OPNsense core: OPNsense GUI, API and systems backend (4.8k stars)
What it does
All text below is quoted directly from the project README.
>OPNsense GUI, API and systems backend
Makefile targets:
- make package: A package of the current state of the repository can be created using this target.
- make update: Update will pull the latest commits from the current branch from the upstream repository.
- make upgrade: Upgrade will run the package build and replace the currently installed package in the system.
- make collect: Fetch changes from the running system for all known files.
- make lint: Run several syntax checks on the repository.
- make style: Run the PSR12 and PEP8 style checks on MVC PHP code and Python, respectively.
- make sweep: Run several automatic sanitizers on the code base.
>OPNsense is and will always be available under the 2-Clause BSD license.
Repository
opnsense/core
Repository stats
|Metric|Value|
|:-|:-|
|Stars|4,754|
|Forks|1,016|
|Last release|None|
|Languages|PHP 55.2%, Volt 13.2%, Python 10.3%|
|Contributors|341|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|None|
|AI co-authored commits|None|
Main contributor
|Field|Value|
|:-|:-|
|Name|Franco Fichtner|
|GitHub|@fichtner|
|Commits to this repo|10,073 (top contributor)|
|Bio|I like nifty things. I read a lot. Sometimes I write stuff.|
|Company / Location|Deciso / Lutzen, Germany|
|Followers|305|
|Public repos|25|
|On GitHub since|2012-07-02|
──────────────────────────────
📌 How many great GitHub repos have you discovered and completely forgotten about?
Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week.
📬 Never lose track of great repos again. Subscribe free.
3 points
Call for testers: Q-Feeds Connector with MITRE ATT&CK based firewall aliases
Hi all,
We are very excited about this release. With the new Q-Feeds Connector, OPNsense is, as far as we know, the first firewall in the world where you can build firewall rules directly on MITRE ATT&CK mapping: block or allow traffic based on the tactics, techniques, software and groups behind an IP address.
The new version is available as a development package of the plugin (os-q-feeds-connector-devel). Before it goes to the production release, we would like as many people as possible to try it on real hardware with real traffic. If you use Q-Feeds today, or want to try it, your feedback is very welcome.
What is new
There is a new Security > Q-Feeds Connect > Firewall Aliases page. You create your own aliases and decide which IP addresses go into them, based on the full MITRE ATT&CK mapping: tactics, techniques, software and groups. Each of these has its own "include" and "exclude" selector, and every entry shows how many IP addresses it currently covers.
Every alias you create appears as __qfeeds_<name> and can be used in firewall rules like the existing Q-Feeds aliases. For example, you can block every address linked to a specific threat group or malware family, or only log traffic tied to a certain technique.
The default aliases (such as __qfeeds_malware_ip) are still created, so existing rules keep working.
Please note: for now, the MITRE filters work for IP addresses only.
Coming next
In a future release we will also show the MITRE ATT&CK data on the Events tab, so you can see right away which tactics, techniques, software or groups a blocked connection is linked to. And we will also add this functionality to Unbound and DNScrypt-proxy.
How to get it
There is no need to switch your whole firewall to the development release. You only install the development version of the plugin, from the shell (SSH or console option 8):
- Take a configuration backup first (System > Configuration > Backups). Use a lab or non-critical firewall if you can.
- If you already have the Q-Feeds Connector installed, remove the current version first. Your settings and API key are kept:
- pkg remove os-q-feeds-connector
- Install the development version (version 1.7.d at the time of writing):
- pkg install os-q-feeds-connector-devel
- Check that your API key is filled in under Security > Q-Feeds Connect > Settings and press Apply. No paid subscription? Activate the promo license below first.
- Force a full update, so the MITRE data is loaded right away. Everyone needs to do this once, both new installs and upgrades:
- /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load
- This can take a while. You should see lines like "downloaded ... entries", "database sync executed" and "load feed __qfeeds_...".
To go back to the regular version later, run:
pkg remove os-q-feeds-connector-devel
pkg install os-q-feeds-connector
No paid subscription? Test with 14 days of premium access
Testers who are not on a paid Q-Feeds subscription can use the promo code CALL-FOR-MITRE-TEST. It gives you 14 days of access to the premium feeds and the full MITRE mapping, so you can try the filters with the complete data set.
