The Traffic Shaper and a connection in hardware, measured, 2026-10-20¶
OPNsense's Traffic Shaper and its Captive Portal decide in ipfw, and ipfw sees a packet only while the host forwards it. A connection the coprocessor forwards itself never reaches it: it escapes a shaper's pipe, and a portal's client that logs out keeps what it had open. Nothing in this project knew that until today. Measured on the second XGS 3300, and fixed: whatever an enabled shaper rule or portal zone names is now kept with the host, as if the owner had put it on the never-offloaded list.
The whole page, with how it was taken and what it does not show: The Traffic Shaper and a connection in hardware, measured, 2026-10-20.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.