Skip to content

XML Field Reference

This reference documents the OPNsense config.xml fields that opnDossier parses and validates, with XML examples showing each field's usage. This is useful for understanding how OPNsense represents configuration in XML.

Source and Destination Fields

Firewall rule source and destination support multiple addressing modes. The fields any, network, and address are mutually exclusive -- only one should be present per source/destination block.

Address-based rules (IP/CIDR or alias):

<source>
  <address>192.168.1.0/24</address>
  <port>1024-65535</port>
</source>

Network-based rules (interface subnet):

<source>
  <network>lan</network>
</source>

Negated rules (NOT semantics):

<source>
  <not />
  <network>lan</network>
</source>

Any address:

<source>
  <any />
</source>

Field priority: Network > Address > Any (per OPNsense semantics)

Advanced Rule Fields

Floating rules (interface-independent):

<rule>
  <floating>yes</floating>
  <direction>any</direction>
  <interface>wan,lan</interface>
  ...
</rule>

Floating rules require a direction field (in, out, or any).

Policy routing:

<rule>
  <gateway>WAN_GW</gateway>
  ...
</rule>

State tracking:

<rule>
  <statetype>keep state</statetype>
  <statetimeout>3600</statetimeout>
  ...
</rule>

Valid state types: keep state, sloppy state, synproxy state, none

Rate-Limiting and DoS Protection

Connection limits:

<rule>
  <max-src-nodes>100</max-src-nodes>
  <max-src-conn>10</max-src-conn>
  <max-src-conn-rate>15/5</max-src-conn-rate>
  <max-src-conn-rates>300</max-src-conn-rates>
  ...
</rule>

The max-src-conn-rate field uses the format connections/seconds (e.g., 15/5 means 15 connections per 5 seconds).

TCP flags matching:

<rule>
  <tcpflags1>syn</tcpflags1>
  <tcpflags2>syn,ack</tcpflags2>
  ...
</rule>

ICMP type filtering:

<rule>
  <protocol>icmp</protocol>
  <icmptype>3,11,0</icmptype>
  ...
</rule>

NAT Rule Enhancements

Outbound NAT with port preservation:

<rule>
  <staticnatport />
  <natport>1024-65535</natport>
  <poolopts_sourcehashkey>0x12345678</poolopts_sourcehashkey>
  ...
</rule>

NAT exclusion:

<rule>
  <nonat />
  ...
</rule>

Inbound NAT with reflection:

<rule>
  <natreflection>enable</natreflection>
  <associated-rule-id>5f1234567890abcd</associated-rule-id>
  <local-port>8080</local-port>
  ...
</rule>

Valid NAT reflection modes: enable, disable, purenat