net/cloudflared: new plugin for Cloudflare Tunnel integration #5429
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| BSD 2-Clause License | ||
|
|
||
| Copyright (c) 2026, Alan Martines, Richard Aspden | ||
|
|
||
| Redistribution and use in source and binary forms, with or without | ||
| modification, are permitted provided that the following conditions are met: | ||
|
|
||
| 1. Redistributions of source code must retain the above copyright notice, this | ||
| list of conditions and the following disclaimer. | ||
|
|
||
| 2. Redistributions in binary form must reproduce the above copyright notice, | ||
| this list of conditions and the following disclaimer in the documentation | ||
| and/or other materials provided with the distribution. | ||
|
|
||
| THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" | ||
| AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
| IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | ||
| DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE | ||
| FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | ||
| DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR | ||
| SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER | ||
| CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, | ||
| OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | ||
| OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| PLUGIN_NAME= cloudflared | ||
| PLUGIN_VERSION= 0.1.0 | ||
| PLUGIN_REVISION= 1 | ||
| PLUGIN_COMMENT= Cloudflare Tunnel (cloudflared) integration | ||
| PLUGIN_MAINTAINER= rick+github@insanityinside.net | ||
| PLUGIN_DEPENDS= cloudflared | ||
|
|
||
| .include "../../Mk/plugins.mk" |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| Cloudflare Tunnel (cloudflared) integration for OPNsense. | ||
|
|
||
| Provides a native MVC interface to manage token-based Cloudflare Zero | ||
| Trust tunnels without opening firewall ports or requiring a static IP. | ||
| Uses the cloudflared binary from the FreeBSD ports collection | ||
| (net/cloudflared). | ||
|
|
||
| Features: | ||
| - Token-based tunnel authentication via Cloudflare Zero Trust | ||
| - Transport protocol selection: Auto (QUIC with HTTP/2 fallback), | ||
| QUIC-only, or HTTP/2-only | ||
| - Automatic outbound firewall rules for QUIC (UDP 7844) and HTTP/2 (TCP 7844) | ||
| - QUIC kernel tuning (kern.ipc.maxsockbuf, net.inet.udp.recvspace) | ||
| - Post-quantum encryption support (--post-quantum) | ||
| - Real-time tunnel health status in the UI | ||
| - Log viewer with pagination and live follow mode | ||
| - Automatic crash recovery and restart on WAN IP change | ||
| - Appears in System: Diagnostics: Services | ||
|
|
||
| WWW: https://github.com/cloudflare/cloudflared |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # DO NOT EDIT THIS FILE -- OPNsense auto-generated file | ||
| # | ||
| # User-defined crontab files can be loaded via /etc/cron.d | ||
| # or /usr/local/etc/cron.d and follow the same format as | ||
| # /etc/crontab, see the crontab(5) manual page. | ||
| SHELL=/bin/sh | ||
| PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin | ||
| #minute hour mday month wday who command | ||
| * * * * * root /usr/local/opnsense/scripts/OPNsense/Cloudflared/monitor.sh | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * Copyright (C) 2026 Alan Martines <alancpmartines@hotmail.com> | ||
| * Copyright (C) 2026 Richard Aspden <rick+github@insanityinside.net> | ||
| * All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, | ||
| * this list of conditions and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright | ||
| * notice, this list of conditions and the following disclaimer in the | ||
| * documentation and/or other materials provided with the distribution. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, | ||
| * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY | ||
| * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | ||
| * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, | ||
| * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | ||
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | ||
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN | ||
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | ||
| * POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| function cloudflared_enabled() | ||
| { | ||
| $model = new \OPNsense\Cloudflared\Cloudflared(); | ||
| return (string)$model->general->enabled == '1'; | ||
| } | ||
|
|
||
| function cloudflared_configure() | ||
| { | ||
| return [ | ||
| 'newwanip' => ['cloudflared_configure_newwanip:10'], | ||
|
Member
There was a problem hiding this comment. Why would that be needed, cloudflare should bind to the * (any) socket, so it won't crash when some IP address changes.
Author
There was a problem hiding this comment. It's weird behaviour that came up in real-world testing, if it came started before the WAN was up and it couldn't resolve the Cloudflare router IPs. If it can't resolve them on startup, the process exits. It was a belt and braces approach. Can't explain the :10 though, that's a Claude special.
