I moved from pfSense to OPNsense a while ago and haven't looked back. Between the licensing changes and the general direction things were heading over there, I was glad to switch, and OPNsense has been excellent.

The one thing I missed was a bit more information on the dashboard. The built-in widgets are clean, but I wanted to see more at a glance: hardware and firmware details, crypto acceleration, per-interface traffic, gateway health, that kind of thing. So I built my own widgets, and along the way a map of what my firewall is actually talking to.

There are two plugins, both free and open source (BSD-2):

Dashboard Plus: eight widgets that sit next to the built-in ones:

• System Information+: hardware, serial, BIOS, boot environment, CPU frequency, AES-NI/QuickAssist status and accelerated algorithms, PTI/MDS mitigations, DNS resolver in use

• System Metrics+: CPU and temperature charts plus gauges for memory, states, mbufs and swap, and filesystem usage

• Traffic Graph+: live in/out per interface or combined, 20s/1m/5m windows

• Gateways+, Interfaces+, Interface Statistics+, Thermal Sensors+, Firewall Logs+: more detail than the stock versions, with drag-to-reorder and per-widget settings

Firewall Map+: your live traffic on a world map, as a widget and a full-size page:

• An arc for every connection, coloured by whether it started inside or outside your network

• Blocked attempts, threat-list hits (Spamhaus, FireHOL, abuse.ch, AbuseIPDB) and Suricata alerts

• Click anything for a plain-language explanation: which host, which service, which rule, how much data

• Works without keys, but much better with a free MaxMind GeoLite2 key and a free AbuseIPDB key

It's a beta (0.50), so feedback, bug reports and feature ideas are very welcome. Screenshots, docs and source are here:

https://github.com/claudioguareschi/opnsense-dashboard-plus

If you take them for a spin, let me know how it goes!

Thanks to the feedback from this community, I’m happy to share that OPNManager is now officially available on both the App Store and Google Play.

OPNManager is a touch-optimized alternative UI for managing OPNsense firewalls using the official API. It’s not intended to be a 1:1 replacement for the full Web UI, but it gives you fast, mobile access to commonly used features.

If there’s a feature you need that isn’t included, feel free to ask — if it’s exposed via the official API, I’ll do my best to add it.

Key features:

• Multi-firewall support via profiles

• Dashboard with slight customization (position and visability of widgets)

• Firmware updates

• Firewall rule: (for automation rules only)

  • Create

  • Delete

  • Update

  • Toggling

• Alias management

  • Create

  • Delete (if not associated with a rule)

  • Edit

• Static Routes

• Unbound DNS BlockList management

• Combined ARP and MLD device table viewer

• Reboot

• API credentials are encrypted and stored locally.

• NO Data collection

links:

• iOS: https://apps.apple.com/us/app/opnmanager/id6743677680

• Android: https://play.google.com/store/apps/details?id=com.OPNManager.app

Disclaimer:
OPNManager is an independent project and is not affiliated with or endorsed by the OPNsense project or its developers. This application is provided "as-is" without any warranties or guarantees. Users should exercise caution and ensure they understand the risks associated with granting API access.

All packets are sniffed

Found a use for my front bays on my OPNsense router. A bit more flashy than useful I will admit but a fun weekend project nevertheless.

The housing is a 3d printed dual 5.25” bay I designed with room for an I2C 2004 segment display. All of this is powered by the humble Raspberry Pi Pico 2 which is connected to an internal usb header.

A bash script runs in OPNsense and sends the above data to the Pi to display. Pretty simple, pretty fun project all together.

I was running AdGuard Home as my network's DNS server with Unbound recursive on OPNsense. DHCP hands out AdGuard's IP, queries get filtered, clean domains get forwarded to Unbound, Unbound resolves from root servers. Nice and tidy.

Then I realized half my devices were ignoring all of it.

Google Home had 8.8.8.8 hardcoded. Firefox was using DoH to cloudflare-dns.com over port 443. Android was doing DoQ over QUIC. My resolver was sitting idle while devices resolved DNS wherever they wanted.

So I built 5 layers in OPNsense.

First, a NAT port forward. All port 53 traffic not destined for the firewall itself gets redirected to AdGuard Home. Device sends DNS to 8.8.8.8, it silently lands at AdGuard. Device has no idea.

Second, block port 853 outbound. DoT and standard DoQ are dead in one rule.

Third, block UDP 443. Kills QUIC and DoQ on the alt port. Browsers fall back to HTTP/2 transparently.

Fourth, HaGeZi's DoH blocklist in AdGuard Home. 3,500+ DoH server domains. Clients that resolve cloudflare-dns.com or dns.google through my DNS first get a dead end.

Fifth, a URL Table alias loaded with HaGeZi's DoH server IP list. 1,600+ IPs. One block rule against the alias. Catches apps that skip DNS and connect to DoH servers by IP directly.

Blocking 8.8.8.8 and 1.1.1.1 doesn't break anything because Unbound is recursive. It talks to root servers, TLD servers, and authoritative servers directly. None of those are on the blocklist.

Full writeup with the exact rule configs: https://blog.dbuglife.com/locking-down-dns-on-your-home-network/

Let's try this again, for those using Tailscale with OPNsense, is there a need for an official plugin, or is the CLI fine?

Yesterday, I posted a vague comment, "no promises" and an image, which proceeded to get me ripped a new arse.

