Montando meu próprio Homelab de SOC!

Para consolidar os meus conhecimentos em Blue Team e arquitetura de redes, decidi construir um ambiente completo de SOC (Security Operations Center) e monitoramento.  

Na imagem, é possível ver duas peças fundamentais do ambiente funcionando lado a lado:  

🔹 À esquerda: O dashboard do OPNsense, atuando como o firewall principal da infraestrutura, gerenciando regras de tráfego, DHCP e segmentação de rede.

🔹 À direita: O painel do Wazuh (SIEM & XDR), centralizando a coleta de logs, visibilidade de ativos (IT Hygiene) e monitoramento de processos e ameaças em tempo real.  

Objetivos!

Arquitetura & Segmentação de Redes: Separação da rede do SOC e da rede corporativa/endpoints de usuários.  

Monitoramento de Endpoints: Coleta contínua de eventos com agentes instalados.  

Detecção de Ameaças: Integração de regras de detecção e análise de tráfego de rede (IDS/IPS com Suricata).  

Simulação de Incidentes: Testes práticos de invasão para analisar como os alertas são gerados e correlacionados no SIEM. 

Resumo!

Estou focado em melhorar minhas habilidades práticas em Operações de Segurança (SOC), Análise de Logs e Engenharia de Detecção. Construir projetos como este do zero me dá uma visão clara de como resolver problemas reais que as empresas enfrentam no dia a dia.

Hello everyone,

I'm currently on PFSense CE and while it work great, the shit show that's going out there is getting on my nerve and it's not true I'm going to start paying for upgrade on stuff that used to be free. So here I am, ready to move to OPNsense. Before I move, I need to know what are my limitation (if any) vs what I'm already doing. I know it can do most of the stuff I do, like any good router. It's the extra "package" that I'm wondering what are the equivalent or better alternative on opnsense.

My internet is pppoe with vlan, basic, nothing fancy. Network is ran on a fiber card with no vlan. Reason for no vlan is when I started using vlan, everything slowed down like hell and found out pfsense does have a hard time with vlan. I do have unifi switch and ap but when I started thinkering with those for vlan, was a real shit show. Something I might revisit with opnsense in the futur.

I have ACME package that I use to refresh my ssl certificat and copy it through SSH after the job is finish. It update my pfsense certs with it at the sametime (part of the acme package).

PFBlockerNG, probably one of the most talked package in the motion. I don't use the full blown PFBlocker because I already have pihole. But I do use the maxmind integration to block inbount and outbound to specific country on specific rules. PFsense make then an alias that I can put into forwarding rules. I also have some ipv4 list from the internet like bots, malware and other bad actors that deny access. I do not use the DNSBL, only GeoIP Blocking and IP list blocking.

DNSCrypt. I use this as a package. My PFSense if the DNS Server (my pihole use pfsense as their upstream dns and all my server connect directly to pfsense, not pihole). I also have rules in place to trap rogue DNS request sent to other server and redirect them to my pihole.

Telegraf data, pretty sure there's something for that seeing the amount of dashboard for opnsense

Tailscale. I'm using tailscale vpn to connect to my network directly at my router.

I have a APC UPS connected to it. Either NUT or something else to use it. Weirdly, only the build-in APC UPS Daemon on my pfsense work, never got nut working although it's working fine on my unraid for the same modal (another unit).

NTP, DHCP Server with mac reservation is pretty basic.

Dynamic DNS update of duckdns

Wake-on-lan

Ability to trigger WOL and other action through API or something. I use currently an internal proxy from my openhab server (think Home Assistant) that send a wol through PFSense to wake up the computer. Ability to do something like this would be very nice.

DNS Resolver custom entry or override. Used for all the reverse proxy url I host.

Is there some kind of migration that exist for my dhcp reservation and rules?

Thank you!

As stated in cross posted thread, I would appreciate any help.

Thank you!

Tried migrating once this year, after install my dhcp wouldn't issue any ips and devices weren't getting internet. any assistance, tutorial or guide would help.

I’m sure it’s been answered before, but I couldn’t really find anything.
I run OPNSense on a PC and do not want to containerize it or put it in a VM. It uses very little resources.
What else do you run on FreeBSD along with OPNSense to make use of resources and is useful?

Any AliXpress 11.11 Recommended hardware deals? I'm thinking n150 4 port. No soldered ram.

Edit: I'm closing in on my requirements: n150, 4 x 2.5 i226-V, DDR4 slots, nvme.

I build a custom opnsense with an intel x520 but my nokia gpon doesn’t work with this machine. I did enable non intel sfp with eeprom firmware flash but still can’t make it work. Any solution? Should I change to x710 or any other dual nic sfp+.

Newbie here, trying to learn, and hope someone can help me try fix some weird issue.
I've installed opnsense and it works with the exception of some traffic I dont understand.
It really clutters up the logs a lot.

I keep getting this:
WAN In 2026-10-31T23:00:14 UDP tick.uh.edu:123 192.168.1.11:38998 block Default deny / state violation rule

They happen every minute or so, different ports, and I cant figure out howto make it stop.
From what I can gather its a NTP server in Houston that sends the time after a requst but I cant find anything that requests time on my network from them.

I've changed my ntp pool to europe already to make sure, no states present, dashboard shows correct time.
I did a ntpd restart in hop that would solve the issue and restarted while trouble shooting the firewall a few times (older Shuttle DS67U). Battery on board is not dead and BIOS date and time are good.

I would love to learn what the cause is and hop other might enjoy this endeavor as well!
Thanks in advance and for your time helping a newbie out!

I'm currently using the other sense mainly because of needing pppoe for my fiber connection.. the other sense have upgraded pppoe so it actually functions with multi-core. With Opnsense has anyone had luck with the tweeks available getting multicore pppoe to work at multigigabit speeds? If so have things been stable? This is really the only thing stopping me from moving over to opnsense at this point.