Member
There was a problem hiding this comment. For the code you are using the default number of parameters is ok which is 1 so you can omit the ":10" completely. |
||
| 'newwanip6' => ['cloudflared_configure_newwanip:10'], | ||
|
Author
There was a problem hiding this comment. Oops. Nice hallucination. 🤦🏻♂️ |
||
| ]; | ||
| } | ||
|
|
||
| function cloudflared_configure_newwanip($verbose = false) | ||
| { | ||
| if (!cloudflared_enabled()) { | ||
| return; | ||
| } | ||
| if (file_exists('/var/run/cloudflared.stopped')) { | ||
|
Member
There was a problem hiding this comment. usually we get around these special magic files unless we're dealing with difficult scenarios such as CARP which are decoupled in cause and effect
Author
There was a problem hiding this comment. The reason I put that in there was to stop the cronjob auto-restarting the daemon if a user had manually stopped the service while it was still enabled. Covered the scenario if it'd exited due to the previously mentioned odd behaviour if it couldn't resolve the Cloudflare endpoints. If there's a better way, I'm happy to implement.
Member
There was a problem hiding this comment. This kinda reminds me of wireguard startup failures for configuration where it needs to resolve a hostname, and it only does so exactly once. Why cant the Cloudflare tunnel thing be smarter and retry it longer, it's purpose is to be behind whacky networks after all... xD
Author
There was a problem hiding this comment. Yeah, the behaviour of the daemon is impressively dumb. Why it doesn't just loop round to try and resolve again is beyond me, but it just bails out. Only seems to occur if it starts up before it can resolve DNS though - it's fine if it can resolve but can't actually connect. Appeared when I was testing all failure scenarios, when starting the box on a bench with no connection plugged in, but also occurs when the box starts up before it can connect to external resolvers if the daemon comes up first.
Member
There was a problem hiding this comment. Here is how core solves this for wireguard If you add a description to an action, it appears configurable in "System - Settings - Cron". Affected users can then create a cron job if they want to, which is cheap for you since you need less glue to prevent that startup issue in your code.
Member
There was a problem hiding this comment. I'm unsure why we need this here in this way... there's no need to kill the current one, |
||
| return; | ||
| } | ||
| $pidfile = '/var/run/cloudflared.pid'; | ||
| if (file_exists($pidfile)) { | ||
| $pid = (int)trim(file_get_contents($pidfile)); | ||
| if ($pid > 0 && posix_kill($pid, 0)) { | ||
| return; | ||
| } | ||
| } | ||
| $backend = new \OPNsense\Core\Backend(); | ||
| $backend->configdRun('cloudflared start'); | ||
| } | ||
|
|
||
| function cloudflared_firewall($fw) | ||
| { | ||
| if (!cloudflared_enabled()) { | ||
| return; | ||
| } | ||
|
|
||
| $model = new \OPNsense\Cloudflared\Cloudflared(); | ||
| $protocol = (string)$model->general->protocol; | ||
|
|
||
| if ($protocol !== 'http2') { | ||
| $fw->registerFilterRule( | ||
| 1, | ||
| [ | ||
| 'descr' => 'Allow Cloudflare Tunnel QUIC (autogenerated)', | ||
| 'direction' => 'out', | ||
|
Member
There was a problem hiding this comment. I would remove auto generated firewall rules. Traffic initiated by the firewall itself has a default out allow rule.
Author
There was a problem hiding this comment. Didn't work in real life without an outbound rule, pf blocked the traffic, I was surprised by the behaviour - I didn't expect this was necessary. What's the best approach here?
Member
There was a problem hiding this comment. It depends on your ruleset, if you have rules somewhere that block all traffic in the out direction (e.g. in floating) e.g. in GeoIP or blocklist aliases, this can happen. But generally there is a "Allow all" rule for firewall initiated traffic, you don't need these rules in the plugin. Best remove auto generated rules in general and document these rules might be needed to be set manually. A small https://github.com/opnsense/docs manual how to use your plugin is a good choice for that. E.g. here an example from another plugin I maintain:
Author
There was a problem hiding this comment. This looks like a problem with my local configuration somewhere, when pre-configured to drop in as a replacement for the existing firewall. I did a factory reset and it worked fine out of the box with a very minimal config. Will find what's causing the issue and work around if necessary - firewall showed it as allowing the traffic on a pass, but with my fully configured with VLANs and multi-WAN it failed, despite having minimal rules on there, possibly a routing issue. The good news is the outbound firewall rules are completely unnecessary, and were a workaround for something conflicting on my end. Edit: Confirmed, it's MultiWAN causing the issue. I'll continue investigation, hopefully I can narrow it down / configure it to use gateway groups or similar. Weirdly the traffic was shown on pf as going out of the right interface, but the traffic never made it out. Hit the automatic rule "let out anything from firewall host itself (force gw)". Figured out that enabling "Disable force gateway" on the firewall settings allowed it to work. I'll keep digging.