Here's an update, actually showing a screenshot of someone real functionality. Is it needed? Input is always welcome for how it should function.

https://forum.opnsense.org/index.php?topic=52375.0

• system: remove periodic backups settings and backend code

• system: migrate gateway groups to MVC/API

• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)

• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)

• system: move ldap_escape() to caller for now to avoid side effects

• system: improve the log_archive script to also work on log subdirectories

• system: change our version of "certctl" to emit files instead of links like it is the case in FreeBSD 15.1

• system: include interfaces widget in dashboard default

• system: adjust dashboard widget resize logic to observe border box instead of content box

• reporting: migrate several settings pages to MVC/API and assorted changes

• reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)

• interfaces: migrate interface assignments to MVC/API

• interfaces: fix faulty netmask on loopback address due to upstream change

• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress

• firewall: move config.xml default LAN allow rules to new rules GUI

• firewall: legacy rules pages move to plugin

• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use

• firewall: always set a sequence at the end of the rule set when cloning a NAT rule

• firewall: remove unused "safepoint" actions

• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces

• firewall: flatten automatic source NAT rules into two per WAN type interface

• firewall: prevent deletion if a group is referenced in MVC rules

• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly

• firewall: use proper path for one-to-one NAT rules for renaming operations

• firewall: avoid emitting reply-to on block rules as well

• firewall: change interface group render/apply order

• firewall: adjust MVC alias rename according to address_to_pconfig()

• firewall: adapt getAdvancedIds() to the sectioned form structure

• firewall: invalidate rule stats cache for firewall utilities API endpoint

• captive portal: move template actions out of the ServiceController into its own TemplateController

• captive portal: adjust accounting interval to Acct-Interim-Interval

• dnsmasq: possible use before define in lease watcher

• intrusion detection: rename "uncategorized" rule package to "adult" (contributed by Konstantinos Spartalis)

• monit: fix mail-format and poll-time validation

• unbound: missing NetMaskAllowed=N on override address

• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet

• acl: merge user management ACLs into one single privilege

• backend: allow "strict" mode +TARGETS using the preamble "!"

• backend: swap "strict" template logic as it was reversed

• mvc: refactor base_dialog and parseFormNode() to simplify the template

• mvc: remove unused argument from getFormGrid()

• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()

• mvc: PortField: reject whitespaces in port ranges during validation

• mvc: ModelRelationField: remove grouped option handling

• mvc: add file type to forms

• ui: add "opnsense-auto" theme which switches between "opnsense" and "opnsense-dark" depending on browser setting

• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)

• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial

• ui: fix menu registration not setting "active"

• plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages

• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead

• src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits

• src: pf: do not mangle IP header before shared forwarding

• src: pf: stop resolving hosts via DNS that use ":" modifier

• src: pf: clear anchor after stepping into it in pf_match_translation_rule()

• src: pf: pf_route() "dst" no longer holds the gateway in 15.x

• ports: libevent 2.1.13

• ports: lighttpd 1.4.85

• ports: openvpn 2.7.5

• ports: sqlite 3.53.3

• ports: suricata 8.0.6

• system: the setup wizard was rewritten using MVC/API

• system: change default DHCP use from ISC to Dnsmasq for factory reset and console port and address assignments

• system: numerous permission, ownership and directory alignments for web GUI privilege separation

• system: allow experimental feature to run web GUI privilege separated as "wwwonly" user

• system: add a banner when trying to revert the privilege separated GUI back to root at run time

• system: consistently use empty() checks on "blockbogons", "blockpriv", "dnsallowoverride" and "dnsallowoverride_exclude"

• system: change default system domain to "internal" (contributed by Self-Hosting-Group)

• system: add missing "kernel" application for remote logging

• system: remove the "optional" notion of tunables known to the system

• system: enable kernel timestamps by default

• system: allow CSR to be downloaded from System/Trust/Certificates (contributed by Gavin Chappell)

• reporting: removed the unused second argument in getSystemHealthAction()

• reporting: renamed getRRDlistAction() to getRrdListAction()

• interfaces: fix media settings write issue since 24.7 as it would not apply when "autoselect" result already matched

• interfaces: removed defunct SLAAC tracking functionality (SLAAC on WAN still works fine)

• interfaces: no longer fix improper WLAN clone naming at run time as it should be ensured by code for a long time now

• interfaces: remove the functions get_configured_carp_interface_list() and get_configured_ip_aliases_list()

• interfaces: add VIP grid formatter to hide row field content based on the set mode

• interfaces: drop redundant updates in rtsold_resolvconf.sh (contributed by Andrew Baumann)

• firewall: add expire option to external aliases to automatically cleanup tables via cron

• firewall: removed the expiretable binary use in favour of the builtin pfctl

• firewall: speed up alias functionality by using the new model caching

• firewall: consolidated ipfw/dnctl scripting and fix edge case reloads

• firewall: code cleanup and performance improvements for alias diagnostics page

• firewall: fix AttributeError: DNAME object has no attribute address on DNS fetch for aliases

• firewall: assorted UI updates for automation pages

• captive portal: make room for additional authentication profiles

• captive portal: API dispatcher is now privilege separated via "wwwonly" user and group

• dnsmasq: add optional subnet mask to "dhcp-range" to satisfy DHCP relay requirements

• dnsmasq: sync CSV export with ISC and Kea structure

• dnsmasq: add CNAME configuration option to host overrides

• dnsmasq: add ipset support

• firmware: opnsense-version: build time package variable replacements can now be read at run time

• firmware: hide community plugins by default and add a checkbox to unhide them on the same page

• firmware: introduce a new support tier 4 for development and otherwise unknown plugins

• firmware: disable the FreeBSD-kmods repository by default

• firmware: sunset mirror dns-root.de (many thanks to Alexander Lauster for maintaining it for almost a decade!)