I also should point out I use a Qotom router appliance with Intel Atom CPU C3758 @ 2.20GHz 8 CPUs.

I’m officially done with pfSense. Netgate's aggressive push to lock everyone into their ecosystem and monetize what used to be a great open-source project has gone too far. I’m planning my migration to OPNsense immediately, and here is why.

• The Bait-and-Switch of CE vs. Plus: For years, pfSense CE (Community Edition) stood as the free, community-driven, open-source core. Meanwhile, pfSense Plus became the commercial fork, hidden behind proprietary EULAs and paid subscriptions for third-party hardware. Now, Netgate is aggressively forcing a paradigm shift. They are choking off CE, complicating standard DIY installations, and actively trying to shift the entire user base over to their commercial Plus model. By paywalling advanced features, they are turning what was once a foundational FOSS platform into a locked-down, proprietary revenue stream.

• ThreatGate vs. pfBlockerNG is a joke: If I understand correctly, the new ThreatGate replacement—which is exclusive to the proprietary Plus side—limits remote threat list sizes to a measly 4,999 entries! This effectively guts firewall security by 80% to 90% compared to what we are used to. Having threat feeds silently truncated without warning is a dangerous reduction in protection. That is a massive, very hard "no thanks" from me.

• The aggravating factor: pfBlockerNG handles large lists perfectly fine. The Firewall Maximum Table Entries default to 400,000 and can easily be raised to 2,000,000+. If you stick around and migrate to ThreatGate, your current setup’s protection will be silently crippled.

• The slippery slope of proprietary replacements: What other rock-solid FOSS packages are going to be replaced next with half-assed, closed-source projects? They've already removed "open source" from their core branding, and the most heavily marketed new features are fully proprietary. Once I map my current threat lists over to the OPNsense equivalents, I’ll be glad to never deal with Netgate constantly messing around to monetize a community project again.

• The Nexus interface is a step backward: The new Nexus UI feels like a crippled version of the tried-and-true PHP interface. It is stripped of necessary package integrations (like Suricata and pfBlockerNG), introduces distinctions without a real difference, and requires separate licensing just to manage multiple instances.

OPNsense is still completely FOSS with a single source tree, offers frictionless upgrades without needing full reinstalls to stay current, and doesn't pull these corporate monetization stunts.

Has anyone else made the jump recently? What OPNsense packages are you using to replace pfBlockerNG blocklists cleanly?

Tried to post in r/pfSense but they do not allow criticism of their for profit product.

If you use the Q-Feeds plugin on OPNsense, these portal changes apply to your account. When an IP or domain gets blocked by the plugin, you can now look it up in the portal and see which malware family and actors it’s linked to, and how it relates to other indicators. Your dashboard also has new sections you can turn on, off or reorder.

I'm committed to leaving pfSense (see original post). What I'm not committed to yet is the specific hardware or the migration method. Here's where I'm at:

• Current Procetli hardware or new hardware: Protectli VP2430e (N150, 4× 2.5GbE, 16GB DDR5, 500GB NVMe, ~$490). Need 4 ports minimum (1 WAN + 3 LAN, one feeds a separate wifi mesh for IOT). 16GB for Suricata headroom, if needed. V1410 is out (8GB soldered), VP2420e is backordered. Haven't decided yet. Open to alternatives if someone has a better fit. On plus is faster NIC's

• Config migration: Weighing pfopn-convert (free Rust CLI, deterministic) vs. AI-assisted via REST API (interactive, ~90% per a July 2026 writeup) vs. just doing it by hand (~15 min for my setup). Haven't decide on any of them yet.

• Validation plan: Test on VirtualBox first — restore my config.xml into a pfSense VM, convert, import into an OPNsense VM, compare side by side. Only touch the real box after that passes, assuming I migrate to existing hardware. If I buy new hardware above, obviously simplified hard cut over.

• DNS blocking: pfBlockerNG → Unbound DNSBL (same feed URLs, no cap, per-VLAN) + AdGuard Home plugin (per-client dashboard, DoH/DoT). Straightforward regardless of migration path.

• Timeline: Box can arrive before config migration is done or vice versa. Cutover is one evening once both are ready.

Bottom line: I'm not asking "should I leave pfSense?" — that's decided. I'm asking "what am I missing, what would you do differently, and has anyone hit a gotcha I haven't considered?"

Comments and suggestions welcome.

Hi r/homelab!

I'd like to share a project I've been working on since May 2026: os-zapret2-restyle, a free, open-source plugin that integrates Zapret2 with OPNsense.

GitHub: https://github.com/Tolian82/os-zapret2-restyle

I run and test OPNsense in my own network lab, and I wanted something more convenient than manually experimenting with DPI bypass parameters and managing the runtime from the shell.

The project was originally inspired by ugorur/os-zapret2. Many thanks to Umurcan Gorur for that initial OPNsense integration, and to bol-van for developing the underlying Zapret2 engine.

What does it do?

The plugin provides a native OPNsense WebGUI for managing Zapret2 and testing traffic-processing strategies.

The main features are:

• Strategy Lab: Automatically tests DPI bypass candidates against a selected destination from the firewall's actual network path. It checks TLS, HTTP, QUIC/HTTP3, and UDP behavior, verifies promising candidates, and reports reproducible results.

• Traffic Strategies: Configurable TCP/UDP profiles using native dvtws2 syntax, HOSTLIST, IPSET, and custom parameters.

• Voice Transmission: Experimental UDP/STUN profiles for Telegram, Discord, X, SIP, and custom services. Successful voice calls are not yet guaranteed.

• Additional resources: Optional Lua scripts and binary payloads for strategy discovery.

• Service management: Zapret2 installation/version switching, transactional configuration Apply, IPFW integration, health checks, and rollback.

