{"id":24925,"date":"2026-09-05T15:14:19","date_gmt":"2026-09-05T19:14:19","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=24925"},"modified":"2026-09-05T15:15:42","modified_gmt":"2026-09-05T19:15:42","slug":"dont-forget-about-bogons","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2026\/09\/05\/dont-forget-about-bogons\/","title":{"rendered":"Don’t Forget about Bogons…"},"content":{"rendered":"
\n
\"\"<\/a>
OPNsense 25.7.1 incorrectly states that the bogons list does not contain RFC 1918 addresses.<\/figcaption><\/figure>\n<\/div>\n\n\n

After a severe round of early September storms here in Southeast Michigan we’re in the midst of a multi-day power-and-internet outage. While mobile hot spots were kinda working, it was also a pain not having the normal network up, especially as I troubleshot why some Home Assistant devices didn’t come back online. So I set out to up our normal network with a tethered mobile phone as its public internet link instead of the cable modem.<\/p>\n\n\n\n

This was super-easy to do, in general, using the aforementioned GL-MT3000<\/a> reset to defaults\u2020, connected to an iPhone, in basic router mode, and plugged into the WAN port of my OPNsense<\/a> router (replacing the cable modem). I did this instead of connecting the iPhone directly because OPNsense doesn’t have all the drivers needed loaded by default — changes I didn’t want to make for a temporary solution — and the router is down in the basement where cell phone signal isn’t quite as good.<\/p>\n\n\n

\n
\"\"<\/a>
GL-MT3000 tethered to an iPhone.<\/figcaption><\/figure>\n<\/div>\n\n\n

(While I considered setting up multi-WAN with failover mode, this is a really rare occurrence, and I won’t be keeping the phone connected after Wide Open West<\/a> comes back online, so replacing the cable modem was much cleaner and simpler.)<\/p>\n\n\n\n

I did run into one wrinkle, though: bogons<\/a>. OPNsense (25.7.1, at least) has an option to block RFC 1918<\/a> (private address<\/a>) and bogon network<\/a> ranges, but states that RFC 1918 addresses are not included. This is wrong.<\/p>\n\n\n\n

I’d previously had both of these options enabled and unchecked the RFC 1918 box when switching around the interface. This was another fifteen minutes of frustration of looking for something else I was missing before I read the actual bogons list and saw the cause of the problem. Unchecked the bogons box in OPNsense and poof, everything worked.<\/p>\n\n\n\n

(Specifically, the internal (LAN\/WLAN) default GL-MT3000 config is 192.168.8.0\/24. Because OPNsense WAN interface got its address from there, with the bogon boxe checked on this interface interface, the OPNsense router would not forward traffic from the GL-MT3000 internal network. Yet traffic from the OPNsense box itself, via shell utilities, flowed fine to and from that interface, so that misled me for a bit.)<\/p>\n\n\n\n

Guess I need to submit a PR to the OPNsense project to fix those documents, or at least open a bug. Maybe once the main network is back up…<\/p>\n\n\n\n

\u2020 Thanks to the lovely brownout, my GL-MT3000 would no longer boot. I had to use the Debrick via Uboot<\/a> process to get it working again. Fortunately it wasn’t actually-dead. And now I’ll have to put back the IPv6 tunnel stuff… But at least that’s documented.<\/p>\n","protected":false},"excerpt":{"rendered":"

After a severe round of early September storms here in Southeast Michigan we’re in the midst of a multi-day power-and-internet outage. While mobile hot spots were kinda working, it was also a pain not having the normal network up, especially as I troubleshot why some Home Assistant devices didn’t come back online. So I set\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,13],"tags":[],"class_list":["post-24925","post","type-post","status-publish","format-standard","hentry","category-around-the-house","category-computers"],"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=24925"}],"version-history":[{"count":2,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24925\/revisions"}],"predecessor-version":[{"id":24931,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24925\/revisions\/24931"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=24925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=24925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=24925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}