Skip to content

port OPNsense plugin fix from stable #366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wojcik91 merged 3 commits into from
Aug 11, 2026
Merged

port OPNsense plugin fix from stable #366

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
04f081d
port opnsense plugin fix
wojcik91 Aug 11, 2026
ee0276c
update nftnl
wojcik91 Aug 11, 2026
f7c0224
cleanup
wojcik91 Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ tracing = "0.1"
tracing-subscriber = "0.3"

[target.'cfg(target_os = "linux")'.dependencies]
nftnl = { git = "https://github.com/DefGuard/nftnl-rs.git", rev = "abd34b08c53b88a47346da6362e360d522cf8ca2" }
nftnl = "0.9"
mnl = "0.3"

[dev-dependencies]
Expand Down
9 changes: 8 additions & 1 deletion opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,5 +81,12 @@ function defguardgateway_firewall($fw)

// $fw->registerAnchor('defguard/*', 'nat', 1, 'head');
// $fw->registerAnchor('defguard/*', 'rdr', 1, 'head');
$fw->registerAnchor('defguard/*', 'fw', 1, 'head', true);
// IMPORTANT: never register this anchor as 'quick'. On FreeBSD 15+
// (OPNsense 26.7+), a 'quick' anchor short-circuits the parent ruleset
// even when no inner rule matches, silently skipping OPNsense's own
// firewall rules.
$model = new OPNsense\DefguardGateway\DefguardGateway();
$placement = (string) $model->general->FwAnchorPlacement ?: 'tail';
$quick = (string) $model->general->FwAnchorQuick === '1';
$fw->registerAnchor('defguard/*', 'fw', 1, $placement, $quick);
}
9 changes: 9 additions & 0 deletions opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/Api/ServiceController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,13 @@ class ServiceController extends ApiMutableServiceControllerBase
protected static $internalServiceClass = "\OPNsense\DefguardGateway\DefguardGateway";
protected static $internalServiceTemplate = "OPNsense/DefguardGateway";
protected static $internalServiceEnabled = "general.Enabled";

/**
* The 'defguard/*' anchor is hooked into the ruleset by defguardgateway_firewall().
* Changes only take effect once the filter is reloaded.
*/
protected function invokeFirewallReload()
{
return true;
}
}
14 changes: 14 additions & 0 deletions opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,4 +134,18 @@
<help>Directory where the gateway stores generated gRPC certificates.</help>
<hint>Default value: /etc/defguard/certs</hint>
</field>
<field>
<id>defguardgateway.general.FwAnchorPlacement</id>
<label>Firewall anchor placement</label>
<type>dropdown</type>
<help>Where in the pf ruleset the Defguard anchor is inserted. Tail (default) evaluates OPNsense rules first; Head places Defguard rules before OPNsense rules.</help>
<advanced>true</advanced>
</field>
<field>
<id>defguardgateway.general.FwAnchorQuick</id>
<label>Quick anchor (dangerous)</label>
<type>checkbox</type>
<help>Make the Defguard anchor 'quick'. WARNING: on OPNsense 26.7+ (FreeBSD 15.1+) this short-circuits the parent ruleset even when no inner rule matches, silently bypassing OPNsense's own firewall rules. Leave disabled unless you fully understand the risk.</help>
<advanced>true</advanced>
</field>
</form>
12 changes: 12 additions & 0 deletions opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,18 @@
<default>/etc/defguard/certs</default>
<Required>Y</Required>
</CertDir>
<FwAnchorPlacement type="OptionField">
<default>tail</default>
<Required>Y</Required>
<OptionValues>
<tail>Tail (evaluate after OPNsense rules)</tail>
<head>Head (evaluate before OPNsense rules)</head>
</OptionValues>
</FwAnchorPlacement>
<FwAnchorQuick type="BooleanField">
<default>0</default>
<Required>Y</Required>
</FwAnchorQuick>
</general>
</items>
</model>
3 changes: 2 additions & 1 deletion src/enterprise/firewall/nftables/netfilter.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,8 @@ fn add_rule_comment(rule: &mut Rule, comment: &str) -> Result<(), FirewallError>
"Failed to create CString from string {comment}. Error: {e:?}"
))
})?;
rule.set_comment(comment);
rule.set_comment(comment)
.map_err(|err| FirewallError::NetlinkError(err.into()))?;
debug!("Added comment to nftables expression: {comment:?}");
Ok(())
}
Expand Down
2 changes: 1 addition & 1 deletion src/enterprise/firewall/packetfilter/api.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ impl FirewallManagementApi for FirewallApi {

for rule in rules {
if let Err(err) = self.add_rule(rule, ticket, pool_ticket, anchor) {
error!("Firewall rule {} can't be added", &rule.id);
error!("Firewall rule {} can't be added", rule.id);
debug!("Rollback pf transaction");
// Rule cannot be added, so rollback.
let result = unsafe { ioctl(self.fd(), DIOCXROLLBACK, &raw mut ioc_trans) };
Expand Down
Loading