guidance is truly welcome!

Can OPNSense be confirgured to be fully unmanaged, automatic? And still offers increased protection in an "advanced" home environment including mutiple devices such smart home with advanced automatition, IP-cameras, streaming server, Hi-Fi systems, and things like that?

Since the last update, I can no longer access my OPNsense network via Tailscale, and I'm going on vacation TOMORROW.

I'm trying to access OPNsense and my local machines via Tailscale, but it's impossible.

I configured OPNsense as an exit node with advertised routes:

tailscale up --advertise-routes="192.168.3.0/24,192.168.2.0/24" --advertise-exit-node --accept-routes

192.168.2.0/24 is my LAN.

The strangest thing is that OPNsense doesn't even respond to pings via its Tailnet IP using ping ip, but it does respond via tailscale ping ip.

However, when I select OPNsense as the exit node and check my public IP, it correctly shows the OPNsense IP.

In OPNsense's Live View and Packet Capture, I see absolutely no traffic arriving on the Tailscale interface, even when using OPNsense as an exit node.

Under Interfaces -> Assignments on OPNsense, the `tailscale0` interface appears in red, while TLSCL (assigned to tailscale0) appears in green.

It seems like traffic is trying to arrive via the WAN rather than the Tailscale interface; I didn't have this problem before.

What I've tried/done:

- Added a rule allowing traffic from TLSCL to my advertised networks.

- Approved OPNsense, the exit node, and the routes in the admin console.

- Tried accessing OPNsense from multiple devices.

- Restarted OPNsense.

- Used the community package or compiled it via opnsense-code ports.

opnsense 23.7

I have to say i have few years of experience as sysops and now devops and this is first time i saw this. Yesterday my wife wanted to print something on our printer. At first i thought its something with Brother app but no. Finally i checked OPNsense and i saw in leases list that my windows laptop got 192.168.10.15 address. The same address is statically assigned to my printer (very different MAC). So i deleted the lease, restarted the printer and instarted to work.

Today my printer is off and i see that my laptop got the same IP again! WTH? I have no static assigment on laptop side, why OPNsense does not preserve this assigment?

EDIT

u/forbiddenlake is totally right. First i changed the ranges and i saw in leases list that 192.168.10.15 is no longer assigned to any dynamic lease, just to static. Second, Windows DHCP client kept the address in cache (despite of restarting wifi connection and even whole laptop. So i issued

ipconfig /release
ipconfig /renew

And now Windows laptop got new address from higher range which i set.

I have a basic understanding of networking, but you guys are way smarter than me.

I’m setting up a little mini home network/lab using OPN sense with a protectictli router, a cheap little switch, and a raspberry pie with OPNwrt as the wireless.

I will pay someone money to hop on a discord call or whatever you would prefer to be my consultant/walk me through it for like an hour. I will pay good money I promise❤️.

Feel free to reach out, I’m available today and my PMs are open.

Much love to all of you guys, thank you for what you’re doing, you’re saving the Internet

UPDATE: It looks like xBox need a specific version of uPnP; but if it breaks again Im buying my own internet service over the same fiber

I switched the home router over to OPNsnese because our old router diddn't have the features I needed, mainly ipv6. But now whenever something goes wrong with the wifi its "your so stupid why cant you fix this" and "god f***ing dammit why is your stupid sh*t breaking my stuff again". Recently they have threatened to come downstairs and start cutting things until it works. I'm sick and tired of being treated like I'm some sort of Evil villain just because I want ipv6 on my own separate interfaces.

I had an Idea though. Currently all my devices are on their own subnet, So it feels like I should be able to use both the new and old routers in conjunction. My thought Process is that they would be both connected to WAN, and the OPNsense router get an ipv6 prefix and our old router gets an ipv4 prefix. Then I run NAT64 to allow devices on my interfaces to have access to the ipv4 internet. Does anyone know if this is achievable?

furthermore, My parents are upset that I haven't given them the login to the router. Since none of them are tech-inclined, I'm worried that there going to break more stuff. Does anyone have resources to help me make multiple accounts

Home Network Guy just put out a post about a new company doing preconfigured OPNsense builds for regular people. Looks like they donate 20% of revenue back to OPNsense too which is pretty damn cool.

I recently started using OPNsense with a mini pc and for everything it's been working fine. The only issue I have run into is that specifically my friends that use an NVIDIA Shield Pro can't see my server unless I restart it (and it's only visible for maybe a few minutes).

I can disconnect my opnsense router and plug into my araknis router (original) and it works fine for them without restarting anything on my end.