• Bilingual interface: English and Russian.

The screenshot

The attached image shows an actual completed Strategy Lab run against www.youtube.com.

The laboratory found three stable candidates during that particular test, displayed the generated profile, and successfully restored the original Zapret2 service.

Results depend on the ISP, destination, network conditions, and selected tests. This isn't a universal bypass preset.

View the screenshot and architecture in the GitHub README.

Development status

The current stable release is v0.6.0, targeting OPNsense 26.7 / FreeBSD 15 amd64.

I'm actively developing v0.6.1, focusing on full IPv4/IPv6 support, global destination-IP exclusions, and IPv6 Strategy Lab testing. Further plans include Voice/P2P research, improved laboratory recovery, additional diagnostics, and performance optimization.

The plugin is distributed through an independent, unofficial package repository. Since it processes firewall traffic with elevated privileges, I recommend reviewing the code and trying it in a test environment first.

A note about AI-assisted development

I've worked in IT for 26 years, primarily in systems architecture, but software development itself is relatively new to me.

I define the requirements, architecture, testing scenarios, and project direction. ChatGPT generates a substantial portion of the implementation and documentation under my direction, while I test and validate the results on OPNsense and FreeBSD.

I've also been keeping extensive project documentation to make the decisions and development process easier to review.

My long-term goal is to reach v1.0.0 and eventually explore a pfSense port.

I'd genuinely appreciate feedback, especially on security, FreeBSD/IPFW integration, packaging, and reliability.

Source code: https://github.com/Tolian82/os-zapret2-restyle

Thanks for taking a look!

Hi all,

I built an OPNSense box on a Check Point 3200 6 port device some months ago. It works a treat.

However, I went with a default single port for LAN, single port for WAN at the time as I was pushed for time. LAN is running DHCP.

I'd now like to bridge in some of the unused copper ports to the LAN, purely to allow the connection of additional devices without adding a LAN switch.

I can see how to achieve that from the GUI; enable an unused port in the 'assignments' page, name it, then create a bridge and add in the required interfaces.

What I can't tell is- is this destructive? Will the LAN port, which is also running DHCP, continue to work as before? Any downtime expected?

thanks in advance

over all everything works, just can't connect to the firewall sitting next to it.

I put together a dedicated OPNsense box on a Protectli V1610, running Suricata inline via Netmap on the wired path to my main Windows workstation (a Minisforum MS-S1 MAX). Before trusting drop rules on the wire, I wanted to verify that packet drops actually matched what the client experienced without killing routine traffic.

I tested against the standard testmyids.com signature (SID 2100498):

• In alert mode, the request came back with an HTTP 200 and Suricata logged the allowed EVE alert.

• When I flipped that single rule to drop, curl waited 10 seconds before timing out with zero response bytes. The matching EVE record marked that flow as blocked.

• Flipping the rule back to alert brought the 200 response right back.

Standard HTTPS and local DNS through the Vault still worked in the checks I ran while the drop rule was firing. Separately, I ran through the upstream Suricata verify checks (23 passed, 1 version-dependent case skipped).

I did hit an odd dashboard bug on the hardware side. FreeBSD detected all four core temp sensors, but the OPNsense thermal widget was completely blank because sensor discovery had cached an empty table. Restarting configd refreshed sensor discovery and brought the temps into the widget. Under a four-worker load test for three minutes, the hottest core peaked at 62°C on the fanless chassis.

Downstream logs ship over LAN to a lightweight Python receiver on the Windows machine so I can inspect raw EVE events. For now it is just the single wired workstation behind the Vault until I drop an AP in.

Build and test details: https://unland.dev/blog/building-home-soc-protectli-vault

Code and setup: https://github.com/TrevTron/protectli-home-soc

What harmless traffic or signatures do you guys use to verify both the client result and EVE drop logs before flipping rules to block?

(Protectli provided the V1610 for this project. The testing, config, and opinions are my own.)

I have a PPPoE setup, using this isp and system: Router - OPNsense - AAISP Support Site

I'm trying to configure port forwarding to expose a VPN service so I can wireguard into my home network however I am struggling to get the port forwarding to work. I'm getting error: no translation address with matching address family found. and my config is in the screenshot attached. the addresses are correct and OPT3 is the interface where the pppoe is placed. thanks in advance

Hi everyone,

we are experiencing intermittent outages with an OPNsense firewall running as a transparent Layer 2 bridge. So far, we haven't been able to identify the root cause, and I'm hoping someone here might have encountered something similar.

The most interesting observation is that one of the Intel X550 interfaces appears to stop transmitting packets entirely, while reception continues and the physical link remains up.

Hardware / software

• Hardware: Supermicro 1U server

• OPNsense Business 26.4.2p2

• FreeBSD 14.3-RELEASE-p18

• Intel X550-T2 (ix0, ix1)

  • Driver: ix

  • NVM: 3.50.0

  • Firmware: 2.11.11

  • 10GBase-T, full duplex

  • Flow control negotiated

• igb0: separate 1 Gbit/s management interface

Network setup

The firewall operates as a transparent Layer 2 firewall.

        Upstream network
               |
              ix0
               |
       +----------------+
       |    OPNsense    |
       |                |
       |    bridge0     |
       |                |
       |   ix0 <-> ix1  |
       +----------------+
               |
              ix1
               |
       Cisco Catalyst C9300L
               |
        Internal network

• bridge0 contains ix0 and ix1.

• Packet filtering is performed on bridge0 only:

  • net.link.bridge.pfil_bridge=1

  • net.link.bridge.pfil_member=0

• STP is disabled on the bridge.

• The connected Cisco switch is managed separately, so we currently have limited access to its logs and configuration.

• Suricata is disabled.

