OPNSense/core 4f97172 — src/opnsense/mvc/app/library/OPNsense/Firewall FilterRule.php, src/opnsense/mvc/app/models/OPNsense/Routing Gateways.php

Revert "System: Gateways - fix protocol selection for dynamic interfaces without ipprotocol set and make sure policy based routing rules can use these for both protocols"

This reverts commit 5b6ccdb592729ddb5e001e5351125c00eb0dd43e.

It looks like there's no easy fix that satisfies exsiting and new setups, ref https://github.com/opnsense/core/issues/11117
DeltaFile
+0-3src/opnsense/mvc/app/models/OPNsense/Routing/Gateways.php
+0-1src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+0-42 files

OPNSense/core a45a3e3 — src/opnsense/mvc/app/library/OPNsense/Firewall SNatRule.php

Firewall: NAT: Source NAT - use getWellKnown() and properly validate port ranges, closes https://github.com/opnsense/core/issues/11122
DeltaFile
+9-1src/opnsense/mvc/app/library/OPNsense/Firewall/SNatRule.php
+9-11 files

OPNSense/core bc49b61 — src/opnsense/service/conf/actions.d actions_filter.conf actions_system.conf

backend: make all long TTLs indefinite
DeltaFile
+2-2src/opnsense/service/conf/actions.d/actions_system.conf
+2-2src/opnsense/service/conf/actions.d/actions_kea.conf
+2-2src/opnsense/service/conf/actions.d/actions_dnsmasq.conf
+1-1src/opnsense/service/conf/actions.d/actions_filter.conf
+7-74 files

OPNSense/core ac08367 — src/opnsense/mvc/app/library/OPNsense/Firewall FilterRule.php, src/opnsense/mvc/app/models/OPNsense/Routing Gateways.php

Revert "System: Gateways - fix protocol selection for dynamic interfaces without ipprotocol set and make sure policy based routing rules can use these for both protocols"

This reverts commit 5b6ccdb592729ddb5e001e5351125c00eb0dd43e.
DeltaFile
+0-3src/opnsense/mvc/app/models/OPNsense/Routing/Gateways.php
+0-1src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+0-42 files

OPNSense/core 50105e6 — src/opnsense/service/conf/actions.d actions_system.conf

system: cache sysctl gather indefinitely
DeltaFile
+1-1src/opnsense/service/conf/actions.d/actions_system.conf
+1-11 files

OPNSense/core 23949d1 — src/opnsense/service/modules/actions script_output.py

configd: support indefinite TTL, closes https://github.com/opnsense/core/issues/11113
DeltaFile
+2-1src/opnsense/service/modules/actions/script_output.py
+2-11 files

OPNSense/core 9faca36 — src/etc/inc filter.inc, src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms settings.xml

Firewall: Migrate remaining Miscellaneous advanced settings

Remove the legacy advanced firewall settings page.
DeltaFile
+0-472src/www/system_advanced_firewall.php
+124-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_7.php
+106-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+99-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+44-28src/etc/inc/filter.inc
+23-7src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_0_9.php
+396-5089 files not shown
+442-52915 files

OPNSense/core 3048994 — src/etc/inc filter.lib.inc, src/etc/inc/plugins.inc.d pf.inc

Firewall: Migrate Miscellaneous advanced settings (automatic rules)
DeltaFile
+0-105src/www/system_advanced_firewall.php
+80-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_6.php
+40-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+16-16src/etc/inc/filter.lib.inc
+25-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+3-3src/etc/inc/plugins.inc.d/pf.inc
+164-1257 files not shown
+177-13613 files

OPNSense/core 153d537 — src/etc/inc filter.inc filter.lib.inc, src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms settings.xml

Firewall: Migrate Logging advanced settings to new settings page
DeltaFile
+76-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_5.php
+0-67src/www/system_advanced_firewall.php
+36-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+23-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+5-6src/etc/inc/filter.inc
+6-5src/etc/inc/filter.lib.inc
+146-796 files not shown
+163-9412 files

OPNSense/core 69f81b6 — . plist, src/etc/inc filter.inc

Firewall: Migrate Schedules advanced settings to new settings page





DeltaFile
+60-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_4.php
+0-25src/www/system_advanced_firewall.php
+10-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+5-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+1-1src/etc/inc/filter.inc
+1-0plist
+77-276 files

OPNSense/core eeab04c — src/etc/inc filter.inc, src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms settings.xml