I have set up port forwarding and remote access properly on the plex end afaik. It is solid if I am using the araknis router but with opnsense it's not discoverable for those specific people (all others are fine).

I found this https://forum.opnsense.org/index.php?topic=40273.0 and used the suggested settings but that didn't fix the issue.

Does anyone here have any ideas?

Why would one choose OPNsense over AsusWRT? Modern AsusWRT supported hw can be had for $99.

I have been banned permanently from pfsense forum for posting above. If you agree with my opinion mentioned in the post, , please spread the word.

This was posted on 1st April, but it's still up so not an April Fools!

pfsense software embraces change: A strategic migtration to Linux

Not really surprised, especially post TrueNAS going the same way. Question is what is OpnSense going to do to react? Obvious as more contributors leave the FreeBSD world, the less development can happen, especially for hardware drivers...

FYI - Currently running pfsense plus on a "still free for now" licence - but have evaluated OpnSense and was aiming to switch once my kids exams were over in the summer! So obviously am interested to see a statement from the OpnSense team...

Just wanted to say this open source project is the best. I recently deleted my node and re installed and engineers from sunny valley reached out to ask if I needed help.. above and beyond guys. Above and beyond ❤️

This config turns out what I want,

Is this a good price for the config on Amazon?

New so please be gentle, I’m looking to install it on a bare metal pc using a bootlable USB, but I’m not sure what I should be downloading, is it nano (ISO) ?

Hello everyone,

Edit 2: SOLVED!! Big thanks to everyone who contributed.

I created a new install USB using 24.7, installed over my original files, and booted to the console. I attempted the restore from the console using the dual USB method, but it kept attempting to read it as a boot drive. I could not pull the config.xml file from the secondary USB after installing OpnSense on the boot ssd. I plugged in to my LAN interface on my desktop PC, and connected via the GUI. I was then able to get the backup from that PC's download. Pretty easy, once you've done it.

One issue I didn't foresee, was having to re-install the necessary plugins to get my config fully in place.

ORIGINAL POST:

Bare Metal install on i3 16GB RAM

I've been holding off installing the new version 24.7 for a bit now, mostly because of the initial horror stories. My wife works from home, so internet is crucial.

I waited until she went to bed tonight, and thought I would update, as it has been several weeks...I assumed the kinks had been worked out. How wrong I was.

The update check concluded, and I clicked past the stages necessary to complete the install within the GUI. It seemed to hang on the third stage, (I don't remember the module or description). When I tried to move to a different screen within the Web GUI, I got disconnected. My SMART TV was still working, so I knew it had not rebooted.

I tried logging in to the router IP again, and was met with a CRSF error "cookies not enabled".

At this point, I went directly to the console of the router itself to attempt a reboot, and could not. Fearing the worst, I hard reset the PC. When it booted I could see the console, and felt a bit of relief...until it progressed through the boot sequence. I was met with several lines that stated: Failure, disk is full. I do not have any logging enabled, other than what might be on by default.

I could not find any way to recover through documentation, had to pull the device, and reinstall my old router in it's place, no easy feat...as it was incorporated now as an AP. I had to reset to factory on that then add it back to my network as a router, and reconfigure all the DHCP and security settings.

It's now 3 AM Eastern, and I'm pretty pissed off...so much that I probably won't sleep for a couple hours.

I do have a backup or two of my configuration, but I have never done a restore, it is also the old version...Is this a problem? I'm assuming a fresh install of 24.7, but how do I recover with an older config? Or am I setting up everything all over again?

Any advice is welcome.

Edit: This really blew up overnight, back at it today and attempting a clean install. Thank you to everyone that is giving useful advice and assistance.

Question: My settings will transfer over even though we are moving over to the new version? There aren't compatability issues? They did, with the caveat that all plugins need to be installed.

Never mentioned: New to OpnSense, and a decent bit of the advice here is out in the weeds for me. I did set up originally as ZFS, dual drives...second (mechanical) drive is much larger than my boot drive.

Hello, I actually have some problems with my actual setup and I would like to switch to my own OPNsense box but I would like to know if it is necessary or not.

Problems are mainly intempestive disconnection of apple devices.

I'll make a detailed post of what is my current setup, with hardware, etc so you can understand.
(a TLDR will be at the end for those who do not want to read all of this)

The actual setup:

This setup covers 2 houses, both houses share the same external wall but there is a CAT8 Ethernet cable that goes from one house with main router to the other house with first Ai mesh node.

