#opnsense — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #opnsense, aggregated by home.social.
-
🚀 How to Deploy #OPNsense on a Rad Web Hosting #VPS
This guide demonstrates how to deploy OPNsense on a Rad Web Hosting VPS. This guide is tailored specifically for Rad Web Hosting VPS infrastructure, including /32 IP addressing, KVM ...
Continued 👉 #opensource #selfhosting #selfhosted
🚀 How to Deploy OPNsense on a ... -
Locked out of your firewall at 2 AM? This pfSense vs OPNsense guide compares architecture, VPN, security, and real benchmarks so you choose right the first time. #pfSense #OPNsense #SelfHosting #Firewall
-
Locked out of your firewall at 2 AM? This pfSense vs OPNsense guide compares architecture, VPN, security, and real benchmarks so you choose right the first time. #pfSense #OPNsense #SelfHosting #Firewall
-
Locked out of your firewall at 2 AM? This pfSense vs OPNsense guide compares architecture, VPN, security, and real benchmarks so you choose right the first time. #pfSense #OPNsense #SelfHosting #Firewall
-
Locked out of your firewall at 2 AM? This pfSense vs OPNsense guide compares architecture, VPN, security, and real benchmarks so you choose right the first time. #pfSense #OPNsense #SelfHosting #Firewall
-
A sad lesson from a few years of operating local #DNS resolvers in my infrastructure - #DNSSEC validation requires enormous resources to work reliably due to vast extra records it needs to pull from DNS for each validation and required computing power.
Forget about DNSSEC validation in
systemd-resolved,dnsmasqorunboundon home routers, it will just cause periodic and apparently unexplained delays and choke overall DNS resolution.On firewalls like #OPNsense it also would work only server-class devices, any of the desktop-class fanless hardware won’t work reliably for DNSSEC validation even if they can perfectly handle production-class proxy and firewall traffic.
Probably what only makes sense is a dedicated Unbound validation server, a separate container or jail but running within a proper hardware server with tons of memory and CPU. But then I found out that it’s much easier to use non-DNSSEC caching resolvers on perimeter devices that forward queries to Quad9 ECS resolvers[^1] which already do DNSSEC validation.
The only missing bit is that I think my local resolvers don’t forward the DO bit downstream, but that I need to still check.
[^1]: https://quad9.net/service/service-addresses-and-features/#ecssec
-
A sad lesson from a few years of operating local #DNS resolvers in my infrastructure - #DNSSEC validation requires enormous resources to work reliably due to vast extra records it needs to pull from DNS for each validation and required computing power.
Forget about DNSSEC validation in
systemd-resolved,dnsmasqorunboundon home routers, it will just cause periodic and apparently unexplained delays and choke overall DNS resolution.On firewalls like #OPNsense it also would work only server-class devices, any of the desktop-class fanless hardware won’t work reliably for DNSSEC validation even if they can perfectly handle production-class proxy and firewall traffic.
Probably what only makes sense is a dedicated Unbound validation server, a separate container or jail but running within a proper hardware server with tons of memory and CPU. But then I found out that it’s much easier to use non-DNSSEC caching resolvers on perimeter devices that forward queries to Quad9 ECS resolvers[^1] which already do DNSSEC validation.
The only missing bit is that I think my local resolvers don’t forward the DO bit downstream, but that I need to still check.
[^1]: https://quad9.net/service/service-addresses-and-features/#ecssec
-
A sad lesson from a few years of operating local #DNS resolvers in my infrastructure - #DNSSEC validation requires enormous resources to work reliably due to vast extra records it needs to pull from DNS for each validation and required computing power.
Forget about DNSSEC validation in
systemd-resolved,dnsmasqorunboundon home routers, it will just cause periodic and apparently unexplained delays and choke overall DNS resolution.On firewalls like #OPNsense it also would work only server-class devices, any of the desktop-class fanless hardware won’t work reliably for DNSSEC validation even if they can perfectly handle production-class proxy and firewall traffic.
Probably what only makes sense is a dedicated Unbound validation server, a separate container or jail but running within a proper hardware server with tons of memory and CPU. But then I found out that it’s much easier to use non-DNSSEC caching resolvers on perimeter devices that forward queries to Quad9 ECS resolvers[^1] which already do DNSSEC validation.