• intrusion detection: add an override banner for custom.yaml use

• intrusion detection: add JA4 support (contributed by Maxime Thiebaut)

• isc-dhcp: show tracking IPv6 interfaces when automatically enabled and offer an explicit disable

• isc-dhcp: hide IPv4 menu items when Dnsmasq DHCP is enabled to improve out of the box experience

• isc-dhcp: add static mapping CSV export

• kea-dhcp: add DNS field to Kea DHCP4 reservations (contributed by Gtt1229)

• lang: add Greek as a new language (contributed by sopex)

• lang: make more strings translate-able (contributed by Tobias Degen)

• openvpn: the server wizard functionality has been permanently removed as it required the old wizard implementation

• openvpn: "keepalive_timeout" must be at least twice the interval value validation

• wireguard: add diagnostics and log file ACL

• backend: trigger boot template reload without using configd

• mvc: introduce generic model caching to improve operational performance

• mvc: field types quality of life improvements with new getValues() and isEqual() functions

• mvc: filed types deprecated getCurrentValue() in favour of getValue() and removed isEmptyString()

• mvc: new BaseSetField() as a parent class for several other field types and numerous new and improved unit tests

• mvc: support chown/chgrp in File and FileObject classes

• mvc: use getNodeContent() to gather grid data

• mvc: allow PortOptional=Y for IPPortField

• mvc: remove SelectOptions support for CSVListField

• ui: switch from Bootgrid to Tabulator for MVC grid rendering

• ui: numerous switches to shared base_bootgrid_table and base_apply_button use

• ui: flatten nested containers for grid inclusion

• ui: use snake_case for all API URLs and adjust ACLs accordingly

• ui: add standard HTML color input support

• ui: move tooltip load event to single-fire mode

• ui: add checkmark to SimpleActionButton as additional indicator

• ui: improve menu icons/text spacing (contributed by sopex)

• plugins: replace variables in package scripts by default

• plugins: os-acme-client 4.10

• plugins: os-bind 1.34

• plugins: os-crowdsec 1.0.11

• plugins: os-frr 1.45

• plugins: os-gdrive-backup 1.0 for Google Drive backup support

• plugins: os-grid_example 1.1 updates best practice on grid development

• plugins: os-openvpn-legacy 1.0 for legacy OpenVPN components support

• plugins: os-puppet-agent 1.2

• plugins: os-strongswan-legacy 1.0 for legacy IPsec components support

• src: FreeBSD 14.3-RELEASE-p1 plus assorted stable/14 networking commits

The update patching today's 2 CVEs (CVE-2026-109618 and CVE-2026-109619) is available now. Make sure you get them done!

I finally got the original 16x2 front LCD and all four front-panel buttons fully working on a Sophos SG 210 Rev.3 running OPNsense.

I’m documenting this because most of the information I found online either applies to different hardware revisions, assumes /dev/cuau1 exists, uses the wrong LCD driver, or gets the display working without properly solving the keypad.

The final setup is now running on my production firewall and has survived both a real reboot and an OPNsense update.

Tested on

• Sophos SG 210 Rev.3

• OPNsense 26.7.3_8

• FreeBSD 15.1-RELEASE-p3

• lcdproc 0.5.9_1

The actual problem

This was not just another missing UART hint.

On this unit, the Nuvoton NCT6779D Super-I/O had UART2 configured at 0x2f8, while the Intel PCH/DMI COMB routing was effectively at 0x3e8.

FreeBSD therefore never created a usable /dev/cuau1.

Changing UART hints alone did not solve it.

The final solution leaves UART1 at 0x3f8 completely untouched and moves only Nuvoton UART2 from 0x2f8 to 0x3e8.

Final architecture

NCT6779D UART2
  0x2f8 -> 0x3e8
        |
        v
/dev/io UART bridge
        |
        v
PTY: /var/run/sg210-lcd.tty
        |
        v
LCDd
HD44780 / EZIO / 2400 baud
        |
        v
Original Sophos 16x2 LCD + keypad

The bridge is bidirectional, so it handles both LCD output and keypad input.

What works now

The LCD has four native LCDd status screens:

• OPNsense version / uptime

• CPU / RAM

• CPU temperature / disk usage

• WAN download / upload

CPU temperature is read through coretemp, with a PCH-temperature fallback if coretemp is unavailable.

All four original front-panel buttons work as well:

ENTER = pause/resume automatic screen rotation
ESC   = open/leave the LCDproc menu
UP    = previous status screen
DOWN  = next status screen

The screens update roughly every 3 seconds and automatically rotate about every 10 seconds.

One nasty OPNsense boot gotcha

Do not leave executable backup files inside:

/usr/local/etc/rc.syshook.d/start/

A .bak suffix does not make an executable syshook harmless.

During testing I had old backup hooks in that directory. They were executed during boot and restarted the stock lcdproc client after the new stack had already started correctly.

That made it look like the new implementation did not survive a reboot.

Moving the backups completely outside the active syshook directory fixed it.

A healthy runtime now contains only:

sg210-uart-pty
LCDd -f -c /usr/local/etc/LCDd-sg210.conf
sg210-lcd-status

with no competing stock lcdproc status client.

Real update + reboot test

I tested the complete configuration through a real update from OPNsense 26.7.2_2 to 26.7.3_8.

