From 1cb256bead219932478750af439c81545ef781f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Fri, 31 Jul 2026 11:22:28 +0200
Subject: [PATCH 1/3] change default anchor setup

---
 opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
index 5584a3b4..7b2ce77a 100644
--- a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
+++ b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
@@ -81,5 +81,9 @@ function defguardgateway_firewall($fw)
 
     // $fw->registerAnchor('defguard/*', 'nat', 1, 'head');
     // $fw->registerAnchor('defguard/*', 'rdr', 1, 'head');
-    $fw->registerAnchor('defguard/*', 'fw', 1, 'head', true);
+    // IMPORTANT: never register this anchor as 'quick'. On FreeBSD 15+
+    // (OPNsense 26.7+), a 'quick' anchor short-circuits the parent ruleset
+    // even when no inner rule matches, silently skipping OPNsense's own
+    // firewall rules.
+    $fw->registerAnchor('defguard/*', 'fw', 1, 'tail', false);
 }

From 9eeed4c57d33ebe517be6e0ed1f987bb0f8db00e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Fri, 31 Jul 2026 11:58:49 +0200
Subject: [PATCH 2/3] expose anchor placement as advanced settings

---
 .../src/etc/inc/plugins.inc.d/defguardgateway.inc  |  5 ++++-
 .../OPNsense/DefguardGateway/forms/general.xml     | 14 ++++++++++++++
 .../OPNsense/DefguardGateway/DefguardGateway.xml   | 12 ++++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
index 7b2ce77a..3696a19f 100644
--- a/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
+++ b/opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
@@ -85,5 +85,8 @@ function defguardgateway_firewall($fw)
     // (OPNsense 26.7+), a 'quick' anchor short-circuits the parent ruleset
     // even when no inner rule matches, silently skipping OPNsense's own
     // firewall rules.
-    $fw->registerAnchor('defguard/*', 'fw', 1, 'tail', false);
+    $model = new OPNsense\DefguardGateway\DefguardGateway();
+    $placement = (string) $model->general->FwAnchorPlacement ?: 'tail';
+    $quick = (string) $model->general->FwAnchorQuick === '1';
+    $fw->registerAnchor('defguard/*', 'fw', 1, $placement, $quick);
 }
diff --git a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
index 3b9b81e2..29709dad 100644
--- a/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
+++ b/opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
@@ -134,4 +134,18 @@
     <help>Directory where the gateway stores generated gRPC certificates.</help>
     <hint>Default value: /etc/defguard/certs</hint>
   </field>
+  <field>
+    <id>defguardgateway.general.FwAnchorPlacement</id>
+    <label>Firewall anchor placement</label>
+    <type>dropdown</type>
+    <help>Where in the pf ruleset the Defguard anchor is inserted. Tail (default) evaluates OPNsense rules first; Head places Defguard rules before OPNsense rules.</help>
+    <advanced>true</advanced>
+  </field>
+  <field>
+    <id>defguardgateway.general.FwAnchorQuick</id>
+    <label>Quick anchor (dangerous)</label>
+    <type>checkbox</type>
+    <help>Make the Defguard anchor 'quick'. WARNING: on OPNsense 26.7+ (FreeBSD 15.1+) this short-circuits the parent ruleset even when no inner rule matches, silently bypassing OPNsense's own firewall rules. Leave disabled unless you fully understand the risk.</help>
+    <advanced>true</advanced>
+  </field>
 </form>
diff --git a/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml b/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
index 5c0a8ee8..d7e0562c 100644
--- a/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
+++ b/opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
@@ -90,6 +90,18 @@
         <default>/etc/defguard/certs</default>
         <Required>Y</Required>
       </CertDir>
+      <FwAnchorPlacement type="OptionField">
+        <default>tail</default>
+        <Required>Y</Required>
+        <OptionValues>
+          <tail>Tail (evaluate after OPNsense rules)</tail>
+          <head>Head (evaluate before OPNsense rules)</head>
+        </OptionValues>
+      </FwAnchorPlacement>
+      <FwAnchorQuick type="BooleanField">
+        <default>0</default>
+        <Required>Y</Required>
+      </FwAnchorQuick>
     </general>
   </items>
 </model>

From 0c89410166a483c67b9018bd79dde3a31b304846 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Fri, 31 Jul 2026 12:03:47 +0200
Subject: [PATCH 3/3] bump version

---
 Cargo.lock | 2 +-
 Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index aa509d2e..a2789800 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -808,7 +808,7 @@ checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "defguard-gateway"
-version = "2.0.3"
+version = "2.0.4"
 dependencies = [
  "axum",
  "base64 0.22.1",
diff --git a/Cargo.toml b/Cargo.toml
index 6891fb1b..53deb3d0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "defguard-gateway"
-version = "2.0.3"
+version = "2.0.4"
 edition = "2024"
 rust-version = "1.95"