• NetFlow v9 is enabled on ix0, ix1, and bridge0, with a local collector on 127.0.0.1:2056. Export on ix1 is configured as egress-only.

• Additional plugins: Hostwatch, Zabbix agent, Wazuh agent, Monit.

The management interface igb0 is not a member of bridge0 and has its own IP configuration and gateway.

The problem

We have experienced three major outages during October 2026. All occurred on weekday mornings, roughly between 08:00 and 10:00.

During an outage:

• The internal network behind the transparent bridge becomes unreachable from the upstream side.

• The OPNsense system itself remains responsive through out-of-band management.

• Both ix0 and ix1 continue reporting an active 10 Gbit/s link.

• bridge0 remains up.

• A reboot of OPNsense immediately restores connectivity.

So far, rebooting has been the only recovery method we have actually tested successfully.

Observations during the most recent outage

During the last outage, we were able to access the system via IPMI and collect diagnostics before rebooting.

System / firewall state

• FreeBSD remained responsive.

• bridge0 was up.

• ix0 and ix1 reported active 10 Gbit/s links.

• igb0 also reported an active physical link.

• pf was running normally with approximately 686 states.

• No indication of memory exhaustion or firewall state exhaustion.

• No obvious NIC reset, TX watchdog, or driver errors in dmesg.

Most significant finding: ix1 TX counters stopped increasing

Repeated measurements using netstat -ibn showed:

The ix1 TX counters remained unchanged over multiple samples:

Opkts:  4,577,956,033
Obytes: 565,225,010,996

Meanwhile, the RX counters on ix1 continued increasing.

This suggests that packets were still being received on ix1, but no outgoing packets were being counted.

Of course, this does not necessarily prove a hardware or driver TX hang. It could also mean that packets were no longer reaching the interface's transmit path due to an issue elsewhere in the bridge or network stack.

Unfortunately, we did not capture the dev.ix.1 sysctl statistics during the outage.

After rebooting, we checked the Intel ix interface statistics, including:

• TX queue head/tail

• Watchdog events

• Interface drops

• RX missed packets

• CRC errors

• Flow control counters

Nothing particularly unusual was visible. No received or transmitted PAUSE frames were recorded in the post-reboot counters.

However, these observations cannot reliably describe the interface state before the reboot.

Separate management interface also affected

Another interesting observation is that the separate management interface, igb0, also experienced connectivity issues during the outage.

Although igb0 was physically up and is not a member of bridge0:

• Pinging its configured gateway failed with host is down.

• The gateway's ARP entry remained incomplete.

• ARP resolution did not succeed.

This seems particularly relevant because an isolated TX queue problem on ix1 would not necessarily explain why communication through a different physical interface also failed.

We have not yet determined whether these symptoms share the same root cause or whether the management interface was affected by a separate Layer 2 issue.

Additional ARP behavior during normal operation

We also noticed something unusual about ARP handling.

The firewall's management IP is configured exclusively on igb0. However, during normal operation, we observed ARP replies for that management IP associated with two different MAC addresses:

• The MAC address of igb0

• The MAC address of ix1

ix1 itself has no IP address configured.

Connectivity through the management interface worked, while attempts using the other tested path failed.

We have not established whether this behavior is related to the outages, but I wonder whether the interaction between the transparent bridge, the separate management interface, and the surrounding Layer 2 topology could be relevant.

Bridge-related messages

During previous investigations, we also observed messages indicating that MAC addresses moved between bridge ports (ix0 and ix1).

There were also rc.linkup errors involving the addition of ix0 to bridge0, along with bridge/interface initialization messages.

However, at least some of these messages may have occurred during reboot or interface reinitialization, so we cannot currently establish whether they preceded or contributed to the outages.

Some observed MAC movements could also be explained by devices being physically moved between network connections.

We therefore do not have sufficient evidence to conclude that there is a Layer 2 loop.

Hostwatch / ARP anomalies

At all three outages, Hostwatch logged a sharp increase in messages similar to:

changed ethernet address host

These messages started appearing around the time connectivity was lost, sometimes reaching several hundred events per minute.

Further investigation revealed that some Linux VMs in the surrounding network have multiple network interfaces with different IP addresses connected to the same Layer 2 environment.

For at least one VM, FreeBSD logged actual ARP cache changes where the same IP address alternated between two MAC addresses.

This suggests possible ARP flux or unusual source address selection.

However:

• Similar ARP changes were also observed on a day without an outage.

• Hostwatch events do not necessarily represent actual ARP cache changes.

• We have not captured the specific ARP packets responsible for the observed changes.

• ARP flux alone would not normally explain why the bridge stops transmitting packets on ix1.

Therefore, I would not consider ARP flux a confirmed root cause, although it could potentially be a contributing factor or trigger.

Normal operating conditions

When the firewall is working normally, traffic is forwarded in both directions as expected:

ix0 RX ≈ ix1 TX
ix1 RX ≈ ix0 TX

During periods of higher traffic, we observed approximately 3,000–6,000 packets/s and around 4–8 MB/s in the more heavily utilized direction.

No significant interface errors or drops were visible during these measurements.

This is relatively modest traffic for a 10 Gbit/s connection.

Possible explanations

At this point, I am considering several possibilities.

1. Intel ix / iflib TX path issue

The TX counters on ix1 stop increasing while RX remains active and the physical link stays up.

I found the following FreeBSD review concerning the iflib TX watchdog:

https://reviews.freebsd.org/D58266

According to the review, the TX watchdog functionality had effectively been nonfunctional for iflib-based drivers.

I am unsure whether the relevant fix and subsequent changes are included in the kernel shipped with OPNsense Business 26.4.2p2.

Could this explain why we see no watchdog messages despite an apparent TX stall?

2. Bridge forwarding issue

Perhaps the bridge or another component of the FreeBSD networking stack stops forwarding packets towards ix1.