- Log in to the Q-Feeds Threat Intelligence Portal, or create a free account: tip.qfeeds.com
- Redeem the code at tip.qfeeds.com
- Attach the test license to an API key. Without this step the license will not be active for the plugin.
- Enter that API key in Security > Q-Feeds Connect > Settings, press Apply and run the update command from step 5 above.
Useful commands
# show your licensed feeds and when the next update is due
configctl qfeeds info
# force a full update now: download, MITRE index, aliases and DNS blocklists
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load
# show the MITRE tactics, techniques, software and groups known to the local database
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py get_ip_meta
# count the entries of an alias
pfctl -t __qfeeds_<name> -T show | wc -l
Reporting back
Please reply in this thread with:
- OPNsense version and plugin version (System > Firmware > Status)
- Hardware or VM specs
- What you tested, and what worked or did not work
- For problems: the output of the forced update command above, any errors from System > Log Files > Backend or General, and a screenshot where it helps
Reproducible bugs can also go straight to GitHub: github.com/opnsense/plugins/issues (please start the title with [os-q-feeds-connector-devel]).
A big thank you to Ad and the Deciso team for the work on this release, and thanks in advance to everyone who helps test it.
The Q-Feeds team
28 points
Mentions
That assumption may be incorrect, but I'm seeing a pattern where a simple "me too" is turned into an entire longform set of paragraphs (see attached) that could have been a single sentence, and completely ignores that opnsense just uses a vanilla subset of the upstream FreeBSD packages. (cont.)
OPNsense core: OPNsense GUI, API and systems backend (4.8k stars) What it does All text below is quoted directly from the project README. >OPNsense GUI, API and systems backend Makefile targets: - make package: A package of the current state of the repository can be created using this target. - make update: Update will pull the latest commits from the current branch from the upstream repository. - make upgrade: Upgrade will run the package build and replace the currently installed package in the system. - make collect: Fetch changes from the running system for all known files. - make lint: Run several syntax checks on the repository. - make style: Run the PSR12 and PEP8 style checks on MVC PHP code and Python, respectively. - make sweep: Run several automatic sanitizers on the code base. >OPNsense is and will always be available under the 2-Clause BSD license. Repository opnsense/core Repository stats |Metric|Value| |:-|:-| |Stars|4,754| |Forks|1,016| |Last release|None| |Languages|PHP 55.2%, Volt 13.2%, Python 10.3%| |Contributors|341| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|None| |AI co-authored commits|None| Main contributor |Field|Value| |:-|:-| |Name|Franco Fichtner| |GitHub|@fichtner| |Commits to this repo|10,073 (top contributor)| |Bio|I like nifty things. I read a lot. Sometimes I write stuff.| |Company / Location|Deciso / Lutzen, Germany| |Followers|305| |Public repos|25| |On GitHub since|2012-07-02| ────────────────────────────── 📌 How many great GitHub repos have you discovered and completely forgotten about? Don't let another useful tool disappear into your Reddit feed. Get the community's best repos, organized by category, plus key takeaways from real developer discussions, delivered to your inbox twice a week. 📬 Never lose track of great repos again. Subscribe free.
OPNsenseのVersion上げたらOSPFのNeighbor上がらなくてないた。 設定し直したらなおった。これか plugins#5787
Call for testers: Q-Feeds Connector with MITRE ATT&CK based firewall aliases Hi all, We are very excited about this release. With the new Q-Feeds Connector, OPNsense is, as far as we know, the first firewall in the world where you can build firewall rules directly on MITRE ATT&CK mapping: block or allow traffic based on the tactics, techniques, software and groups behind an IP address. The new version is available as a development package of the plugin (os-q-feeds-connector-devel). Before it goes to the production release, we would like as many people as possible to try it on real hardware with real traffic. If you use Q-Feeds today, or want to try it, your feedback is very welcome. What is new There is a new Security > Q-Feeds Connect > Firewall Aliases page. You create your own aliases and decide which IP addresses go into them, based on the full MITRE ATT&CK mapping: tactics, techniques, software and groups. Each of these has its own "include" and "exclude" selector, and every entry shows how many IP addresses it currently covers. Every alias you create appears as __qfeeds_<name> and can be used in firewall rules like the existing Q-Feeds aliases. For example, you can block every address linked to a specific threat group or malware family, or only log traffic tied to a certain technique. The default aliases (such as __qfeeds_malware_ip) are still created, so existing rules keep working. Please note: for now, the MITRE filters work for IP addresses only. Coming next In a