11.2
opnsense
Disable the pf ftp proxy handler.
debug.pfftpproxy
default
Increase UFS read-ahead speeds to match current state of hard drives and NCQ. More information here: http://ivoras.sharanet.org/blog/tree/2010-11-19.ufs-read-ahead.html
vfs.read_max
default
Set the ephemeral port range to be lower.
net.inet.ip.portrange.first
default
Drop packets to closed TCP ports without returning a RST
net.inet.tcp.blackhole
default
Do not send ICMP port unreachable messages for closed UDP ports
net.inet.udp.blackhole
default
Randomize the ID field in IP packets (default is 0: sequential IP IDs)
net.inet.ip.random_id
default
Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway)
net.inet.tcp.drop_synfin
default
Enable sending IPv4 redirects
net.inet.ip.redirect
default
Enable sending IPv6 redirects
net.inet6.ip6.redirect
default
Enable privacy settings for IPv6 (RFC 4941)
net.inet6.ip6.use_tempaddr
default
Prefer privacy addresses and use them over the normal addresses
net.inet6.ip6.prefer_tempaddr
default
Generate SYN cookies for outbound SYN-ACK packets
net.inet.tcp.syncookies
default
Maximum incoming/outgoing TCP datagram size (receive)
net.inet.tcp.recvspace
default
Maximum incoming/outgoing TCP datagram size (send)
net.inet.tcp.sendspace
default
IP Fastforwarding
net.inet.ip.fastforwarding
default
Do not delay ACK to try and piggyback it onto a data packet
net.inet.tcp.delayed_ack
default
Maximum outgoing UDP datagram size
net.inet.udp.maxdgram
default
Handling of non-IP packets which are not passed to pfil (see if_bridge(4))
net.link.bridge.pfil_onlyip
default
Set to 0 to disable filtering on the incoming and outgoing member interfaces.
net.link.bridge.pfil_member
default
Set to 1 to enable filtering on the bridge interface
net.link.bridge.pfil_bridge
default
Allow unprivileged access to tap(4) device nodes
net.link.tap.user_open
default
Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid())
kern.randompid
default
Maximum size of the IP input queue
net.inet.ip.intr_queue_maxlen
default
Disable CTRL+ALT+Delete reboot from keyboard.
hw.syscons.kbd_reboot
default
Enable TCP extended debugging
net.inet.tcp.log_debug
default
Set ICMP Limits
net.inet.icmp.icmplim
default
TCP Offload Engine
net.inet.tcp.tso
default
UDP Checksums
net.inet.udp.checksum
default
Maximum socket buffer size
kern.ipc.maxsockbuf
default
normal
OPNsense
localdomain
all
All Users
system
1998
- 0
admins
System Administrators
system
1999
- 0
page-all
root
System Administrator
system
admins
$6$$Y8Et6wWDdXO2tJZRabvSfQvG2Lc8bAS6D9COIsMXEJ2KjA27wqDuAyd/CdazBQc3H3xQX.JXMKxJeRz2OqTkl.
0
user-shell-access
6236393534643264633361623266386435346633383365643836616631626133
2000
2000
Africa/Abidjan
0.nl.pool.ntp.org
https
1
55a674a3abc80
2
yes
1
hadp
hadp
hadp
monthly
1
en_US
none
none
none
none
1
enabled
enabled
115200
serial
8.8.8.8
1
1
em1
172.18.0.101
dhcpv6
24
WANGW
0
1
em0
192.168.1.10
24
track6
64
wan
0
PFSYNC
em2
1
10.0.0.1
24
1
192.168.1.10
192.168.1.245
192.168.1.20
192.168.1.1
192.168.1.1
public
advanced
wan

              127.0.0.0/8

500
1
1
Auto created rule for ISAKMP - localhost to WAN
1436974583
Manual Outbound NAT Switch
wan

              127.0.0.0/8

1
Auto created rule - localhost to WAN
1436974583
Manual Outbound NAT Switch

              192.168.1.0/24

Auto created rule for ISAKMP - LAN to WAN
172.18.0.100
0
wan 1 1 500 1436974583 Manual Outbound NAT Switch 1436978113 root@192.168.1.127

              192.168.1.0/24

Auto created rule - LAN to WAN
172.18.0.100
0
wan 1 1436974583 Manual Outbound NAT Switch 1436974663 root@192.168.1.100
wan

              10.0.0.1/32

500
1
1
Auto created rule for ISAKMP - PFSYNC to WAN
1436974583
Manual Outbound NAT Switch
wan

              10.0.0.1/32

1
Auto created rule - PFSYNC to WAN
1436974583
Manual Outbound NAT Switch
pass wan inet `` keep state carp

            1

1
1437033188
root@192.168.1.127
1437033188
root@192.168.1.127
pass inet Default allow LAN to any rule lan

            lan

pass inet6 Default allow LAN IPv6 to any rule lan

            lan

pass opt1 inet `` keep state

            1

1
1436974315
root@192.168.1.100
1436974971
root@192.168.1.100
1,31
0-5
*
*
*
root
adjkerntz -a
1
3
1
*
*
root
/usr/local/etc/rc.update_bogons
*/60
*
*
*
*
root
/usr/local/sbin/expiretable -v -t 3600 sshlockout
1
1
*
*
*
root
/usr/local/etc/rc.dyndns.update
*/60
*
*
*
*
root
/usr/local/sbin/expiretable -v -t 3600 virusprot
30
12
*
*
*
root
/usr/local/etc/rc.update_urltables
ICMP
icmp ICMP
TCP
tcp Generic TCP
HTTP
http Generic HTTP / `200`
HTTPS
https Generic HTTPS / `200`
SMTP
send Generic SMTP 220 *
system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interface_list-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close
1437058742
root@192.168.1.127: Updated High Availability configuration
root@192.168.1.127
55a674a3abc80
webConfigurator default
wan 172.18.0.250 WANGW 1 inet WAN Gateway 1 1
carp
wan 1 0 1 opnsense VIP WANx single 24 172.18.0.100
carp
lan 3 0 1 opnsense VIP LAN single 24 192.168.1.1
on
on
on
10.0.0.2
opt1
10.0.0.2
root
opnsense
on
on
on