diff --git a/Cargo.lock b/Cargo.lock
index aa509d2e..a2789800 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -808,7 +808,7 @@ checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
[[package]]
name = "defguard-gateway"
-version = "2.0.3"
+version = "2.0.4"
dependencies = [
"axum",
"base64 0.22.1",
diff --git a/Cargo.toml b/Cargo.toml
index 6891fb1b..53deb3d0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "defguard-gateway"
-version = "2.0.3"
+version = "2.0.4"
edition = "2024"
rust-version = "1.95"
diff --git a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
index 5584a3b4..3696a19f 100644
--- a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
+++ b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
@@ -81,5 +81,12 @@ function defguardgateway_firewall($fw)
// $fw->registerAnchor('defguard/*', 'nat', 1, 'head');
// $fw->registerAnchor('defguard/*', 'rdr', 1, 'head');
- $fw->registerAnchor('defguard/*', 'fw', 1, 'head', true);
+ // IMPORTANT: never register this anchor as 'quick'. On FreeBSD 15+
+ // (OPNsense 26.7+), a 'quick' anchor short-circuits the parent ruleset
+ // even when no inner rule matches, silently skipping OPNsense's own
+ // firewall rules.
+ $model = new OPNsense\DefguardGateway\DefguardGateway();
+ $placement = (string) $model->general->FwAnchorPlacement ?: 'tail';
+ $quick = (string) $model->general->FwAnchorQuick === '1';
+ $fw->registerAnchor('defguard/*', 'fw', 1, $placement, $quick);
}
diff --git a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
index 3b9b81e2..29709dad 100644
--- a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
+++ b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
@@ -134,4 +134,18 @@
Directory where the gateway stores generated gRPC certificates.
Default value: /etc/defguard/certs
+
+ defguardgateway.general.FwAnchorPlacement
+
+ dropdown
+ Where in the pf ruleset the Defguard anchor is inserted. Tail (default) evaluates OPNsense rules first; Head places Defguard rules before OPNsense rules.
+ true
+
+
+ defguardgateway.general.FwAnchorQuick
+
+ checkbox
+ Make the Defguard anchor 'quick'. WARNING: on OPNsense 26.7+ (FreeBSD 15.1+) this short-circuits the parent ruleset even when no inner rule matches, silently bypassing OPNsense's own firewall rules. Leave disabled unless you fully understand the risk.
+ true
+
diff --git a/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml b/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
index 5c0a8ee8..d7e0562c 100644
--- a/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
+++ b/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
@@ -90,6 +90,18 @@
/etc/defguard/certs
Y
+
+ tail
+ Y
+
+ Tail (evaluate after OPNsense rules)
+ Head (evaluate before OPNsense rules)
+
+
+
+ 0
+ Y
+