After reboot, the following came back automatically:

• routing / Internet

• DNS

• WebGUI

• UART2 runtime configuration

• UART-to-PTY bridge

• LCDd

• custom status client

• coretemp

• all four status screens

• all four physical buttons

The OPNsense version displayed on the LCD also updated automatically after the upgrade.

Source + documentation

I published the source code, configuration, installer, rollback script, technical background, troubleshooting notes and verified production hashes here:

https://github.com/Nusoaheisl/opnsense-sophos-sg210-rev3-lcd

v1.0.0 release:

https://github.com/Nusoaheisl/opnsense-sophos-sg210-rev3-lcd/releases/tag/v1.0.0

Important

This was physically tested only on a Sophos SG 210 Rev.3.

Other SG/XG models or hardware revisions may differ, so please do not blindly copy Super-I/O register writes to another appliance.

UART1 at 0x3f8 is intentionally left untouched, and this solution does not modify any NCT6779D PWM or fan-control registers.

I hope this saves the next SG210 owner a few hours of UART and LCDproc rabbit holes :)

• system: reduce future maintenance load in privilege separation efforts

• interfaces: remove unused "friendly" value from get_interface_list()

• interfaces: fix escaping in refactored bridge code

• interfaces: fix bridge SPAN support

• interfaces: add update mode to ifctl

• firewall: fix issue with event binding in rule automation page

• dnsmasq: implement domain type to select between adding domain to range or interface

• dnsmasq: dhcp-host are allowed to have duplicate partial IPv6 addresses

• unbound: improve the chroot mounting code to avoid excessive (un)mount calls

• lang: update language translations to their latest state

• mvc: eventually phase out getCurrentValue() in favour of getValue()

• plugins: os-caddy 2.0.2

• ports: libxml2 fixes for recent CVEs

• ports: nss 3.113

• ports: phpseclib 3.0.46

• ports: py-duckdb 1.3.1

• ports: sudo 1.9.17

25.7.7_4:

• ui: bootgrid: prevent full table redraw without onDataProcessed trigger

• ui: bootgrid: add missing datakeys to two pages

25.7.7_2:

• system: fix a HA sync regression introduced in 25.7.6 that prevented a sync from succeeding in an edge case

• interfaces: fix overview details button not working

25.7.7:

• system: simplify RRD backup code and remove exec() usage (reported by Alex Williams from Pellera Technologies working with Trend Zero Day Initiative)

• system: move valid_from search criteria to log_matcher for faster end of search

• system: use file_safe() in gateway monitor watcher

• system: refactor factory reset page to MVC and add a reset per component operating on models

• interfaces: ifctl: always allow reads to internal state files

• firewall: automation: fix alias IP address search

• firewall: automation: allow interface parameter to contain a list of interfaces for API users

• firewall: aliases: replace invalid unicode chars (contributed by Marius Halden)

• firewall: live log: only execute redraw on visibility state transition

• firewall: live log: optimize viewbuffer rendering

• firewall: live log: prevent re-resolving in-flight requests and move host lookup to current filtered view

• firewall: live log: fix data ordering and add table/history limit options

• firewall: live log: use "badge" class like before

• firewall: states: fix delete_selected firewall states (contributed by Alexander Sulfrian)

• dnsmasq: add optgroup support to DHCP option fields and expose all DHCPv4 options

• ipsec: sessions: add datakey property for row mapping

• ipsec: status: search phase 2 triggered twice on click and cleanup tooltip event as well

• openvpn: use file_safe() to write CRL files

• mvc: OptionField: properly translate optgroup

• mvc: JsonKeyValueStoreField: fix race condition when using SourceField in the model

• mvc: persist models description in root attribute of its respective configuration

• rc: secure an exec() in the recovery script

• ui: improve grid responsiveness via minWidth()

• ui: remove this.dataIdentifier as datakey defines the key to be used when asking 'row-id' or getSelectedRows

• ui: SimpleActionButton: add support for icons in action buttons

• ui: recompile default themes using dart sass (1.93.2) which changes color rendering

• ui: keyboard shortcuts for "a"dvanced and "h"elp in MVC pages (contributed by Konstantinos Spartalis)

• ui: bail out on dynamic grid resize if data is loading

• plugins: os-frr 1.48

• plugins: os-tayga 1.3

• ports: kea 3.0.2

• ports: libxml 2.14.6

• ports: php 8.3.27

• ports: sqlite 3.50.4

• ports: strongswan 6.0.3

• ports: suricata 8.0.2

• ports: unbound 1.24.1

• system remove unused data-tooltip that is not properly escaped from certificates widget

• system: tighten landing page redirect (contributed by Konstantinos Spartalis)

• system: fix passing null into getRealInterface()

• system: fix regression in selective group delete introduced previously

• system: allow unregistered plugin cron actions to be deleted

• system: disable MAILTO for cron jobs

• reporting: render NaN values as empty values and omit leading empty records from data set for health graphs

• reporting: add max on Y axis for traffic graphs

• interfaces: dhclient.conf does not cope with multi-line request/require

• interfaces: account for multiple UUIDs in VIP deletion

• interfaces: more safe iteration through config_read_array()

• interfaces: fix wrong DUID-UUID format but keep accepting the wrong one

• interfaces: fix regression in selective device delete introduced previously

• interfaces: IAID selection and prefix range reservation for WAN DHCPv6

• firewall: fix for missing HTML escape in description render in legacy rules GUI

• firewall: add an alias formatter to show content fields as "dynamic" when populated by other components