The only missing bit is that I think my local resolvers don’t forward the DO bit downstream, but that I need to still check.
[^1]: https://quad9.net/service/service-addresses-and-features/#ecssec
-
A sad lesson from a few years of operating local #DNS resolvers in my infrastructure - #DNSSEC validation requires enormous resources to work reliably due to vast extra records it needs to pull from DNS for each validation and required computing power.
Forget about DNSSEC validation in
systemd-resolved,dnsmasqorunboundon home routers, it will just cause periodic and apparently unexplained delays and choke overall DNS resolution.On firewalls like #OPNsense it also would work only server-class devices, any of the desktop-class fanless hardware won’t work reliably for DNSSEC validation even if they can perfectly handle production-class proxy and firewall traffic.
Probably what only makes sense is a dedicated Unbound validation server, a separate container or jail but running within a proper hardware server with tons of memory and CPU. But then I found out that it’s much easier to use non-DNSSEC caching resolvers on perimeter devices that forward queries to Quad9 ECS resolvers[^1] which already do DNSSEC validation.
The only missing bit is that I think my local resolvers don’t forward the DO bit downstream, but that I need to still check.
[^1]: https://quad9.net/service/service-addresses-and-features/#ecssec
-
Spent a day troubleshooting Client IPSec IKEv2 connections that kept failing. In the end it was… NOT DNS, but PKI.
Also, I suspect a weird edge-case bug in #OPNsense’s certificate handling…Either way… it’s working again now… so I can finally begin looking into the things that I *actually* wanted to build. A way-too-familiar situation.
-
Spent a day troubleshooting Client IPSec IKEv2 connections that kept failing. In the end it was… NOT DNS, but PKI.
Also, I suspect a weird edge-case bug in #OPNsense’s certificate handling…Either way… it’s working again now… so I can finally begin looking into the things that I *actually* wanted to build. A way-too-familiar situation.
-
Gerade habe ich das Upgrade auf #OPNsense 26.7 durchgeführt. Zu meiner Sicherheit habe ich zuvor das Plugin os-cpu-microcode-intel deinstalliert. Ob das auf das Update auf 26.7.1 noch erforderlich ist, kann ich nicht beurteilen und ich habe auch keine Lust, das extra zu testen. Das Upgrade soll möglichst stressfrei durchlaufen. Achja Backup und Snapshot vorher nicht vergessen!
-
Das 1. Mal seit der DSL-Einführung in meinem Heimartdorf ist unser Haushalt jetzt komplett frei von #avm bzw. #Fritz-Produkten. Das hat nichts mit dem Verkauf der Firma zu tun, aber meine persönlichen Anforderungen an die heimische Netzwerk-Infrastruktur waren die Produkte nicht mehr gewachsen. WLAN und Multi-SSID bieten die Produkte nicht an.
Das WLAN übernehmen jetzt zwei GWN7660, die vier AVM-Repeater ersetzen. Router macht aktuell noch ein ER605, aber der wird noch durch #opnsense ersetzt.
-
Das 1. Mal seit der DSL-Einführung in meinem Heimartdorf ist unser Haushalt jetzt komplett frei von #avm bzw. #Fritz-Produkten. Das hat nichts mit dem Verkauf der Firma zu tun, aber meine persönlichen Anforderungen an die heimische Netzwerk-Infrastruktur waren die Produkte nicht mehr gewachsen. WLAN und Multi-SSID bieten die Produkte nicht an.
Das WLAN übernehmen jetzt zwei GWN7660, die vier AVM-Repeater ersetzen. Router macht aktuell noch ein ER605, aber der wird noch durch #opnsense ersetzt.
-
Das 1. Mal seit der DSL-Einführung in meinem Heimartdorf ist unser Haushalt jetzt komplett frei von #avm bzw. #Fritz-Produkten. Das hat nichts mit dem Verkauf der Firma zu tun, aber meine persönlichen Anforderungen an die heimische Netzwerk-Infrastruktur waren die Produkte nicht mehr gewachsen. WLAN und Multi-SSID bieten die Produkte nicht an.
