Skip to content

change default OPNsense anchor placement #359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wojcik91 wants to merge 3 commits into
base: stable/2.x
Choose a base branch
from
Draft

change default OPNsense anchor placement #359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1cb256b
change default anchor setup
wojcik91 Jul 31, 2026
9eeed4c
expose anchor placement as advanced settings
wojcik91 Jul 31, 2026
0c89410
bump version
wojcik91 Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "defguard-gateway"
version = "2.0.3"
version = "2.0.4"
edition = "2024"
rust-version = "1.95"

Expand Down
9 changes: 8 additions & 1 deletion opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,5 +81,12 @@ function defguardgateway_firewall($fw)

// $fw->registerAnchor('defguard/*', 'nat', 1, 'head');
// $fw->registerAnchor('defguard/*', 'rdr', 1, 'head');
$fw->registerAnchor('defguard/*', 'fw', 1, 'head', true);
// IMPORTANT: never register this anchor as 'quick'. On FreeBSD 15+
// (OPNsense 26.7+), a 'quick' anchor short-circuits the parent ruleset
// even when no inner rule matches, silently skipping OPNsense's own
// firewall rules.
$model = new OPNsense\DefguardGateway\DefguardGateway();
$placement = (string) $model->general->FwAnchorPlacement ?: 'tail';
$quick = (string) $model->general->FwAnchorQuick === '1';
$fw->registerAnchor('defguard/*', 'fw', 1, $placement, $quick);
}
14 changes: 14 additions & 0 deletions opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,4 +134,18 @@
<help>Directory where the gateway stores generated gRPC certificates.</help>
<hint>Default value: /etc/defguard/certs</hint>
</field>
<field>
<id>defguardgateway.general.FwAnchorPlacement</id>
<label>Firewall anchor placement</label>
<type>dropdown</type>
<help>Where in the pf ruleset the Defguard anchor is inserted. Tail (default) evaluates OPNsense rules first; Head places Defguard rules before OPNsense rules.</help>
<advanced>true</advanced>
</field>
<field>
<id>defguardgateway.general.FwAnchorQuick</id>
<label>Quick anchor (dangerous)</label>
<type>checkbox</type>
<help>Make the Defguard anchor 'quick'. WARNING: on OPNsense 26.7+ (FreeBSD 15.1+) this short-circuits the parent ruleset even when no inner rule matches, silently bypassing OPNsense's own firewall rules. Leave disabled unless you fully understand the risk.</help>
<advanced>true</advanced>
</field>
</form>
12 changes: 12 additions & 0 deletions opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,18 @@
<default>/etc/defguard/certs</default>
<Required>Y</Required>
</CertDir>
<FwAnchorPlacement type="OptionField">
<default>tail</default>
<Required>Y</Required>
<OptionValues>
<tail>Tail (evaluate after OPNsense rules)</tail>
<head>Head (evaluate before OPNsense rules)</head>
</OptionValues>
</FwAnchorPlacement>
<FwAnchorQuick type="BooleanField">
<default>0</default>
<Required>Y</Required>
</FwAnchorQuick>
</general>
</items>
</model>
Loading