Author
There was a problem hiding this comment. I'm not sure I can solve this without either creating a firewall rule (to work around the force gateway), or configure it up to work with a failover group / have the option to point it at a specific interface. Seems to be a quirk of the way pf is set up. My guess is the fact I created it earlier with the "quick" tag stopped it ever hitting the bottom force GW rule. Open to suggestions!
Member
There was a problem hiding this comment. Just remove automatic firewall rules from this plugin, it depends on the individual ruleset what is needed. Manual rules are the best choice here. Less code = everybody happy :D
Author
There was a problem hiding this comment. I agree in theory, but if I do that, it won't work at all when multi-WAN is set up, due to it getting stuck on the force default GW. Unless you're saying "add it to the docs that you need a firewall rule if using multi-WAN", happy to do that if it's the best way.
Member
There was a problem hiding this comment. Yes that is what I meant. The plugin is only responsible for bootstrapping and configuring the cloudflared service. There is no need to also make sure the traffic flows correctly, that is firewall policy and each user might need different rules. Keep the plugin simple and document instead. |
||
| 'from' => '(self)', | ||
| 'to' => 'any', | ||
| 'to_port' => '7844', | ||
| 'protocol' => 'udp', | ||
| 'type' => 'pass', | ||
| 'quick' => true, | ||
| 'statetype' => 'keep', | ||
| '#ref' => 'ui/cloudflared/', | ||
| ] | ||
|
insanityinside marked this conversation as resolved.
|
||
| ); | ||
| } | ||
|
|
||
| if ($protocol !== 'quic') { | ||
| $fw->registerFilterRule( | ||
| 1, | ||
| [ | ||
| 'descr' => 'Allow Cloudflare Tunnel HTTP/2 (autogenerated)', | ||
| 'direction' => 'out', | ||
| 'from' => '(self)', | ||
| 'to' => 'any', | ||
| 'to_port' => '7844', | ||
| 'protocol' => 'tcp', | ||
| 'type' => 'pass', | ||
| 'quick' => true, | ||
| 'statetype' => 'keep', | ||
| '#ref' => 'ui/cloudflared/', | ||
| ] | ||
|
insanityinside marked this conversation as resolved.
|
||
| ); | ||
| } | ||
| } | ||
|
|
||
| function cloudflared_services() | ||
| { | ||
| $services = []; | ||
|
|
||
| if (cloudflared_enabled()) { | ||
| $services[] = [ | ||
| 'description' => gettext('Cloudflare Tunnel'), | ||
| 'configd' => [ | ||
| 'restart' => ['cloudflared restart'], | ||
| 'start' => ['cloudflared start'], | ||
| 'stop' => ['cloudflared stop'], | ||
| ], | ||
| 'name' => 'cloudflared', | ||
| 'pidfile' => '/var/run/cloudflared.pid', | ||
| ]; | ||
| } | ||
|
|
||
| return $services; | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * Copyright (C) 2026 Alan Martines <alancpmartines@hotmail.com> | ||
| * Copyright (C) 2026 Richard Aspden <rick+github@insanityinside.net> | ||
| * All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, | ||
| * this list of conditions and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright | ||
| * notice, this list of conditions and the following disclaimer in the | ||
| * documentation and/or other materials provided with the distribution. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, | ||
| * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY | ||
| * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | ||
| * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, | ||
| * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | ||
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | ||
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN | ||
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | ||
| * POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| namespace OPNsense\Cloudflared\Api; | ||
|
|
||
| use OPNsense\Base\ApiMutableServiceControllerBase; | ||
| use OPNsense\Core\Backend; | ||
|
|
||
| class ServiceController extends ApiMutableServiceControllerBase | ||
| { | ||
| protected static $internalServiceClass = '\OPNsense\Cloudflared\Cloudflared'; | ||
| protected static $internalServiceEnabled = 'general.enabled'; | ||
| protected static $internalServiceTemplate = 'OPNsense/Cloudflared'; | ||
| protected static $internalServiceName = 'cloudflared'; | ||
|
|
||
| public function reconfigureAction() | ||
| { | ||
| if ($this->request->isPost()) { | ||
| $backend = new Backend(); | ||
| $backend->configdRun("cloudflared reconfigure"); | ||
| return ['status' => 'ok']; | ||
| } | ||
| return ['status' => 'failed']; | ||
| } | ||
|
|
||
| public function tunnelStatusAction() | ||
| { | ||
| $backend = new Backend(); | ||
| $response = $backend->configdRun("cloudflared tunnel_status"); | ||
| $data = json_decode(trim($response), true); | ||
| if ($data === null) { | ||
| return ['tunnel' => 'unknown']; | ||
| } | ||
| return $data; | ||
| } | ||
|
|
||
| public function logAction() | ||
| { | ||
| $backend = new Backend(); | ||
| $raw = $backend->configdRun("cloudflared log"); | ||
| $lines = $raw !== null ? explode("\n", rtrim($raw)) : []; | ||