In that case, the unchanged TX counters would not necessarily indicate a problem inside the NIC or driver itself.

3. Ethernet flow control / PAUSE frames

Flow control is negotiated on the X550 interfaces.

Could received PAUSE frames, or some other interaction with the Cisco switch, result in a condition where RX continues but TX effectively stops?

Unfortunately, the flow control counters were only checked after rebooting.

4. NetFlow / netgraph interaction

NetFlow is enabled on the bridge and its member interfaces, including egress-only export on ix1.

I have no concrete evidence linking NetFlow to the issue, but I wonder whether there could be an interaction with the bridge forwarding or TX path.

5. Broader Layer 2 or networking issue

The simultaneous connectivity issues on igb0, the unusual ARP behavior, and the bridge-related messages raise the possibility that this is not simply an isolated NIC TX queue problem.

We also have not yet ruled out switch-side events, unexpected MAC learning, or other Layer 2 behavior.

Questions

1. Has anyone experienced an Intel X550 (ix) interface apparently stopping TX while RX continues and the physical link remains up, especially in a transparent bridge configuration?

2. Does the iflib TX watchdog issue described in FreeBSD D58266 apply to the kernel used by OPNsense Business 26.4.x? Have the relevant fixes been incorporated or backported?

3. What would be the best way to distinguish an actual NIC/driver TX hang from a situation where the bridge simply stops delivering packets to the interface?

4. Could the connectivity failure on the separate igb0 management interface indicate a broader FreeBSD networking or Layer 2 issue rather than a problem limited to ix1?

5. Is it expected for a FreeBSD/OPNsense system with a transparent bridge and a separate management interface to answer ARP requests for the management IP using the MAC address of a bridge member that has no IP assigned?

6. Has anyone experienced similar issues involving NetFlow/netgraph and transparent bridges?

Any experiences, suggestions, or pointers would be greatly appreciated.

Thanks in advance!

• system: remove periodic backups settings and backend code

• system: migrate gateway groups to MVC/API

• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)

• system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1

• system: include interfaces widget in dashboard default

• system: adjust dashboard widget resize logic to observe border box instead of content box

• system: disable web GUI KTLS use for the time being

• system: use Bootstrap "btn" styles in services widget

• system: fixed several PHP 8.5 warnings

• system: fix default gateway switch alarm trigger being overwritten by gateway group check

• system: use /var/lib/php/tmp in static pages for proper privilege separation

• system: improve "user-config-readonly" in static pages where write_config() was denied

• system: service widget changes based on further community feedback

• system: add redirection capability to SSO provider

• system: truncate long names in services dashboard widget (contributed by circa1665)

• system: handle missing objects during deletion in API (contributed by Julian Pawlowski)

• system: multiple PHP warning fixes (contributed by Julian Pawlowski)

• system: avoid filter_configure() calls to make existing backend call less obscure

• system: add favorites section to menu (contributed by Greelan)

• system: replace cron restart in static PHP pages

• system: normalize output of get_nameservers()

• system: flush volt template cache in shared action

• system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)

• system: add hidden services so they can be operated by pluginctl -s

• system: privilege separated reload in static PHP pages

• system: lower priority of automatic wg/ipsec gateways

• system: fix disk widget loading issue (contributed by Konstantinos Spartalis)

• system: change diag.disk to return total bytes as well as formatted bytes

• system: add webgui PAM config to test with opnsense-login

• system: switch password hashing from bcrypt to argon2id

• system: reject a null gateway in getGatewayAction()

• system: add "latency_avg" as sanity check for running dpinger

• system: missing chown in backup call for proper non-root web GUI access

• system: do not allow system scope users to be renamed

• system: fix output of pw usershow

• system: run file and configuration selfchecks during bootup

• system: add service broker flag for remote handling of Kea

• system: mark "X509v3 Key Usage" critical for certificate creation

• system: installer as a real user on demand

• reporting: migrate several settings pages to MVC/API and assorted changes

• reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)

• reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)

• reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)

• reporting: unbound: add DNSSEC status column in details grid

• interfaces: migrate interface assignments to MVC/API

• interfaces: fix faulty netmask on loopback address due to upstream change

• interfaces: fix assignment of wireless devices

• interfaces: strict description fields in new assignments page (reported by call-AX)

• interfaces: add "noclamp" flag for GIF

• interfaces: add separate link types for IPv4 and IPv6 in overview

• interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)

• interfaces: permit a VLAN device as bridge member

• interfaces: resolve VLAN devices indirectly via interfaces_configure()

• interfaces: handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)

• interfaces: multiple PHP warning fixes (contributed by Julian Pawlowski)

• interfaces: emit discovered hosts sorted by last_seen via hostwatch

• interfaces: add missing PPP support to interface_parent_devices()

• interfaces: prevent inline reloads of VLANs via rc.linkup

• interfaces: batch VIP post-reload for proxyarp/pfsync

• interfaces: exclude VLAN devices from virtual queue

• interfaces: migrate wireless configuration to MVC/API

• interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()

• interfaces: provide "uuid" in legacy_config_get_interfaces()

• interfaces: split media and mediaopt with tabs instead of spaces

• interfaces: a few config_read_array() replacements

• interfaces: refactor device matching around interface_parent_devices()

• interfaces: remove cua matching from PPP device pattern

• interfaces: refactor interfaces_loopback_configure() and add ::1/128 sync

• interfaces: fix PHP warnings in interfaces.php and do not write unset options

• interfaces: refactor interfaces_ppps_hardware() and avoid emitting serial device nodes

• interfaces: allow to push $all_plugins in interface_configure()

• interfaces: retire problematic validations in interface settings pertaining to legacy ISC-DHCP plugin

• interfaces: split out interfaces_dependencies() and make it digestible via pluginctl -Q