Firewall: Migrate Multi-WAN advanced settings to new settings page
DeltaFile
+0-88src/www/system_advanced_firewall.php
+72-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_3.php
+28-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+17-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+8-6src/opnsense/mvc/app/models/OPNsense/Core/InitialSetup.php
+4-2src/etc/inc/filter.inc
+129-976 files not shown
+142-10412 files

OPNSense/core 88a3fdb — . plist, src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms settings.xml

Firewall: Migrate Gateway Monitoring advanced settings to new settings page
DeltaFile
+60-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_2.php
+0-27src/www/system_advanced_firewall.php
+10-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+5-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+2-1src/opnsense/mvc/app/library/OPNsense/Firewall/Plugin.php
+1-0plist
+78-296 files

OPNSense/core d9575e1 — src/etc/inc/plugins.inc.d pf.inc, src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api SettingsController.php

Firewall: Migrate Bogon advanced settings to new settings page





DeltaFile
+60-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_1.php
+0-32src/www/system_advanced_firewall.php
+12-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+3-5src/etc/inc/plugins.inc.d/pf.inc
+8-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+3-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SettingsController.php
+86-391 files not shown
+87-397 files

OPNSense/core 3d0eb8a — src/etc/inc legacy_bindings.inc, src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms settings.xml

Firewall: Migrate NAT advanced settings to new settings page
DeltaFile
+68-0src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_1_0.php
+0-59src/www/system_advanced_firewall.php
+34-0src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/settings.xml
+13-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml
+11-0src/etc/inc/legacy_bindings.inc
+4-3src/opnsense/mvc/app/library/OPNsense/Firewall/Plugin.php
+130-631 files not shown
+131-637 files

OPNSense/core dc5312c — src/opnsense/scripts/captiveportal cp-background-process.py

captive portal: further restrict roaming to IPv6 client sessions
DeltaFile
+21-26src/opnsense/scripts/captiveportal/cp-background-process.py
+21-261 files

OPNSense/core 3cc9d6f — src/etc/inc system.inc filter.inc, src/opnsense/mvc/app/library/OPNsense/Firewall Plugin.php

Move the legacy compatability shim into legacy_bindings.inc
DeltaFile
+0-40src/etc/inc/filter_settings.inc
+11-0src/etc/inc/legacy_bindings.inc
+2-2src/www/guiconfig.inc
+0-3src/etc/inc/system.inc
+0-3src/etc/inc/filter.inc
+0-2src/opnsense/mvc/app/library/OPNsense/Firewall/Plugin.php
+13-507 files not shown
+13-5713 files

OPNSense/core 018affc — src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterBaseController.php, src/opnsense/mvc/app/library/OPNsense/System StaticRoute.php

Merge remote-tracking branch 'origin/master' into firewall-advanced-settings
DeltaFile
+1,308-0src/opnsense/www/js/opnsense_widgets.js
+0-892src/opnsense/www/js/opnsense_widget_manager.js
+467-0src/opnsense/mvc/app/library/OPNsense/System/StaticRoute.php
+244-0src/opnsense/www/js/widgets/HealthGraph.js
+168-31src/opnsense/www/js/opnsense_health.js
+111-72src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+2,298-995203 files not shown
+4,925-2,440209 files

OPNSense/core dffa908 — src/etc/inc system.inc, src/opnsense/scripts/system sysctl.py

system: invalidate sysctl cache on apply; closes #11109

As mentioned in 41ab7fb9f57 this fixes the glaring issue of the
sysctl cache being stuck while trying to avoid reloads during
normal operation.  The performance hit is solely in the apply
path with is already slow, but now at least syncs up with the
system each time which also means there is no more boot race.

Move the cache to the configd end, which is a more flexible
alternative nowadays.  We may want to support an indefinite
cache TTL, but that's not for the scope here.
DeltaFile
+3-14src/opnsense/scripts/system/sysctl.py
+2-1src/opnsense/service/conf/actions.d/actions_system.conf
+2-0src/etc/inc/system.inc
+7-153 files

OPNSense/core c08aeee — src/etc/inc system.inc, src/opnsense/scripts/system sysctl.py

system: appease @monviech
DeltaFile
+2-17src/opnsense/scripts/system/sysctl.py
+2-1src/opnsense/service/conf/actions.d/actions_system.conf
+1-1src/etc/inc/system.inc
+5-193 files

