{{KIND_BADGE}} IPv6 →

IPv6 → {{KIND_BADGE}}

VLAN {{VLAN_ID}} on parent {{VLAN_PARENT}}

{{STATUS_SUMMARY}} {{#DRIFT_BADGE}}{{#B_DRIFT}}{{B_LABEL}}{{/B_DRIFT}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}} {{#SHOW_LIVE_STATS}} {{/SHOW_LIVE_STATS}} {{#SHOW_BRIDGE_STATS}} {{/SHOW_BRIDGE_STATS}} {{#CAN_READ_LOGS}} {{/CAN_READ_LOGS}}

System interface ({{IF}}). OgmaProtect does not manage addresses on encapsulation or pflog interfaces.

Loopback interface. Addresses here (e.g. 127.0.0.1) apply to this host only. Removing the last IPv4 or IPv6 address for a family can affect local services that rely on localhost.

Admin state

Configured: {{TILE_STATE_SUB}}

State drift

Link

—

Not measured

IPv4

Mode: {{TILE_IPV4_MODE}}

Address drift

IPv6

Manage IPv6 →

Address drift

MTU

MTU drift

Throughput

—

Not measured

Confirm address change

A live address change by {{ADDRESS_PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{ADDRESS_PENDING_REMAINING}} seconds unless you keep it.

If this page stops loading after the change, do nothing — the interface addressing reverts to its previous state by itself at the deadline.

Automatic revert failed — the interface addressing may be inconsistent. The change keeps retrying in the background; if it persists, resolve it from the console.

Configured addresses

Family	Address	Prefix	Primary	Action

No addresses configured yet.

This interface carries the default route. Removing an address here briefly clears all of its addresses, so each removal is applied with a {{ADDRESS_DELETE_WINDOW_SECS}}-second auto-revert window — confirm it on the next page or it undoes itself and the address comes back.

WireGuard tunnel

{{#WG_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/WG_DRIFT_BADGE}}

Server public key

{{WG_PUBLIC_KEY}}

Give this to each peer as this router's public key. The private key stays in the secret store.

Listen port {{WG_LISTEN_PORT}}

Peers

This tunnel has more peers than can be shown and edited safely from the web UI. Manage its peers on the device instead — editing here is disabled to avoid dropping peers.

You have read-only access to this tunnel. Adding or removing peers requires interface write permission (net-admin role).

+ Add peer

Peer public key

Allowed IPs

One CIDR per line — the IPs this peer may send and receive through the tunnel.

Endpoint host (optional)

Endpoint port

Persistent keepalive (optional, seconds)

Pre-shared key (optional)

An extra symmetric key mixed into this peer's handshake (defence in depth). It is stored in the secret store and never shown again.

Changing peers (add, remove, enable/disable) or deleting this tunnel also needs secret write permission (net-admin role) — every apply re-materializes the server private key from the secret store. Those controls appear once you have it.

PPPoE client

{{#PPPOE_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/PPPOE_DRIFT_BADGE}}

Authentication: {{PPPOE_AUTHPROTO}}
Username: {{PPPOE_AUTHNAME}}
Service: {{PPPOE_SERVICE}}
Access concentrator: {{PPPOE_AC_NAME}}
Device: {{PPPOE_DEV}}
Phase: {{PPPOE_PHASE}}
State: {{PPPOE_STATE}}
Session id: {{PPPOE_SID}}
PADI / PADR retries: {{PPPOE_PADI_RETRIES}} / {{PPPOE_PADR_RETRIES}}

Negotiated addresses

local {{PPPOE_LOCAL}} → peer {{PPPOE_PEER}}

Negotiating… no IPCP addresses yet (the session is not established).

Tunnel ({{TUNNEL_TYPE}})

{{#TUNNEL_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/TUNNEL_DRIFT_BADGE}}

Outer source: {{TUNNEL_SRC}}
Outer destination: {{TUNNEL_DST}}
VNI / key: {{TUNNEL_VNETID}}
Parent: {{TUNNEL_PARENT}}
Inner address: {{TUNNEL_INNER_LOCAL}}{{#TUNNEL_HAS_REMOTE}} → {{TUNNEL_INNER_REMOTE}}{{/TUNNEL_HAS_REMOTE}}/{{TUNNEL_INNER_PREFIXLEN}}

The tunnel type is fixed once created — delete and recreate to change it. The parent, outer endpoints, and other settings can be edited below.

Confirm endpoint change

A live endpoint change by {{TUNNEL_PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{TUNNEL_PENDING_REMAINING}} seconds unless you keep it.

If this page stops loading after the change, do nothing — the tunnel reverts to its previous endpoints by itself at the deadline.

Automatic revert failed — manual recovery required. From the console: ogmaprotectctl tunnel cancel {{TUNNEL_PENDING_TXN}}

Edit endpoints

Edit inner address

Edit MTU

Edit tunnel settings

Adjust packet-handling settings for this tunnel. Leave a field unchanged to keep its current value. TTL and DF cannot be cleared once set (delete and recreate the tunnel to remove them).