Das WLAN übernehmen jetzt zwei GWN7660, die vier AVM-Repeater ersetzen. Router macht aktuell noch ein ER605, aber der wird noch durch #opnsense ersetzt.
-
Das 1. Mal seit der DSL-Einführung in meinem Heimartdorf ist unser Haushalt jetzt komplett frei von #avm bzw. #Fritz-Produkten. Das hat nichts mit dem Verkauf der Firma zu tun, aber meine persönlichen Anforderungen an die heimische Netzwerk-Infrastruktur waren die Produkte nicht mehr gewachsen. WLAN und Multi-SSID bieten die Produkte nicht an.
Das WLAN übernehmen jetzt zwei GWN7660, die vier AVM-Repeater ersetzen. Router macht aktuell noch ein ER605, aber der wird noch durch #opnsense ersetzt.
-
Das 1. Mal seit der DSL-Einführung in meinem Heimartdorf ist unser Haushalt jetzt komplett frei von #avm bzw. #Fritz-Produkten. Das hat nichts mit dem Verkauf der Firma zu tun, aber meine persönlichen Anforderungen an die heimische Netzwerk-Infrastruktur waren die Produkte nicht mehr gewachsen. WLAN und Multi-SSID bieten die Produkte nicht an.
Das WLAN übernehmen jetzt zwei GWN7660, die vier AVM-Repeater ersetzen. Router macht aktuell noch ein ER605, aber der wird noch durch #opnsense ersetzt.
-
-
-
Well that sucked! My Verizon-supplied router had a failure of its internet port. The other ports work fine and the wireless still works so I disabled DHCP on it and hooked it up directly to my home lab's switch. I needed everything to work so that when my wife got home, she could watch TV. Basically it went from a router to an access point. POS!
Now my OPNsense box is doing all the routing. Damn but I love OPNsense. It rescued me out of a problem.
-
Well that sucked! My Verizon-supplied router had a failure of its internet port. The other ports work fine and the wireless still works so I disabled DHCP on it and hooked it up directly to my home lab's switch. I needed everything to work so that when my wife got home, she could watch TV. Basically it went from a router to an access point. POS!
Now my OPNsense box is doing all the routing. Damn but I love OPNsense. It rescued me out of a problem.
-
Well that sucked! My Verizon-supplied router had a failure of its internet port. The other ports work fine and the wireless still works so I disabled DHCP on it and hooked it up directly to my home lab's switch. I needed everything to work so that when my wife got home, she could watch TV. Basically it went from a router to an access point. POS!
Now my OPNsense box is doing all the routing. Damn but I love OPNsense. It rescued me out of a problem.
-
Well that sucked! My Verizon-supplied router had a failure of its internet port. The other ports work fine and the wireless still works so I disabled DHCP on it and hooked it up directly to my home lab's switch. I needed everything to work so that when my wife got home, she could watch TV. Basically it went from a router to an access point. POS!
Now my OPNsense box is doing all the routing. Damn but I love OPNsense. It rescued me out of a problem.
-
Well that sucked! My Verizon-supplied router had a failure of its internet port. The other ports work fine and the wireless still works so I disabled DHCP on it and hooked it up directly to my home lab's switch. I needed everything to work so that when my wife got home, she could watch TV. Basically it went from a router to an access point. POS!
Now my OPNsense box is doing all the routing. Damn but I love OPNsense. It rescued me out of a problem.
-
It's taken me a week, but I finally abandoned my old Ubiquiti router for an #opnsense firewall. I only caused an outage for about an hour as I discovered some mistakes from my initial testing. Now to figure out NAT66 for #ipv6. Work provides me with a hotspot for travel that also gives me an ipv6 address. I want to ensure failover between providers.
-
I just finished my Catppuccin theme for OPNsense, a theme bringing all 4 Catppuccin flavors to your firewall UI.
Flavors: Mocha, Latte, Frappé, Macchiato
Features:
- 540+ color replacements using official Catppuccin palette
- CSS custom properties for easy flavor switching
- BSD-2-Clause licensed
- Based on the Cicada theme from opnsense/plugins
Install: Manual SCP (package coming if there's demand)
Known limitations: Graph axis labels retain OPNsense defaults (inline SVG, can't override via CSS).