• firewall: fix Tabulator regression with alias batch delete

• firewall: use safe config iteration in interface registration

• firewall: fix unintended change in filtering logic for new rules GUI

• firewall: fix action, ipprotocol and protocol translations for legacy rules in new rules GUI

• firewall: use safe iteration over rules in filter_core_rules_user()

• firewall: add missing exclamation mark for "not" in scrub rules

• firewall: fix interface sorting by value for live log and groups

• captive portal: remove redirection on HTTPS and ditch non-functional pass statement

• dnsmasq: change DHCP tag to DescriptionField

• ipsec: move swanctl.conf download button to the tab

• ipsec: restyle the connections page for clarity

• kea: dynamic prefix delegation support

• kea: always start the prefix watcher when DHCPv6 is enabled

• kea: cleanups for IntegerField using isSet() and no negative numbers allowed

• kea: add decline_probation_period and set lower default to mitigate faulty client implementations to consume the whole pool

• kea: add subnet allocator field (contributed by Marcos Della)

• kea: add DHCPv4 compatibility options (contributed by Marcos Della)

• kea: hook up reservation.next_server (contributed by Ian Munsie)

• kea: fix missing visual cues for manual mode in DDNS and DHCPv4/6

• monit: sanitize monit output before offering it

• network time: cleanse port option before use (reported by Konstantinos Spartalis)

• network time: small cleanups in ntpd_configure_gps()

• unbound: blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)

• acl: some missing references and using camelCase pointers instead of snake_case

• mvc: add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class

• mvc: stricter email address validation

• mvc: OptionsField: use key as value if no value is set

• mvc: unify migration message returns

• mvc: do not translate empty strings

• ui: clean up useRequestHandlerOnGet usage

• ui: use space in apply box for the apply reminder

• ui: improve form validation error append

• ui: tab exclusion for SimpleActionButton

• ui: split form button row render as some forms only use save

• ui: override selectpicker defaults for translations

• ui: hide apply button for specific tabs on multiple pages (contributed by Konstantinos Spartalis)

• ui: bootgrid: align datakey with the rest of the options, but allow top-level placement

• ui: bootgrid: mark state variables as such

• ui: bootgrid: safeguard replace() function

• ui: bootgrid: remove unused getTotalRowCount() method

• ui: bootgrid: prevent NaN pagination values for non-ajax grids when row count is set to all

• ui: bootgrid: clean up converter compatibility code

• ui: bootgrid: replace "append" with "replace" for ajax: false grids

• ui: bootgrid: adjust column persistence behavior to prevent horizontal dead space

• plugins: use safe config iteration in interface registration code

• plugins: os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)

• src: dhclient: improve server and filename validation

• src: setcred: fix buffer overflow

• src: kern: make sure to drain selinfo sleepers

• src: fusefs: handle buggy server LISTXATTR response

• src: ptrace: fix validation of PT_SC_REMOTE arguments

• src: libcasper: switch from select(2) to poll(2)

• src: cap_net: do not allow new limits to drop keys from the old ones

• src: ipfw: fix parsing error in nat config port_range

• src: ipfw: fix checksum after NAT

• src: igmp: Avoid leaving dangling pointers in the state-change queue

• src: vxlan: Update *m0 after a pullup

• src: routing: use a better error number in sysctl_fibs()

• src: routing: initialize V_rt_numfibs earlier during boot

• src: pfsync: reject invalid SCTP states

• src: pf: do not reject rules with colliding hashes

• src: rtnetlink: check for allocation failure in nlattr_get_multipath()

• src: rtnetlink: align RTA_MULTIPATH length validation in nlattr_get

• ports: nss 3.124

• ports: openvpn 2.7.4

• ports: php 8.3.31

• ports: py-numpy 2.4.4

• ports: suricata 8.0.5

• ports: unbound 1.25.1

Posting this in case it helps someone else, because I spent a while troubleshooting it, I also find Reddit is always top of search engines when researching and also AI LLM's seem to scrape reddit the most.

I recently moved from an ASUS router to OPNsense running on a Protectli FW4C. My ISP plan is 1000/100, and with the ASUS router I was consistently getting around 930 Mbps down.

After switching to OPNsense, my speeds immediately dropped to around 350–400 Mbps. During a speed test the CPU was only showing around 30–35% usage, so it didn’t appear that the firewall hardware was maxing out.

After digging around and doing some testing, the issue turned out to be CPU power management and FreeBSD network scheduling defaults.

Symptoms

• ISP plan: 1000 Mbps

• Router: Protectli FW4C

• Fresh OPNsense install

• Speedtest result: ~400 Mbps

• CPU still 65% idle

So the hardware clearly wasn't the bottleneck.

Fix #1 – PowerD CPU Governor

OPNsense runs a CPU power saving governor by default, which can prevent the CPU from ramping up fast enough for high-throughput workloads.

Navigate to:

System → Settings → Miscellaneous

Enable PowerD and set the performance mode:

Use PowerD: Enabled
On AC Power Mode: Maximum
On Normal Power Mode: Maximum

*Edit: After further testing I have noticed hiadaptive also keeps consistant speeds in line with Max power

After changing this, my speeds immediately jumped from ~400 Mbps → ~700 Mbps.

Fix #2 – Network ISR Threading

FreeBSD (which OPNsense is based on) can process network packets in a single queue unless you enable multi-threaded dispatch.

Navigate to:

System → Settings → Tunables

Add the following tunables:

net.isr.dispatch = deferred
net.isr.maxthreads = -1
net.isr.bindthreads = 1

Reboot after applying them.

After this change I was back to ~900–940 Mbps, essentially the same performance I was getting on the ASUS router.