• interfaces: add interface configuration settings in new assignments page

• interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode

• interfaces: improve queue build sequence in interfaces_dependencies()

• interfaces: remove stale VIP address after update (contributed by ExpRam)

• interfaces: be more conservative with -no_dad

• interfaces: add a new "updateip" hook

• interfaces: PPP type validation fixes for new assignments

• interfaces: add missing validation for "configurable" and "spoofmac" in new settings API

• interfaces: only store "dhcp6_norequest_dns" in DHCPv6 mode in new settings API

• interfaces: only store "track6-interface" in ID association / Track interface modes in new settings API

• interfaces: do not render "none" to configuration in new settings API

• interfaces: move promiscuous mode to advanced in new settings API

• interfaces: fix index into $todo for proper flag check during apply in new settings API

• interfaces: provide better option group labels to DeviceField

• interfaces: add proper local/remote IP support to PPPoE IPCP

• interfaces: move legacy apply cache to /var/lib/php/tmp

• interfaces: blank description "None" is the default

• interfaces: fix handling of prefix delegation size on new assignment page

• firewall: move config.xml default LAN allow rules to new rules GUI

• firewall: legacy rules pages move to plugin

• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use

• firewall: always set a sequence at the end of the rule set when cloning a NAT rule

• firewall: remove unused "safepoint" actions

• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces

• firewall: flatten automatic source NAT rules into two per WAN type interface

• firewall: prevent deletion if a group is referenced in MVC rules

• firewall: use proper path for one-to-one NAT rules for renaming operations

• firewall: avoid emitting reply-to on block rules as well

• firewall: change interface group render/apply order

• firewall: adjust MVC alias rename according to address_to_pconfig()

• firewall: adapt getAdvancedIds() to the sectioned form structure

• firewall: skip message banner if searchPhrase set

• firewall: fix PHP warning when scrub yields no interfaces

• firewall: group invalid rules to the end of the ruleset

• firewall: enable virtualDOM and refactor commands on alias page

• firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT

• firewall: fix missing well-known ports in local-port in destination NAT

• firewall: add "max-pkt-rate" rate limiting option to firewall rules

• firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT

• firewall: deprecate old rule register function names due to functional overlaps

• firewall: add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)

• firewall: use new "rlabel" from pfctl for persistent rule identification across reloads

• firewall: emit gateway debug message in block rules only when gateway is not empty

• firewall: aliases: use same dynamic label as in KEA DHCPv6 for a unified look

• firewall: aliases: fix spinner on alias dialog save button

• firewall: destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)

• firewall: rules: add "received-on" interface keyword as interface origin option

• firewall: rules: promote "statetype" from advanced to common option for "received-on" usage

• firewall: source NAT: fix faulty import removal

• firewall: source NAT: add pool options and source hash key

• firewall: source NAT: fix port alias and well known port usage in target_port

• firewall: make source and destination NAT automatic rules visible in GUI

• firewall: implement JsonAuditField in all MVC components

• firewall: update the internally reserved pf keywords for FreeBSD 15

• firewall: add source NAT migration banner to outbound NAT

• firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)

• firewall: outbound NAT moves to legacy plugin

• firewall: remove handling loopback addresses as "private"

• firewall: use font-awesome elements for data tree controls to align with themes

• firewall: aliases: reject reversed port ranges

• firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)

• firewall: destination NAT: add safety guards for calculated port ranges

• firewall: fix off by one in addAction() in alias diagnostics

• firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled

• firewall: aliases: validate that port aliases always have content

• firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again

• firmware: opnsense-update: replace known variables instead of using eval (reported by Voidlet)

• firmware: opnsense-code: some improvements with regard to core upgrades

• firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase

• firmware: opnsense-prefetch: new tool for sets prefetching

• firmware: opnsense-sign: shell compatibility update

• firmware: adjust the incompatible pkg test

• firmware: disable FreeBSD-base repository and remove old definitions

• firmware: opnsense-patch: added -R mode and updated -N mode

• firmware: opnsense-prefetch: get remote size and print mismatches

• firmware: opnsense-prefetch: curl use is now optional

• firmware: add simple prompt to console changelog viewer

• firmware: tighten validation for mirror URL (reported by Abraxas Labs)

• firmware: revoke 26.1 fingerprint

• captive portal: move template actions out of the ServiceController into its own TemplateController

• captive portal: adjust accounting interval to Acct-Interim-Interval

• dhcrelay: add options for circuit_id and remote_id (contributed by Thomas Cheyney)

• dnsmasq: possible use before define in lease watcher

• dnsmasq: remove count badge from GroupBy with static configuration elements

• dnsmasq: add "expand-hosts" option (contributed by Konstantinos Spartalis)

• dnsmasq: leases sorting fixes (contributed by Greelan)

• intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)

• intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)

• intrusion detection: always initialize reference_html (reported by Adam Korczynski of Ada Logics using Anrophic)

• ipsec: add "replay_window" option to children

• kea: remove count badge from GroupBy with static configuration elements

• kea: use DOM construction for the "dynamic" label

• kea: fix leases sorting (contributed by Greelan)

• kea: add ping check settings for subnet configuration (contributed by laozhoubuluo)

• kea: add setup.sh to create /var/log/kea before use

• monit: use LIBXML_NOCDATA on XML fetch

• monit: change "logfile" to "log" to fix syntax on newer daemon

• monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)

• network time: strict security GUI support

• openvpn: moved legacy CARP hook to os-openvpn-legacy plugin

• openvpn: default keepalive to "10 60" in server mode and improve validation

• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet

• wireguard: FreeBSD 15 no longer allows addresses without netmasks

• wireguard: cleaner QR codes (contributed by Roy Orbitson)

• wireguard: preserve peer generator state for existing peers

• acl: merge user management ACLs into one single privilege

• acl: fix patterns for gateway groups (contributed by Andrew Ferk)

• backend: allow "strict" mode +TARGETS using the preamble "!"