Choose Set and enter a value — 0 is a valid VNI, not “unset”.{{#TUNNEL_VNETID_CLEARABLE}} Choose Remove to unset it entirely.{{/TUNNEL_VNETID_CLEARABLE}}

Tunnel TTL (0-255)

Don't fragment (DF)

Change parent interface

This learning-mode vxlan joins its multicast group on the parent. Changing the parent briefly bounces the interface (down→up). Choosing “point-to-point” clears the parent and switches the tunnel to a unicast destination.

Parent interface

Bridge members

Current members

No members configured
{{M_NAME}}{{#M_HAS_DISPLAY}} {{M_DISPLAY}}{{/M_HAS_DISPLAY}} {{#M_IS_VLAN}}{{#M_HAS_VLAN_ID}}VLAN {{M_VLAN_ID}} · {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{^M_HAS_VLAN_ID}}on {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{/M_IS_VLAN}}{{^M_IS_VLAN}}{{#M_HAS_ADDR}}{{M_ADDR}}{{/M_HAS_ADDR}}{{#M_HAS_SEP}} · {{/M_HAS_SEP}}{{#M_HAS_VLAN_COUNT}}{{M_VLAN_COUNT}} VLAN{{#M_VLAN_PLURAL}}s{{/M_VLAN_PLURAL}}{{/M_HAS_VLAN_COUNT}}{{#M_HAS_BARE}}{{M_BARE}}{{/M_HAS_BARE}}{{/M_IS_VLAN}} {{#M_HAS_WARN}}⚠{{/M_HAS_WARN}}

Add or remove members

No eligible member interfaces found.

{{/M_NONE}}{{^M_NONE}} {{M_NAME}}{{#M_HAS_DISPLAY}} {{M_DISPLAY}}{{/M_HAS_DISPLAY}} {{#M_IS_VLAN}}{{#M_HAS_VLAN_ID}}VLAN {{M_VLAN_ID}} · {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{^M_HAS_VLAN_ID}}on {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{/M_IS_VLAN}}{{^M_IS_VLAN}}{{#M_HAS_ADDR}}{{M_ADDR}}{{/M_HAS_ADDR}}{{#M_HAS_SEP}} · {{/M_HAS_SEP}}{{#M_HAS_VLAN_COUNT}}{{M_VLAN_COUNT}} VLAN{{#M_VLAN_PLURAL}}s{{/M_VLAN_PLURAL}}{{/M_HAS_VLAN_COUNT}}{{#M_HAS_BARE}}{{M_BARE}}{{/M_HAS_BARE}}{{/M_IS_VLAN}} {{#M_HAS_WARN}}⚠{{/M_HAS_WARN}} {{/M_NONE}}{{/MEMBER_OPTIONS}}

Hover ⚠ for cautions — e.g. an interface already in another bridge (checking it moves it here), or a physical port with VLAN children.

Bridge L2 settings

MAC address {{#BRIDGE_HAS_VETHER}}

An OpenBSD bridge presents the MAC of its L3 carrier interface (a vether). Set a static MAC here, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55.

Reset to the default MAC and renew it now (briefly re-MACs the carrier) {{/BRIDGE_HAS_VETHER}} {{#BRIDGE_NO_VETHER}}

This bridge has no L3 interface yet, so it has no MAC to manage. Add an IPv4/IPv6 address to the bridge first — its MAC is that carrier interface (a vether).

Spanning tree (RSTP/STP)

Spanning tree runs per member — enable it on the members below. The protocol and timers here are bridge-wide.

Protocol Priority (0–61440) Hello time (1–2s) Fwd delay (4–30s) Max age (6–40s) Hold count (1–10)

Per-member options

DISCOVER floods unknown-destination frames out the port; Learning caches source MACs; Block non-IP drops non-IP/ARP frames; STP enables spanning tree on the port. Port priority (0–240) and path cost (1–200000000) are optional RSTP tuning.

Member	Discover	Learning	Block non-IP	STP	Port priority	Path cost
{{BF_MEMBER}}

You do not have write access to this bridge. Use the Live stats view to inspect its current MAC, spanning-tree state, and per-member flags.

VLAN settings

Parent interface {{#VLAN_CAN_EDIT_PARENT}}

The physical interface this VLAN tags on. Re-pointing moves the VLAN to a different port.

This VLAN's parent ({{VLAN_SETTINGS_PARENT}}) is fixed by its name. To use a different parent, delete this VLAN and create one on that interface.

MTU

1280–65535. Leave blank to use the default (1500). Writes mtu 9000 to hostname.{{IF}}, or removes the line when blank.

MAC address

Set a static MAC, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55. Writes lladdr 02:11:22:33:44:55 to hostname.{{IF}}, or removes the line when blank.