Repo:
https://github.com/TerminalTilt/os-theme-catppuccinScreenshots in the repo. Feedback/PRs welcome!
-
I just just finished my Catppuccin theme for OPNsense, a theme bringing all 4 Catppuccin flavors to your firewall UI.
Flavors: Mocha, Latte, Frappé, Macchiato
Features:
- 540+ color replacements using official Catppuccin palette
- CSS custom properties for easy flavor switching
- BSD-2-Clause licensed
- Based on the Cicada theme from opnsense/plugins
Install: Manual SCP (package coming if there's demand)
Known limitations: Graph axis labels retain OPNsense defaults (inline SVG, can't override via CSS).
Repo:
https://github.com/TerminalTilt/os-theme-catppuccinScreenshots in the repo. Feedback/PRs welcome!
-
I just just finished my Catppuccin theme for OPNsense, a theme bringing all 4 Catppuccin flavors to your firewall UI.
Flavors: Mocha, Latte, Frappé, Macchiato
Features:
- 540+ color replacements using official Catppuccin palette
- CSS custom properties for easy flavor switching
- BSD-2-Clause licensed
- Based on the Cicada theme from opnsense/plugins
Install: Manual SCP (package coming if there's demand)
Known limitations: Graph axis labels retain OPNsense defaults (inline SVG, can't override via CSS).
Repo:
https://github.com/TerminalTilt/os-theme-catppuccinScreenshots in the repo. Feedback/PRs welcome!
-
I just finished my Catppuccin theme for OPNsense, a theme bringing all 4 Catppuccin flavors to your firewall UI.
Flavors: Mocha, Latte, Frappé, Macchiato
Features:
- 540+ color replacements using official Catppuccin palette
- CSS custom properties for easy flavor switching
- BSD-2-Clause licensed
- Based on the Cicada theme from opnsense/plugins
Install: Manual SCP (package coming if there's demand)
Known limitations: Graph axis labels retain OPNsense defaults (inline SVG, can't override via CSS).
Repo:
https://github.com/TerminalTilt/os-theme-catppuccinScreenshots in the repo. Feedback/PRs welcome!
-
Hallo liebes Fediverse,
Ich bräuchte eure Hilfe: Welche Hardware-Geräte eignen sich für eine OPNsense Firewall und einen OpenWrt Router dahinter mit vier Netzwerken (LAN, WLAN, Gast und SmartHome)?
Hat da wer Erfahrungen? 😇🤗
-
Hallo liebes Fediverse,
Ich bräuchte eure Hilfe: Welche Hardware-Geräte eignen sich für eine OPNsense Firewall und einen OpenWrt Router dahinter mit vier Netzwerken (LAN, WLAN, Gast und SmartHome)?
Hat da wer Erfahrungen? 😇🤗
-
Hallo liebes Fediverse,
Ich bräuchte eure Hilfe: Welche Hardware-Geräte eignen sich für eine OPNsense Firewall und einen OpenWrt Router dahinter mit vier Netzwerken (LAN, WLAN, Gast und SmartHome)?
Hat da wer Erfahrungen? 😇🤗
-
Hallo liebes Fediverse,
Ich bräuchte eure Hilfe: Welche Hardware-Geräte eignen sich für eine OPNsense Firewall und einen OpenWrt Router dahinter mit vier Netzwerken (LAN, WLAN, Gast und SmartHome)?
Hat da wer Erfahrungen? 😇🤗
-
Hallo liebes Fediverse,
Ich bräuchte eure Hilfe: Welche Hardware-Geräte eignen sich für eine OPNsense Firewall und einen OpenWrt Router dahinter mit vier Netzwerken (LAN, WLAN, Gast und SmartHome)?
Hat da wer Erfahrungen? 😇🤗
-
#OPNsense 26.7.1 released. forum.opnsense.org/index.php?to...
-
#OPNsense 26.7.1 released. forum.opnsense.org/index.php?to...
-
#OPNsense 26.7.1 released. forum.opnsense.org/index.php?to...
-
#OPNsense 26.7.1 released. forum.opnsense.org/index.php?to...