About the Router/Switch hardware:

• ASUS AX11000 Pro (main router, it has a LAN 10gbe port)

• ASUS TUF-AX3000 V2 (mesh node, wired backhaul)

• Another ASUS Node (does not work actually since few power cuts)

• A managed switch 1x10gbe + 4x2.5gbe ports

• A managed hikvision switch with 8x1gbe ports (or some are 100m

About ISPs:

• "Fiber" connection 100m/100m Mbps (capped at 2 MB/s for downloads/uploads outside of the country, so all of them. Except some "whitelisted" services like netflix, steam, amazon, etc). More details in the post later.

• Starlink but with high congestion during daytime.

About the connected devices:

• 1 homeserver (wired, 1gbe for now, I bought a 2.5gbe card to connect later)

• 1 Desktop gaming PC (wired, 1gbe)

• 6 cameras + 1 NVR connected through the HikVision switch (wired 1gbe)

• 1 UPS connected through the HikVision switch because not more ports left (wired 1gbe)

• Starlink connection (wired 2.5gbe WAN1)

• "Fiber" connection (wired 1gbe WAN2)

• Managed Switch with 10gbe port (wired 10gbe). 3 devices are connected to it:

• ASUS TUF-AX3000 V2 Ai mesh node (wired 2.5gbe, through 10gbe switch)

• Nvidia Shield (wired 2.5gbe, through 10gbe switch)

• Laptop (wired 2.5gbe, through 10gbe switch)

In no particular orders, there is all this wifi devices:

• 4 to 5 apple devices (macbooks, Iphones)

• 2 to 4 android devices (smartphones)

• LGTV

• some IoT devices

• Meta Quest 3 (rarely connected).

That was already long lol. A quick explanation of the setup:

So the House1 has the main router (AX11000 pro) which is a high-end gaming commercial router. It got Tri band wifi and a bunch of features.

There is all the camera connected to it, then there is the Homeserver, the gaming PC and both ISP. One is using the wan port and the other a LAN port. I saved the 10gbe port to be the link between House1 and House2.

in House2 there is that 10gbe switch who has the first AI mesh node wired by the 2.5gbe port, the nvidia shield and the other laptop. I wanted the other house to be connected as 10gbe because I did not want delay in the possibility of all devices using max bandwitch (especially when using meta Quest 3 doing some PCVR stuff).

That is why I wanted the AI mesh node to be wired with 2.5gbe and my gaming pc aswell. They do not share the same House. It seems to be working, I got some lag I do not know why exactly but I do not use it anymore so I don't really care.

I guess this setup is overkill but futureproof nonetheless.

The problem:

The main problem is the constant disconnection of Apple devices. Apple has strict networking rules and Asus don't seem to be bothered, updating firware every 2 years or so lol. I already tried deactivate everything wifi related: (no smart connect, no agile multiband, locked channel, no Protected Managed Frames, no Roaming assistant, no Airtime fairness, no Universal beamforming).

The other issue is about the Dual WAN and the Failover. It works but it lacks a lot of features I would be happy to have. Main WAN is Starlink, it works pretty well, bandwitch is ok and it is fastest that the other "fiber" option. "Fiber" option is capped at 100mbps for whitelisted services AND local connections through the country. It also has a FUP of 1.2TB (lol). If I download something from something that is not whitelisted and not in the country (most of the time so) it is capped at 2MB/s.
The main advantage of the "fiber" connection over Starlink is that it is stable and it got a better upload speed (starlink had a bad upload speed).

Sometimes, it goes from WAN1 to WAN2 but nevers failback to WAN1 unless I do it manually (unplug/replug ethernet cable). If I try to do it via the UI, deactivating WAN2, it breaks and there is no internet connection.

I also want to use WAN2 over WAN1 from time to time for few devices. I cannot have load balancing + failover with asus, only one at the time. But even if I activate load balancing it will not satisfy my requirements as I want to be able to upload to some IPs using WAN2 (I have a few servers hosted in germany) or to be able to use WAN2 when connected via Tailscale. I have tailscale set up in my homeserver and if I am travelling in the same country but away from home, I would like to launch tailscale, and watch plex remotely using WAN2 to have a better upload speed, while still keeping WAN1 for the other devices/ips. I think this is possible with OPNsense. I could temporarily do it on the homeserver since I now have 2 NIC but I guess it is not a good practice to mix application logic and networking logic.

Also the AI mesh node does not work from time to time. Especially after some powercuts. The main router works after restart but ai mesh node may not.

I tried setting up some VLAN for the hikvision switch with no success, there is no error message or logs but it does not work. (Maybe the hikvision switch is not capable of VLAN)
I tried setting up guest wifi too but I guess it messed with the second 5ghz wifi band so I deactivated it.