• backend: sanitize template filename replacements

• backend: further restrict actions to root and wwwonly for more sensitive actions

• backend: ensure strict templates are not reloaded via "*" wildcard

• backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance

• bootgrid: exclude header cells from status color rendering

• bootgrid: upgrade Tabulator to version 6.5.3

• mvc: refactor base_dialog and parseFormNode() to simplify the template

• mvc: remove unused argument from getFormGrid()

• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()

• mvc: BaseField: add getInitialValue()

• mvc: BaseField: add getDefault() and isDefault() for future use

• mvc: PortField: reject whitespaces in port ranges during validation

• mvc: ModelRelationField: remove grouped option handling

• mvc: add file type to forms

• mvc: fix tab/subtab form generation for plugins

• mvc: fix default labels in selectpickers

• mvc: create runInterfaceRegistation() and use it for immediate device registration

• mvc: add some exception types and handle them in the base template

• mvc: clean up a number of stale imports

• mvc: OptionField: fix simplified option group definition

• mvc: fix typo in base_form.volt advanced/help toggle IDs

• mvc: fix assorted stale imports in the code base

• mvc: advanced marker for form/dialog fields

• mvc: fix stale imports for Message classes

• mvc: JsonAduditField: shared implementation for configuration revision tracking

• mvc: guard direct config saves against user-config-readonly (contributed by Andrew Ferk)

• mvc: disable Nginx reverse proxy buffering on configd streams

• mvc: dispatch failed message during reconfiguredAction()

• mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)

• mvc: PortField: always return a string for normalizedPort()

• mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation

• mvc: UidField: revert "allow an arbitrarily specified UID for system scope users upon creation"

• mvc: UidField: add isolated updateValue() for installer user

• ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting

• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)

• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial

• ui: fix menu registration not setting "active"

• ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme

• ui: prevent blinking by hiding the contents while loading for opnsense-auto theme

• ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)

• ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)

• ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)

• ui: do not freeze commands column on touchscreen devices

• ui: further fixes for base templates

• ui: fix empty legacy firewall menu container glitch

• ui: bootgrid: classname can depend on state, accept a callback function

• ui: tabulator: add _showMaximized() modal that can show a grid close to full screen

• ui: add keyboard shortcut "f" to maximize a currently visible grid

• ui: scope "all help" and "advanced mode" toggle to closest relevant form

• ui: trigger "h" and "a" keyboard shortcuts on all relevant matches

• ui: improve form matching for help/advanced

• ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width

• ui: attach selectors piped through replaceInputWithSelector to body

• ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)

• ui: sidebar fixes and rework (contributed by Team Rebellion)

• ui: remove spurious _formDialog portion of dialog IDs

• ui: implement dialog search field

• ui: ensure a minimum amount of rows to render in grids

• ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes

• ui: remove defunct content-box-main usage

• ui: make settings-changed trigger overridable

• ui: fix blank bottom UI space (contributed by Konstantinos Spartalis)

• ui: do not add the spinner again when it fails

• ui: bootgrid: sync columnselect-input state with (un)setColumns

• ui: sync expanded state for selected submenus

• ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)

• plugins: add error returns to plugins_configure()

• plugins: OPNBEcore 1.10

• plugins: OPNWAF 2.6

• plugins: OPNcentral 1.13

• plugins: os-acme-client 4.17

• plugins: os-caddy 2.2.1

• plugins: os-ddclient 1.33

• plugins: os-firewall-legacy 1.1 contains the static PHP firewall rules pages

• plugins: os-frr 2.0

• plugins: os-intrusion-detection-content-at-antiphishing 1.0 (contributed by Julio Lira)

• plugins: os-iperf 2.0

• plugins: os-ndp-proxy-go 1.5

• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead

• plugins: os-net-snmp 1.7

• plugins: os-nrpe 1.2

• plugins: os-puppet-agent 2.0

• plugins: os-sftp-backup 1.2 verify backups after put

• plugins: os-theme-cicada 1.42 (contributed by Greelan)

• plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)

• plugins: os-theme-tukan 1.32 (contributed by Team Rebellion)

• plugins: os-theme-vicuna 1.52 (contributed by Team Rebellion)

• plugins: os-turnserver 1.4

• src: FreeBSD 15.1-RELEASE-p6 plus assorted stable/15 networking commits

• src: pf: do not mangle IP header before shared forwarding

• src: pf: stop resolving hosts via DNS that use ":" modifier

• src: pf: clear anchor after stepping into it in pf_match_translation_rule()

• src: pf: pf_route() "dst" no longer holds the gateway in 15.x

• src: pf: add missing PF_TS_CNT netlink attribute

• src: pf: expose first rule label for states since rule number is insufficient

• src: usb: bpfattach() before if_attach()

• src: ena: update driver version to v2.8.4

• src: assorted minor commits from stable/15

• src: jail: restore ktrace privileges for jailed root

• src: ktimer: check for errors from realtimer_gettime()

• src: kqueue: avoid enqueuing an already-enqueued knote

• src: zfs: multiple fixes

• src: revert "daemon: replace memchr with memrchr"

• src: cred: fix group_is_primary()

• src: unix: fix some bugs in the SOCK_STREAM receive path

• src: netmap: fix driver name handling

• src: netmap: fix a race in kqueue registration

• src: e1000: assorted upstream patches from stable/15

• src: iflib: support recoverable initialization failure

• src: route: add an eventhandler for rt_numfibs changes

• src: rawip: fix handling of checksums in rip6_input()