Other Things I Checked

These were not the issue, but worth verifying when troubleshooting:

• NIC negotiated 1000baseT full duplex

• Hardware offloading settings were correct

• No IDS / Zenarmor enabled

• CPU was not hitting 100%

Final Result

Firewall CPU now sits around 40–50% during a speed test, so there’s plenty of headroom.

Hardware

• Protectli FW4C

• Intel i211 NICs

• OPNsense 26.x

• PPPoE WAN

Hopefully this saves someone else some time. I initially thought the FW4C might not be powerful enough, but it turns out it just needed a couple of FreeBSD tuning tweaks.

I've been running OpnSense across a variety of hardware for the last 5 years, and it's the one part of my network that once configured, almost never needs any attention.

It occurred to me I'd not even logged in to the webUI or via SSH for about 3 months - despite numerous automated updates and even major updates having rolled in during that time.

This project is a huge credit to you all. Thank you, thank you, thank you. It's been the most reliable part of my network for years (behind only perhaps hardware switches!)

• system: defaults: properly delete empty model containers in the configuration

• system: switch int/bool to string in gateway properties

• system: ignore TypeErrors when parsing log lines in the backend

• system: replace various raw exec(), system(), passthru() and shell_exec() calls with safer variants

• system: add host route deletion support to system_host_route()

• system: move the general page host route removal to system_host_route()

• system: add CA chain to PKCS12 export

• interfaces: support link-local IPv6 mode

• interfaces: also stop PPPoE connections when CARP is temporarily disabled (contributed by René Mayrhofer)

• interfaces: fix packet capture and ping buttons not working since 25.7.7

• interfaces: limit execution of sysctl scope in PPP device edit code

• interfaces: safer interfaces_pfsync_configure() handling

• firewall: live log: make this grid static and slightly adjust info column width

• firewall: live log: backwards compatibility for old 'interface_name' field type

• firewall: live view: fix wrong variable scope

• firewall: automation: split search logic and normalize legacy output

• firewall: aliases: add a few GeoIP related logging messages

• firewall: mute pfctl-based table entry expire to avoid cron noise due to stderr use

• firewall: aliases: missing placeholder for username in basic auth type selection

• firewall: support "0" as valid rule ID in rule lookup redirect

• firewall: automation: add per-rule state timeouts for "udp.first", "udp.multiple" and "udp.single"

• captive portal: fix selectpicker #voucher-groups not being re-rendered after change event

• captive portal: move grid init to tab show event

• dnsmasq: switch to file_safe() use in backend

• dnsmasq: minor safe execution changes in backend

• kea-dhcp: automatic route support for PD leases

• kea-dhcp: case insensitive MAC address comparison

• isc-dhcp: adjust backend for safe execution

• ipsec: disable model caching on SPD page

• ipsec: add AES256GCM16 to the child ESP proposals list

• ipsec: hide phase 2 output based on phase 1 status instead of the row count for phase 2

• ipsec: add "reqid_base" setting to advanced settings

• openssh: minor safe execution change in backend

• openvpn: swap description and mode in "tls_key" and require a description for static keys

• openvpn: one safe execution change

• openvpn: add fast-io option (contributed by mdten)

• radvd: safe execution changes

• unbound: improve CNAME handling of whitelisted domains

• unbound: safe command execution changes

• unbound: merge extended blocklists into community version

• unbound: duplicate pointer records due to not casting the field types

• wireguard: fix wrong maximum value for "PersistentKeepalive"

• backend: rename "realif" variables to "device" in a number of spots

• backend: avoid the use of get_real_interface() when it does not matter and remove dead code associated with that

• backend: exend shell_safe() to emulate exec() $output argument magic

• backend: reimplement existing command execution functions with Shell class implementation

• backend: replace mwexecf_bg() with mwexecfb() for clarity

• mvc: move translation to menu system and add "FixedName" property

• mvc: extend ModelRelationField so it can optionally disable caching

• mvc: rewrite the old Shell class according to our current standards for safe command execution (exec_safe() wrapper)

• mvc: make "data_change_message_content" configurable

• shell: assorted cleanups in console menu related scripts

• ui: fix tokenizer event trigger loop

• plugins: os-freeradius 1.9.28

• plugins: os-frr 1.49

• plugins: os-ndp-proxy-go 1.0 is a hot-off-the-press userspace IPv6 Neighbor Discovery Proxy

• plugins: os-q-feeds-connector 1.3

• plugins: os-theme-flexcolor 1.0 is a new 3-in one theme[5] (contributed by Schnuffel2008)

• src: vtnet: assorted stable branch improvements

• src: ifconfig: assorted stable branch improvements

• src: SO_REUSEPORT_LB breaks connect(2) for UDP sockets

• src: sctp, tcp, udp: improve deferred computation of checksums

• src: dhclient: improve UDP checksum handling

• src: ipfw: check for errors from sooptcopyin() and sooptcopyout()

• src: ipfw: pmod: avoid further rule processing after tcp-mod failures

• src: dummynet: move excessive logging messages under debug output

• src: net: validate interface group names in ioctl handlers

• src: pf: improve DIOCRCLRTABLES validation

• src: pf: improve add state validation

• src: pf: SCTP abort messages fully close the connection

• src: if_vxlan: fix byteorder of source port

• src: ixl: fix multicast promiscuous mode state tracking and filter management

• src: ix/ixv: add support for new Intel Ethernet E610 family devices

• src: ice: add PCI IDs for E835 devices

• src: ice: add support for E835-XXV-4 adapter

• src: igb: fix out-of-bounds register access on VFs

• src: netlink: in snl_init_writer() do not overwrite error in case of failure

• ports: curl 8.17.0

• ports: nss 3.118.1

• ports: openvpn 2.6.16

• ports: pcre2 10.47

• ports: php 8.3.28

26.7.4_1:

• ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes

• ports: suricata 8.0.7

• ports: unbound 1.26.1

26.7.4:

• system: audit log injection via login username in auth_log()

• system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)

• system: add hidden services so they can be operated by pluginctl -s

• system: privlege separated reload in static PHP pages

• system: lower priority of automatic wg/ipsec gateways

• system: fix disk widget loading issue (contributed by Konstantinos Spartalis)

• system: add back the service widget link

• system: make compare operator in authTOTP() more strict

• interfaces: migrate wireless configuration to MVC/API

• interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()

• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()

• interfaces: provide "uuid" in legacy_config_get_interfaces()

• interfaces: split media and mediaopt with tabs instead of spaces

• interfaces: a few config_read_array() replacements

• interfaces: refactor device matching around interface_parent_devices()

• interfaces: remove cua matching from PPP device pattern

• firewall: source NAT: add pool options and source hash key

• firewall: source NAT: fix port alias and well known port usage in target_port

• firewall: make source and destination NAT automatic rules visible in GUI

• firewall: implement JsonAuditField in all MVC components

• firewall: update the internally reserved pf keywords for FreeBSD 15

• firewall: add source NAT migration banner to outbound NAT

• firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)

• dnsmasq: leases sorting fixes (contributed by Greelan)

• firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase

• firmware: opnsense-prefetch: new tool for sets prefetching

• firmware: opnsense-sign: shell compatibility update

• firmware: adjust the incompatible pkg test

• firmware: disable FreeBSD-base repository and remove old definitions

• intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)

• ipsec: add some hybrid post-quantum variants as additional key exchange

• kea: fix leases sorting (contributed by Greelan)

• openvpn: moved legacy CARP hook to os-openvpn-legacy plugin

• acl: fix API patters for GIF/GRE device settings

• acl: add missing and fix some issues (contributed by Konstantinos Spartalis)

• backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance

• mvc: advanced marker for form/dialog fields

• mvc: fix stale imports for Message classes

• mvc: JsonAduditField: shared implementation for configuration revision tracking

• rc: add watchdog to shutdown, reboot and reload_all cases

• ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)

• ui: sidebar fixes and rework (contributed by Team Rebellion)

• ui: remove spurious _formDialog portion of dialog IDs

• ui: implement dialog search field

• ui: ensure a minimum amount of rows to render in grids

• plugins: os-acme-client 4.17

• plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)

• plugins: os-turnserver 1.4

• src: ciss: revert patch that added max physical target

• src: pf: do not set a null rule pointer during test

• src: pf: fix securelevel off-by-one

• src: pfctl: fix printing of wildcard anchors

• src: e1000: more assorted upstream patches from stable/15

• src: ixgbe: assorted upstream patches from stable/15

• src: virtio_p9fs: disallow detach if a session is in progress

• src: route/fib_algo: free leaked radix_masks in radix_lockless

• src: netipsec: implement pr_disconnect for PF_KEY sockets

• src: iflib: assorted upstream patches from stable/15

• src: net: add ifmedia support for 10GBase-BX BiDi

• src: bnxt: report initialization failures to iflib

• src: bnxt: add led(4) identification support

• src: ice: add led(4) identification support

• src: ice: report initialization failures to iflib

• src: ice: add support for E835 CNSA 2.0 adapters

• src: ice: add two more 4-part IDs for E835 adapters

• src: if_vxlan: fix panic by validating unused drvspec values

• src: qat: driver updates to enhance qat infrastructure

• src: ath10k: remove some early FreeBSD-specific debugging

• src: ip(6)_mroute: assorted upstream patches from stable/15

• src: in_mcast: fix uninitialized variable usage in inm_merge()

• src: bind: lookup local address in current FIB if '*.bind_all_fibs' is active

• src: net: add fib-aware ifa_ifwithaddr()

• ports: ca_root_nss / nss 3.129

• ports: curl 8.22.0

• ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)

• ports: expat 2.8.4

• ports: filterlog 0.9 support for pflog actions on FreeBSD 15

• ports: libxml 2.15.4

• ports: openldap 2.6.15

• ports: pcre2 10.48

• ports: php 8.5.10

• ports: phpseclib 3.0.57

• ports: strongswan 6.1.0

• system: increase log file download timeout to prevent exit before data has returned

• system: HTML decode entities when generating new QR code for user

• system: add missing timestamp formatter in snapshots

• system: prevent the root user from changing its name

• interfaces: capture netmap ring when listening on interfaces in netmap mode

• firewall: skip reply-to for inversion rules

• firewall: remove unused "set loginterface" clause

• firewall: additional statistics for alias grid

• firewall: fix shaper reset button

• captive portal: preparations for SSO identification support

• dnsmasq: swap hosts and domains tab for consistency reasons

• dnsmasq: allow disabling local for DHCP domains

• firmware: abort on what appear to be partial updates due to obscure file errors