OPNSense/core 17f99ed — src/etc/inc system.inc, src/opnsense/scripts/system sysctl.py

system: invalidate sysctl cache on apply; closes #11109

As mentioned in 41ab7fb9f57 this fixes the glaring issue of the
sysctl cache being stuck while trying to avoid reloads during
normal operation.  The performance hit is solely in the apply
path with is already slow, but now at least syncs up with the
system each time which also means there is no more boot race.
DeltaFile
+5-1src/opnsense/scripts/system/sysctl.py
+2-2src/opnsense/service/conf/actions.d/actions_system.conf
+2-0src/etc/inc/system.inc
+9-33 files

OPNSense/core a21815e — src/opnsense/scripts/kea kea_prefix_watcher.py

routes is a better dictionary name, make logic easier to follow
DeltaFile
+30-27src/opnsense/scripts/kea/kea_prefix_watcher.py
+30-271 files

OPNSense/core c2e2de5 — src/etc/inc system.inc, src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api OverviewController.php

system: fix previous refactor
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/OverviewController.php
+1-1src/etc/inc/system.inc
+2-22 files

OPNSense/core 7ee5397 — src/opnsense/mvc/app/models/OPNsense/Interfaces Tap.php

src: style sweep
DeltaFile
+0-1src/opnsense/mvc/app/models/OPNsense/Interfaces/Tap.php
+0-11 files

OPNSense/core 18b3066 — src/opnsense/mvc/app/models/OPNsense/Core/FieldTypes TunableField.php, src/opnsense/scripts/system sysctl.py

system: TunableField: collect current values correctly; closes #11109

"gather" was never meant for runtime value access in 2022. When the
field was added in 2025 it seemed to overlook the fact that we need
to fetch the current values which are not accessible through MVC.
DeltaFile
+10-0src/opnsense/scripts/system/sysctl.py
+7-1src/opnsense/service/conf/actions.d/actions_system.conf
+3-0src/opnsense/mvc/app/models/OPNsense/Core/FieldTypes/TunableField.php
+20-13 files

OPNSense/core 167c468 — . plist

plist
DeltaFile
+7-0plist
+7-01 files

OPNSense/core c6a3d98 — src/etc/inc/plugins.inc.d tap.inc, src/opnsense/mvc/app/controllers/OPNsense/Interfaces TapController.php

Interfaces: Devices: TAP - add support for TAP devices which can be practical for Virtual machine networking (bhyve/QEMU). (#11110)
DeltaFile
+100-0src/etc/inc/plugins.inc.d/tap.inc
+74-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/TapSettingsController.php
+43-0src/opnsense/mvc/app/models/OPNsense/Interfaces/Tap.php
+39-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/TapController.php
+23-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogTap.xml
+18-0src/opnsense/mvc/app/views/OPNsense/Interface/tap.volt
+297-04 files not shown
+326-010 files

OPNSense/core f70fbef — src/etc/inc/plugins.inc.d tap.inc, src/opnsense/mvc/app/controllers/OPNsense/Interfaces TapController.php

Interfaces: Devices: TAP - add support for TAP devices which can be practical for Virtual machine networking (bhyve/QEMU).
DeltaFile
+100-0src/etc/inc/plugins.inc.d/tap.inc
+74-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/Api/TapSettingsController.php
+43-0src/opnsense/mvc/app/models/OPNsense/Interfaces/Tap.php
+39-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/TapController.php
+23-0src/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogTap.xml
+18-0src/opnsense/mvc/app/views/OPNsense/Interface/tap.volt
+297-04 files not shown
+326-010 files

OPNSense/core 2772165 — src/opnsense/mvc/app/views/OPNsense/Routes index.volt

System: Routes: Configuration - use badge for group count.
DeltaFile
+1-1src/opnsense/mvc/app/views/OPNsense/Routes/index.volt
+1-11 files

OPNSense/core 53c787d — src/opnsense/mvc/app/controllers/OPNsense/Routes/Api RoutesController.php, src/opnsense/mvc/app/views/OPNsense/Routes index.volt

System: Routes: Configuration - group ECMP routes and signal the user when mode is disabled, closes https://github.com/opnsense/core/issues/10569
DeltaFile
+58-10src/opnsense/mvc/app/views/OPNsense/Routes/index.volt
+13-0src/opnsense/mvc/app/controllers/OPNsense/Routes/Api/RoutesController.php
+71-102 files

OPNSense/core 9697800 — src/opnsense/mvc/app/controllers/OPNsense/Core/Api SnapshotsController.php

System: Snapshots - always enforce note directory to be owned by "wwwonly:wheel" as configured to prevent notes created by the ui in root mode not being readable when switching to wwwonly.

(cherry picked from commit f81d527a436e5376cbac112ac444a5e54b7fdc93)
DeltaFile
+5-0src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SnapshotsController.php
+5-01 files