| return ['lines' => $lines, 'total' => count($lines)]; | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * Copyright (C) 2026 Alan Martines <alancpmartines@hotmail.com> | ||
| * Copyright (C) 2026 Richard Aspden <rick+github@insanityinside.net> | ||
| * All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, | ||
| * this list of conditions and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright | ||
| * notice, this list of conditions and the following disclaimer in the | ||
| * documentation and/or other materials provided with the distribution. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, | ||
| * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY | ||
| * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | ||
| * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, | ||
| * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | ||
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | ||
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN | ||
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | ||
| * POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| namespace OPNsense\Cloudflared\Api; | ||
|
|
||
| use OPNsense\Base\ApiMutableModelControllerBase; | ||
|
|
||
| class SettingsController extends ApiMutableModelControllerBase | ||
| { | ||
| protected static $internalModelName = 'Cloudflared'; | ||
| protected static $internalModelClass = '\OPNsense\Cloudflared\Cloudflared'; | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * Copyright (C) 2026 Alan Martines <alancpmartines@hotmail.com> | ||
| * Copyright (C) 2026 Richard Aspden <rick+github@insanityinside.net> | ||
| * All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without | ||
| * modification, are permitted provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, | ||
| * this list of conditions and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright | ||
| * notice, this list of conditions and the following disclaimer in the | ||
| * documentation and/or other materials provided with the distribution. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, | ||
| * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY | ||
| * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | ||
| * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, | ||
| * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | ||
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | ||
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN | ||
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | ||
| * POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| namespace OPNsense\Cloudflared; | ||
|
|
||
| use OPNsense\Base\IndexController as BaseIndexController; | ||
|
|
||
| class IndexController extends BaseIndexController | ||
| { | ||
| public function indexAction() | ||
| { | ||
| $this->view->generalForm = $this->getForm("general"); | ||
| $this->view->pick('OPNsense/Cloudflared/index'); | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| <form> | ||
| <field> | ||
| <id>Cloudflared.general.enabled</id> | ||
| <label>Enable</label> | ||
| <type>checkbox</type> | ||
| <help>Enable Cloudflare Tunnel</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.token</id> | ||
| <label>Tunnel Token</label> | ||
| <type>password</type> | ||
| <help>The token for your Cloudflare Tunnel. Get it from one.dash.cloudflare.com > Access > Tunnels.</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.post_quantum</id> | ||
| <label>Enable Post-Quantum Encryption</label> | ||
| <type>checkbox</type> | ||
| <help>Pass --post-quantum to enable post-quantum cryptography for the tunnel connection.</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.quic_disable_pmtu_discovery</id> | ||
| <label>Disable QUIC PMTU Discovery</label> | ||
| <type>checkbox</type> | ||
| <help>Pass --quic-disable-pmtu-discovery to cloudflared. Workaround for intermittent "failed to accept QUIC stream" errors on networks where ICMP is filtered and path MTU discovery does not work correctly.</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.protocol</id> | ||
| <label>Protocol</label> | ||
| <type>dropdown</type> | ||
| <help>Transport protocol for the tunnel connection. Auto tries QUIC first and falls back to HTTP/2 if unavailable. Outbound firewall rules are automatically added: UDP 7844 for Auto and QUIC modes, TCP 7844 for Auto and HTTP/2 modes.</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.kern_ipc_maxsockbuf</id> | ||
| <label>Max Socket Buffer (kern.ipc.maxsockbuf)</label> | ||
| <type>text</type> | ||
| <help>Recommended value for QUIC performance. Default is 16777216.</help> | ||
| </field> | ||
| <field> | ||
| <id>Cloudflared.general.net_inet_udp_recvspace</id> | ||
| <label>UDP Recv Space (net.inet.udp.recvspace)</label> | ||
| <type>text</type> | ||
| <help>Recommended value for QUIC performance. Default is 8388608.</help> | ||
| </field> | ||
| </form> |
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Follows OPNsense plugin conventions, that's why I left it in - it was flagged it in review.