future release we will also show the MITRE ATT&CK data on the Events tab, so you can see right away which tactics, techniques, software or groups a blocked connection is linked to. And we will also add this functionality to Unbound and DNScrypt-proxy. How to get it There is no need to switch your whole firewall to the development release. You only install the development version of the plugin, from the shell (SSH or console option 8): - Take a configuration backup first (System > Configuration > Backups). Use a lab or non-critical firewall if you can. - If you already have the Q-Feeds Connector installed, remove the current version first. Your settings and API key are kept: - pkg remove os-q-feeds-connector - Install the development version (version 1.7.d at the time of writing): - pkg install os-q-feeds-connector-devel - Check that your API key is filled in under Security > Q-Feeds Connect > Settings and press Apply. No paid subscription? Activate the promo license below first. - Force a full update, so the MITRE data is loaded right away. Everyone needs to do this once, both new installs and upgrades: - /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load - This can take a while. You should see lines like "downloaded ... entries", "database sync executed" and "load feed __qfeeds_...". To go back to the regular version later, run: pkg remove os-q-feeds-connector-devel pkg install os-q-feeds-connector No paid subscription? Test with 14 days of premium access Testers who are not on a paid Q-Feeds subscription can use the promo code CALL-FOR-MITRE-TEST. It gives you 14 days of access to the premium feeds and the full MITRE mapping, so you can try the filters with the complete data set. - Log in to the Q-Feeds Threat Intelligence Portal, or create a free account: tip.qfeeds.com - Redeem the code at tip.qfeeds.com - Attach the test license to an API key. Without this step the license will not be active for the plugin. - Enter that API key in Security > Q-Feeds Connect > Settings, press Apply and run the update command from step 5 above. Useful commands # show your licensed feeds and when the next update is due configctl qfeeds info # force a full update now: download, MITRE index, aliases and DNS blocklists /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load # show the MITRE tactics, techniques, software and groups known to the local database /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py get_ip_meta # count the entries of an alias pfctl -t __qfeeds_<name> -T show | wc -l Reporting back Please reply in this thread with: - OPNsense version and plugin version (System > Firmware > Status) - Hardware or VM specs - What you tested, and what worked or did not work - For problems: the output of the forced update command above, any errors from System > Log Files > Backend or General, and a screenshot where it helps Reproducible bugs can also go straight to GitHub: github.com/opnsense/plugins/issues (please start the title with [os-q-feeds-connector-devel]). A big thank you to Ad and the Deciso team for the work on this release, and thanks in advance to everyone who helps test it. The Q-Feeds team
WireGuard peer only connects once after reboot – looking for help diagnosing/fixing I'm running OPNsense 26.7.5-amd64 and have a strange WireGuard server problem. A WireGuard client can connect successfully once after an OPNsense reboot. If the client then disconnects, it cannot establish another handshake. This happens with multiple clients. The only thing that reliably restores connectivity is a complete OPNsense reboot. Immediately after reboot: 1. Client connects successfully. 1. Handshake occurs normally. 1. Traffic works. Client disconnects/reconnects: 1. Client sends a new handshake. 1. OPNsense receives the UDP traffic on WAN/51820. 1. No new WireGuard handshake is recorded. 1. The old latest handshake remains unchanged. 1. Client cannot reconnect. 1. Reboot OPNsense then client immediately works again. The problem occurs with more than one client. WireGuard is listening The FreeBSD WireGuard module is loaded The generated configuration and looks correct. Things I've tried and does not fix: - Restarting the WireGuard service - Disabling/re-enabling WireGuard in the GUI - Regenerating wg1.conf by changing/applying the GUI configuration - Destroying/recreating wg1 - configctl filter reload - Changing the FreeBSD routing algorithm from radix4_lockless to radix4 No additional NAT rules have been added. The existing OPNsense Source NAT configuration already includes the WG1 network, so I don't believe this is an outbound NAT configuration issue. What makes this strange is full reboot reliably resets whatever is broken, but restarting WireGuard itself doesn't. I feel the 26.7.3/4 update may have broken it. I've seen OPNsense GitHub reports such as #9597 and #10421 involving WireGuard peers becoming unable to reconnect despite packets reaching the firewall, but I'm not sure whether my problem is the same underlying issue. I'd really appreciate suggestions for how to identify what is actually getting stuck and reset it without rebooting the firewall. Any ideas?