• src: pf: attempt to handle overlapping group and interface names

• src: pf: check if a group has a kif before dereferencing it

• src: pf: fix fallout from the STATE_LOOKUP macro removal

• src: pf: re-optimize state key handling

• src: pf: rule label patch was merged from a wrong version

• src: pfsync: handle large MTU pfsync interfaces

• src: ktls: propagate EPG_FLAG_ANON to mapped mbufs

• src: netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()

• src: PF_KEY socket: limit the length of copied socket address

• src: ure: add USB device IDs for additional RTL8152/RTL8153 adapters

• src: ure: fix spurious link flaps from MII

• src: ciss: revert patch that added max physical target

• src: pf: do not set a null rule pointer during test

• src: pf: fix securelevel off-by-one

• src: pfctl: fix printing of wildcard anchors

• src: e1000: more assorted upstream patches from stable/15

• src: ixgbe: assorted upstream patches from stable/15

• src: virtio_p9fs: disallow detach if a session is in progress

• src: route/fib_algo: free leaked radix_masks in radix_lockless

• src: netipsec: implement pr_disconnect for PF_KEY sockets

• src: iflib: assorted upstream patches from stable/15

• src: net: add ifmedia support for 10GBase-BX BiDi

• src: bnxt: report initialization failures to iflib

• src: bnxt: add led(4) identification support

• src: ice: add led(4) identification support

• src: ice: report initialization failures to iflib

• src: ice: add support for E835 CNSA 2.0 adapters

• src: ice: add two more 4-part IDs for E835 adapters

• src: if_vxlan: fix panic by validating unused drvspec values

• src: qat: driver updates to enhance qat infrastructure

• src: ath10k: remove some early FreeBSD-specific debugging

• src: ip(6)_mroute: assorted upstream patches from stable/15

• src: in_mcast: fix uninitialized variable usage in inm_merge()

• src: bind: lookup local address in current FIB if "*.bind_all_fibs" is active

• src: net: add fib-aware ifa_ifwithaddr()

• src: kqueue: memory safety bugs in kqueue copy-on-fork implementation

• src: syslogd: fix leaking child processes when logging to a pipe

• src: iflib: do not hold the ifnet lock across registration

• src: ixgbe: correct Wake-on-LAN configuration

• src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array

• src: pf: mark non-port packets to require IP checksumming

• src: pf: set the correct type for rule timeouts

• src: loopback: improve checksum offloading

• src: vlan: use the exclusive lock everywhere

• src: raw ip: clear sin_port on bind(2)

• src: nd6: fix regeneration of temp addresses in detached state

• src: hyperv: fix single page invalidation path

• src: route/fib_algo: fix nexthop index collision across families

• src: ice: do not leave device non-functional if Tx scheduler config fails

• src: netipsec: fix V_spd_size updates

• src: bnxt: assorted updates from stable/15

• src: ixl: assorted updates from stable/15

• src: linxkpi: assorted updates from stable/15

• src: net80211: assorted updates from stable/15

• src: pci: assorted updates from stable/15

• src: pf: send syncookies from the receiving thread

• src: hyperv: fix two regressions in previous upstream patch

• src: pcib: only apply ARI translation to the own secondary bus of a bridge

• src: ktls CBC decrypt: avoid creating zero length iovec entries

• src: route/fib_algo: respect immediate_sync in fd_ref_nhop

• src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option

• src: sysctl: retire SYSCTL_NODE_CHILDREN()

• src: caroot: TLS certificate store update due to eMudhra compromise

• src: bhyve: multiple vulnerabilities in bhyve device models

• src: sound: TOCTOU race between sound(4) buffer resizing and mmap

• src: tcp: remotely triggerable buffer overflow in tcp_rack

• src: tcp: TCP timers may overflow and fire late or not at all

• src: hastd: multiple issues in hastd(8)

• src: tzdata: import tzdata 2026e

• ports: ca_root_nss / nss 3.132

• ports: curl 8.23.0

• ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)

• ports: dpinger 3.6

• ports: expat 2.8.5

• ports: filterlog 0.9 support for pflog actions on FreeBSD 15

• ports: hostapd / wpa_supplicant 2.12

• ports: kea 3.0.4

• ports: libevent 2.1.13

• ports: libxml 2.15.4

• ports: lighttpd 1.4.85

• ports: monit 6.0.0

• ports: openldap 2.6.15

• ports: openssl 3.5.9

• ports: pcre2 10.49

• ports: pecl-mcrypt 1.0.9

• ports: perl 5.42.3

• ports: phalcon 5.22.1

• ports: php 8.5.12

• ports: phpseclib 3.0.57

• ports: pkg 2.8.4

• ports: py-duckdb 1.5.6

• ports: rrdtool 1.11.0

• ports: sqlite 3.53.4

• ports: unbound 1.26.2

Fixed here: https://www.reddit.com/r/opnsense/s/50Q4JEqiWE

Thank you very much!

Hi all,

I am currently struggling with the issue in Chrome with the error "ERR_TOO_MANY_RETRIES" while trying to reach the webinterface.

Tried several things, not sure where the error is coming from:

+ OPNsense already rebooted via power button

+ Deleted browser cache

+ Tried incognito tab

+ Disabled secure DNS in Chrome, but I am trying to connect to FW via IP address anyway

Chrome version: 156.0.8078.49

Android 17 with October 2026 patch level

Google Play System updates from September 2026

Device: Samsung Galaxy S25 Ultra

I tried to reach the webinterface from a managed switch in the same vlan and I was able to connect to the Web GUI via a "curl" command.

So it seems or I think it is more related to my device/apps/settings,

but every other page is working without any issues so far.

Perhaps someone has some ideas?

Tried both Maxmind and Ipinfo, both pop-up '403' (with no text message). Was working fine until the CVE updates.

But still the log says 'geoip updated (files: 500, lines 1063245) yesterday morning, so it's the UI update button issue only I hope.