Reset to the default MAC and renew it now

Interface groups

Space-separated user groups (for pf rules etc.). 1–15 of letters/digits/_/-, not ending in a digit. The automatic vlan group is always present and isn't listed here. Writes one group <name> line per group to hostname.{{IF}}, or removes them when blank.

You do not have write access to this VLAN.

Advanced settings

MTU, description, MAC and interface groups

MTU

1280–65535. Leave blank to use the default (1500). Writes mtu 9000 to hostname.{{IF}}, or removes the line when blank.

Description

A free-text label stored on the interface itself (ifconfig description), visible in the system config. Up to 63 characters; no double quotes. Writes description "…" to hostname.{{IF}}, or removes the line when blank.

MAC address

Set a static MAC, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55. Changing the MAC of the management (default-route) interface is refused. Writes lladdr 02:11:22:33:44:55 to hostname.{{IF}}, or removes the line when blank.

Reset to the default MAC and renew it now

Interface groups

Space-separated user groups (for pf rules etc.). 1–15 of letters/digits/_/-, not ending in a digit. Kernel auto-groups aren't listed here. Writes one group <name> line per group to hostname.{{IF}}, or removes them when blank.

Re-asserting pushes the configured MTU, description, MAC and groups to the running interface without changing the configuration file. It also adopts any address the interface currently holds into the configuration — the review sheet shows exactly what would change before anything is applied.

You do not have write access to this interface.

VLAN interfaces

802.1Q VLANs on this physical port. Bridging a VLAN adds it to a bridge without removing its parent relationship here.

{{V_NAME}} {{#V_HAS_TAG}} VLAN {{V_ID}}{{/V_HAS_TAG}}{{#V_HAS_BRIDGE}} bridged in {{V_BRIDGE}}{{/V_HAS_BRIDGE}}

On interface now (not in hostname file)

These addresses are active on the kernel but not saved in hostname.{{IF}}. Add any you want to persist across reboot.

Family	Address	Prefix	Action
{{LI_FAM}}	{{LI_ADDR}}	{{LI_PREFIX}}	{{#LI_ADD}} {{/LI_ADD}}{{#LI_UNSUP}}Unsupported netmask{{/LI_UNSUP}}

Add IP address

Use CIDR notation for the prefix (e.g. /24 for IPv4 or /64 for IPv6). Additional addresses are added as aliases unless you make the new one primary.

With IPv4 mode DHCP, new IPv4 addresses are static aliases only (same-subnet aliases often use /32).

Address family

IP address

Network prefix

{{#ADDRESS_CAN_WINDOW}} Apply with an auto-revert safety window — the address goes live but reverts by itself unless you confirm it within seconds. Recommended when changing the primary address remotely: if the change cuts your connection you regain it automatically. Not available on DHCP-addressed interfaces. Leave unchecked to apply immediately. {{/ADDRESS_CAN_WINDOW}} {{#IFACE_IS_DEFAULT_EGRESS}}

This interface carries the default route — it is most likely how you are connected. Making an address primary here briefly removes the interface's addresses, so the safety window above is required and has been ticked for you.

Making an address primary is unavailable here: this interface carries the IPv6 default route and is DHCP-addressed, so the auto-revert safety window that would protect the change cannot be used. Switch its IPv4 mode to static first, or make the change from the console.

State, addressing & label

Administrative state

Applying network change…

This can take a minute; the page will update when it completes.

IPv4 addressing

Selecting Static or DHCP creates a virtual L3 interface (vether) on this bridge to carry the address.

DHCP options

DHCP lease (read-only)

No active lease on this interface yet.

Address:: {{LEASE_ADDR}}
Gateway:: {{LEASE_GW}}
Lease time:: {{LEASE_EXP}}

Last known address — the live interface state could not be read, so it is not confirmed the lease is still bound.

When a DHCP default route is installed, its kernel priority is shown on the Routes page.

Display name

Danger zone

Removes this interface from the configuration and destroys it in the kernel. This cannot be undone.

Live Connection Log Feed

Streaming logs for this interface.

Time	Source	Program	Message

Log lines from /var/log that mention this interface — kernel link-state changes and DHCP-client (dhcpleased/slaacd) activity. If a WAN port shows no IP, lease requests appear here. Requires the log:*:read capability.

{{DISPLAY_NAME}}

{{IF}}

Review staged changes

Confirm address change

Configured addresses

WireGuard tunnel

Peers

PPPoE client

Tunnel ({{TUNNEL_TYPE}})

Confirm endpoint change

Bridge members

Bridge L2 settings

VLAN settings

Advanced settings

VLAN interfaces

On interface now (not in hostname file)

Add IP address

Live Connection Log Feed

Interface status

Staged changes

Review staged changes

Confirm address change

Configured addresses

WireGuard tunnel

Peers

PPPoE client

Tunnel ({{TUNNEL_TYPE}})

Confirm endpoint change

Bridge members

Bridge L2 settings

VLAN settings

Advanced settings

VLAN interfaces

On interface now (not in hostname file)

Add IP address

Live Connection Log Feed