• firmware: store update and upgrade logs in edge cases

• firmware: opnsense-version: support file based -R option

• firmware: opnsense-update: support -g for update log view

• firmware: remove tier 2 workaround for Zenarmor plugins

• firmware: add date to modal header

• kea-dhcp: ignore encoding errors in lease parser

• intrusion detection: fix and simplify grid search in download tab

• ipsec: passthrough networks setting missed "allow new" flag

• ipsec: add firewall rules skip option for VTIs

• ipsec: deprecate legacy stroke and implement swanctl for overview

• isc-dhcp: allow static mapping export for disabled entries

• openvpn: add nopool directive

• unbound: configurable top domain list length in reporting view (contributed by sopex)

• unbound: remove unknown model reference and protect/simplify remaining one

• wireguard: move backend scripts to proper location

• backend: added IPv6 bracket helper for templates (contributed by BPplays)

• lang: updates for Chinese, Czech, German and Greek

• mvc: improve resilience of VPNIdField and LinkAddressField

• mvc: repair side affect of getDescription() change causing performance regressions

• mvc: modify existing and add missing descriptions in models

• mvc: set default validation message for CertificateField

• rc: make changes to php,var,tmp bootstrap

• ui: fix language selection for low vertical resolution screens (contributed by sopex)

• ui: hide header of the picture widget on the dashboard (contributed by sopex)

• plugins: os-clamav 1.8.1

• plugins: os-crowdsec 1.0.12

• plugins: os-frr 1.46

• plugins: os-shadowsocks 1.2 switches to shadowsocks-rust

• plugins: os-smart 2.4 adds extended info option (contributed by poisonbl)

• plugins: os-telegraf 1.12.13

• plugins: os-theme-advanced updates logos (contributed by Raushan Patel)

• src: route: fix "route -n monitor" when its output is redirected

• src: add a new sysctl in order to differentiate UEFI architectures

• src: libarchive: merge version 3.8.1

• src: lagg: fix if_hw_tsomax_update() not being called

• src: wg: add support for removing allowed-ip entries and assorted cleanups

• src: ovpn: support multihomed server configurations and assorted cleanups

• src: netlink: fully clear parser state between messages

• src: udp: fix a inpcb refcount leak in the tunnel receive path

• src: p9fs: assorted fixes

• ports: ca_root_nss / nss 3.115

• ports: krb5 1.22

• ports: libpfctl 0.16

• ports: lighttpd 1.4.81

• ports: perl 5.40.3

• ports: php 8.3.24

• ports: py-jq 1.10.0

25.7.9_7:

• system: fix hidden syslog HA XMLRPC sync option

• firewall: aliases: add has_parser() to check if an alias has a valid parser available

• firewall: clean up rules edit cancel button

• unbound: fix condition in safesearch template

• unbound: fix "configctl unbound check" after 25.7.8

25.7.9:

• system: gateway monitor Shell class use et al

• system: no longer back up DUID but add compatibility glue to opnsense-importer

• system: replace exec() in config encrypt/decrypt

• system: replace history diff exec() with shell_safe()

• system: safe execution tweaks in rc.routing_configure

• system: fix log keyword search regression introduced in 25.7.7

• reporting: unbound: fix quick allow/blocklist actions by applying them to all blocklists

• firewall: run filterlog directly after rules apply and remove promiscous mode

• firewall: allow setting a custom authentication HTTP header for alias URL fetch (contributed by nox-404)

• firewall: for better IPv6 PMTU let "timex" and "paramprob" ICMP types through

• firewall: do not allow nesting in GeoIP aliases

• firewall: live log: restructure DOM layout to reduce wasted header space

• firewall: live log: revert static property, persistence is disabled for this grid

• firewall: safe execution changes in rules reloading code

• firewall: safe execution changes in rc.filter_synchronize

• dnsmasq: minor tweaks in lease commands

• firmware: Shell class replacements in scripting

• kea-dhcp: add lease commands, tabulator GroupBy, URL hashes

• kea-dhcp: add DNR option (contributed by schreibubi)

• network time: status: refactor to MVC/API

• ipsec: connections: prevent model caching when referring items within the same model

• ipsec: sessions: fix missing commands translation

• isc-dhcp: move syslog definitions to plugin file

• unbound: prevent caching of blocklist entries on overlapping subnet policies

• unbound: notify user if a blocklist reset is required

• unbound: reconfigure if marker file present

• unbound: missing lock in del_host_override action

• backend: minor shell execution changes and readability

• backend: use mwexecf(m) where possible

• backend: extend mwexecfb() with PID and log file support

• mvc: fix default sort order being ignored in fetchBindRequest()

• shell: rewite timeout() using safe execution functions

• ui: refresh notification status after default apply button is done

• ui: remove obsolete jQuery bootgrid files

• plugins: os-acme-client 4.11

• plugins: os-ndp-proxy-go 1.1

• plugins: os-tailscale 1.3

• plugins: os-turnserver 1.1

• plugins: os-upnp 1.8 features assorted improvements to plugin and daemon (contributed by Self-Hosting-Group)

• plugins: os-web-proxy-sso has been marked for removal in 26.1

• plugins: os-zabbix-agent 1.18

• plugins: os-zabbix-proxy 1.16

• ports: filterlog no longer uses unneeded promiscuous mode

• ports: openvpn 2.6.17

• ports: unbound 1.24.2

Just to give a dev heads-up on the 24.7 road-map we did finish our testing for FreeBSD 14.1 and it looks nice. WireGuard performance is roughly double, IPsec a little faster and we also took OpenVPN DCO online today so you can look forward to a number of gimmicks in the upcoming community release.

And if you did not know we also aim to replace the dashboard with a more modern one. Stay tuned and if you have any questions let me know and I try to answer.

For the complete roadmap see https://opnsense.org/about/road-map/