-
#OPNsense 26.7.1 released. forum.opnsense.org/index.php?to...
-
To be a bit more specific: It was the unbound server that's serving as my recursor/cache for my network. It has a query forward configured to a Pi 4 which runs an authoritative DNS server for my domain, purely for internal use. So queries for mei-home.net go there internally, instead of Strato's DNS.
And for some reason, Unbound forgot that query forward this morning during the 6 AM automated reconnect. First time I ever saw that. Unbound restart fixed it.
1/2
-
To be a bit more specific: It was the unbound server that's serving as my recursor/cache for my network. It has a query forward configured to a Pi 4 which runs an authoritative DNS server for my domain, purely for internal use. So queries for mei-home.net go there internally, instead of Strato's DNS.
And for some reason, Unbound forgot that query forward this morning during the 6 AM automated reconnect. First time I ever saw that. Unbound restart fixed it.
1/2
-
To be a bit more specific: It was the unbound server that's serving as my recursor/cache for my network. It has a query forward configured to a Pi 4 which runs an authoritative DNS server for my domain, purely for internal use. So queries for mei-home.net go there internally, instead of Strato's DNS.
And for some reason, Unbound forgot that query forward this morning during the 6 AM automated reconnect. First time I ever saw that. Unbound restart fixed it.
1/2
-
To be a bit more specific: It was the unbound server that's serving as my recursor/cache for my network. It has a query forward configured to a Pi 4 which runs an authoritative DNS server for my domain, purely for internal use. So queries for mei-home.net go there internally, instead of Strato's DNS.
And for some reason, Unbound forgot that query forward this morning during the 6 AM automated reconnect. First time I ever saw that. Unbound restart fixed it.
1/2
-
To be a bit more specific: It was the unbound server that's serving as my recursor/cache for my network. It has a query forward configured to a Pi 4 which runs an authoritative DNS server for my domain, purely for internal use. So queries for mei-home.net go there internally, instead of Strato's DNS.
And for some reason, Unbound forgot that query forward this morning during the 6 AM automated reconnect. First time I ever saw that. Unbound restart fixed it.
1/2
-
@avatar oh noes! Das nächste Rabbithole :D
Ich sitze bissel dazwischen, habe zwar #adguard aber zumindest "etwas" echtes DNS auf meiner #opnsense . hatte wg. #Technitium schon mal überlegt.
Mal sehen wann ich dafür eigentlich keine Zeit habe. -
@avatar oh noes! Das nächste Rabbithole :D
Ich sitze bissel dazwischen, habe zwar #adguard aber zumindest "etwas" echtes DNS auf meiner #opnsense . hatte wg. #Technitium schon mal überlegt.
Mal sehen wann ich dafür eigentlich keine Zeit habe. -
@avatar oh noes! Das nächste Rabbithole :D
Ich sitze bissel dazwischen, habe zwar #adguard aber zumindest "etwas" echtes DNS auf meiner #opnsense . hatte wg. #Technitium schon mal überlegt.
Mal sehen wann ich dafür eigentlich keine Zeit habe. -
@avatar oh noes! Das nächste Rabbithole :D
Ich sitze bissel dazwischen, habe zwar #adguard aber zumindest "etwas" echtes DNS auf meiner #opnsense . hatte wg. #Technitium schon mal überlegt.
Mal sehen wann ich dafür eigentlich keine Zeit habe. -
@avatar oh noes! Das nächste Rabbithole :D
Ich sitze bissel dazwischen, habe zwar #adguard aber zumindest "etwas" echtes DNS auf meiner #opnsense . hatte wg. #Technitium schon mal überlegt.
Mal sehen wann ich dafür eigentlich keine Zeit habe. -
Latest 𝗩𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝗡𝗲𝘄𝘀 - 𝟮𝟬𝟮𝟲/𝟬𝟳/𝟮𝟬 (Valuable News - 2026/07/20) available.
https://vermaden.wordpress.com/2026/07/20/valuable-news-2026-07-20/
Past releases: https://vermaden.wordpress.com/news/
#verblog #vernews #news #bsd #freebsd #openbsd #netbsd #linux #unix #zfs #opnsense #ghostbsd #solaris #vermadenday