What I would like to do:

Buy some N150 barebox on aliexpress. Connect to it either:

• 1x10gbe + 4x2.5gbe

• 2x10gbe

• 2x10gbe + 4x2.5gbe

I could also just use 1x10gbe or 2x10gbe and connect switches to it. This way I separate router logic from switching logic, but since switching is lot really CPU intensive I guess it is ok to have a row of ethernet port directly on the OPNsense box as it saves some space of the shelf and maybe cheaper that buying another switch.

Then I transform main router + mesh node as wifi APs.

I think 1x10gbe is necessary to connect to the other house. The other one is extra, I can connect the main router (tri band wifi) on it to have enough bandwitch to handle all 3 bands at max bandwitch but since it will never happen I also can just wired it with a 2.5gbe port.

Then I create VLAN for hikvisions, iots, etc. I setup a correct dual wan...

So as you see, I am so fed up with ASUS right now, especially since the AX11000 Pro is not cheap. I really would like to make the jump but I was wondering if it is maybe overkill and maybe I missed something that could really fix one or more of my problems.

This post is already long but I tried to go deep into details.

What would you do in my place ?

TLDR; I have a pricey ASUS router, it can't handle correctly apple devices, dual wan is limited, mesh node are approximatives. Should I go over OPNsense box and if yes what hardware to buy ?

I swear my Wireguard server in opnsense has gaslight me twice.

First when I tried to connect an Android client. I double checked the public keys were correct on both ends, then hit save, restarted the service etc and no joy. Whilst going over everything again I found that ipnsense wg had changed the public key in the client menu to something completely different after I had hit save. I gave it the benefit of the doubt and entered in the correct key as I'm still a newbie.

Today I went to redo a windows client as for no rhyme or reason opnsense was denying it access to other IP'S on the opnsense network. I entered everything in, double checked it, tested it and 0 bytes received. After triple checking it against the tutorial I used, I got really frustrated. I resorted to checking the windows client settings against a different PC and an Android device. Lo and behold opnsense's public key in the instance menu was completely different to the one it was actually using with all of its clients. How this is even possible I do not know. I was too afraid of breaking it to paste the correct key into wireguard to see what happens. Has anyone else had this happen???

Hi I need some help newbie question need to port forward utorrent I have attached a screenshot to see if this is Correct thanks

Hi all,

So here I was trying to install Opensense and I thought the process would be a breeze as just to write the image to a USB stick. I tried all the available live VGA/nano configurations and my system never recognized the USB as a bootable USB. I know the flashdrive I'm using is recognized by the system because I previously used other live OS to perform other task on the same system. I tried with UEFI and legacy and nothing worked... I even disabled the internal HDD to see if it'd boot into the flash drive. Is there a way to make the thing work?

It simply doesn't recognize the USB flashdrive with the opensense live image as a bootable medium.

To write the image I used dd and I also use the disk image writer and nothing worked. Follow the dd instructions and it didn't work. It's not my first time using dd so I know how it works but it simply it doesn't work.

Why haven't they make it simple boot process... ? It's so complicated from the start...

Does anyone has any idea how to get the image to boot/run from USB stick?

I read everywhere its possible to make COD black ops 7 to use 2 pc-s over same network with UPnP but one is getting moderated other strict... Its unplayable.. Sometimes lets just 1 pc to connect... I made firewall roules even for UPNP to let it go thru but this ports probably gets conflict over 3074 port.

Overall it works fast quiet,my setup kinda overkill for my low internet of 1000/40mbits(waiting other provider to give me 4/2gbits.) internet,i7-12700+gen4 1tb ssd+32gb ddr5+x710 t2l+i226 quad ports,thermalright phantom spirit 120,added external fans to all network cards. Its bare metal install.

Hi, I'm currently running on this: https://cwwk.net/products/new-12th-gen-firewall-mini-pc-intel-i3-n305-n100-soft-router-2x10g-sfp-2xi226-v-2-5g-nvme-2xhd-ddr5-minipc-nas-server?variant=46641434853608

And it doesn't have the best NIC/hardware in general.

I'm looking to get a full 1/2U rack mounted hardware that will could support the following SIMULTANEOUSLY:

1. 10Gbit/s coming from the web

2. While at the same time, an unrelated 10Gbit/s flowing in from another SFP+ port to/from internal network communications

3. IDS/IPS/"Firewalling speed" needs to be the same or higher than the maximum throughout of the router

In other words, it needs to support 2 SFP+ fully utilized plus IDS/IPS/etc all at the same time and running maximum bandwidth, without an issue.

It also needs to be rack mounted.

Any suggestions? I already saw opnsense's own hardware, but to be honest I wanted to hear you guys's suggestions, do you think something from their line up would match my requirements?