{{KIND_BADGE}}{{#RDOMAIN_BADGE}} rd {{RDOMAIN_ID}}{{#RDOMAIN_HAS_NAME}} · {{RDOMAIN_NAME}}{{/RDOMAIN_HAS_NAME}}{{/RDOMAIN_BADGE}}

VLAN {{VLAN_ID}} on parent {{VLAN_PARENT}}

{{STATUS_SUMMARY}} {{#IFACE_EGRESS}}egress{{/IFACE_EGRESS}} {{#DRIFT_BADGE}}{{#B_DRIFT}}{{B_LABEL}}{{/B_DRIFT}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}} {{#SHOW_LIVE_STATS}} {{/SHOW_LIVE_STATS}} {{#SHOW_BRIDGE_STATS}} {{/SHOW_BRIDGE_STATS}} {{#CAN_READ_LOGS}} {{/CAN_READ_LOGS}}

System interface ({{IF}}). OgmaProtect does not manage addresses on encapsulation or pflog interfaces.

Loopback interface. Addresses here (e.g. 127.0.0.1) apply to this host only. Removing the last IPv4 or IPv6 address for a family can affect local services that rely on localhost.

Admin state

Configured: {{TILE_STATE_SUB}}

State drift

Link

—

Not measured

IPv4

Address drift

IPv6

Address drift

MTU

MTU drift

Routing domain

Domain drift

Throughput

—

Not measured

Confirm IPv6 change

A management-affecting IPv6 change is live but not yet saved. Confirm within about {{V6_PENDING_REMAINING}} seconds to keep it, or it reverts by itself. Check the observed state below against what you intended — a rogue router advertisement can install a hostile gateway or DNS, so confirm against reality, not just that this page still loads.

Learned IPv6 default gateway: {{V6_DEFAULT6}}
Learned RDNSS (resolver): {{V6_LEARNED_RDNSS}}
Live address: {{PG_ADDR}}/{{PG_PLEN}} ({{PG_SRC}})

Confirm address change

A live address change by {{ADDRESS_PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{ADDRESS_PENDING_REMAINING}} seconds unless you keep it.

If this page stops loading after the change, do nothing — the interface addressing reverts to its previous state by itself at the deadline.

Automatic revert failed — the interface addressing may be inconsistent. The change keeps retrying in the background; if it persists, resolve it from the console.

Addresses

Family	Address	Prefix	Primary	Action
{{LR_FAMILY}}	{{LR_ADDR}} {{LR_SOURCE}} · live{{#LR_HAS_DETAIL}} {{LR_DETAIL}} {{/LR_HAS_DETAIL}}	{{LR_PREFIX}}	{{LR_ROLE}}	{{#LR_CAN_RENEW}} immediate {{/LR_CAN_RENEW}}{{LR_ACTION}}
inet	No active lease on this interface yet — the DHCP client is waiting for an offer. Lease requests appear in the log feed.{{#DHCP_LEASE}} immediate {{/DHCP_LEASE}}

No addresses configured yet.

Last known address — the live interface state could not be read, so it is not confirmed the lease is still bound.

A new address moves the default route with it; this session may drop.

Removing an address here briefly clears all of this interface’s addresses, so each removal is applied with a {{ADDRESS_DELETE_WINDOW_SECS}}-second auto-revert window — confirm it on the next page or it undoes itself and the address comes back.

WireGuard tunnel

{{#WG_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/WG_DRIFT_BADGE}}

Server public key

{{WG_PUBLIC_KEY}}

Give this to each peer as this router's public key. The private key stays in the secret store.

Role

{{#WG_ROLE_SET}}{{WG_ROLE_LABEL}}{{/WG_ROLE_SET}}{{^WG_ROLE_SET}}role not set{{/WG_ROLE_SET}}

Listen port

{{#WG_LISTEN}}{{WG_LISTEN_PORT}}{{/WG_LISTEN}}{{^WG_LISTEN}}{{#WG_ROLE_CLIENT}}none (client){{/WG_ROLE_CLIENT}}{{^WG_ROLE_CLIENT}}ephemeral{{/WG_ROLE_CLIENT}}{{/WG_LISTEN}}

Peers

{{#WG_HAS_PEERS}}{{WG_CONNECTED}} connected {{WG_STALE}} stale {{WG_NEVER}} never {{WG_DISABLED}} disabled{{/WG_HAS_PEERS}}{{^WG_HAS_PEERS}}none{{/WG_HAS_PEERS}}

This tunnel has more peers than can be shown and edited safely from the web UI. Manage its peers on the device instead — editing here is disabled to avoid dropping peers.

{{/WG_PEERS_TRUNCATED}} Manage peers and settings on the WireGuard page {{/WG_OK}}

PPPoE client

{{#PPPOE_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/PPPOE_DRIFT_BADGE}} {{#PPPOE_CAN_EDIT}}Edit{{/PPPOE_CAN_EDIT}}

session: {{PPPOE_DERIVED}} · {{#PPPOE_POLL_ARMED}}updating for two minutes, then {{/PPPOE_POLL_ARMED}}refresh to update

Authentication: {{PPPOE_AUTHPROTO}}
Username: {{PPPOE_AUTHNAME}}
Service: {{PPPOE_SERVICE}}
Access concentrator: {{PPPOE_AC_NAME}}
Device: {{PPPOE_DEV}}
Phase: {{PPPOE_PHASE}}
State: {{PPPOE_STATE}}
Session id: {{PPPOE_SID}}
PADI / PADR retries: {{PPPOE_PADI_RETRIES}} / {{PPPOE_PADR_RETRIES}}

parent: {{PPPOE_PARENT}}
uplink: {{#PPPOE_DEFAULT_ROUTE}}default route via this link{{/PPPOE_DEFAULT_ROUTE}}{{^PPPOE_DEFAULT_ROUTE}}not the default route{{/PPPOE_DEFAULT_ROUTE}}
dial: {{#PPPOE_DIAL_ON_DEMAND}}on demand{{/PPPOE_DIAL_ON_DEMAND}}{{^PPPOE_DIAL_ON_DEMAND}}always on{{/PPPOE_DIAL_ON_DEMAND}}
mtu: {{PPPOE_MTU}}{{^PPPOE_MTU_SET}} · kernel default{{/PPPOE_MTU_SET}}
mss clamp: {{PPPOE_MSS}}
clamp rule: {{#PPPOE_MSS_CLAMP}}recorded{{/PPPOE_MSS_CLAMP}}{{^PPPOE_MSS_CLAMP}}not recorded{{/PPPOE_MSS_CLAMP}}
ipv6: {{#PPPOE_INET6}}link-local (eui64){{/PPPOE_INET6}}{{^PPPOE_INET6}}off{{/PPPOE_INET6}}
slaac: {{#PPPOE_INET6_AUTOCONF}}on{{/PPPOE_INET6_AUTOCONF}}{{^PPPOE_INET6_AUTOCONF}}off{{/PPPOE_INET6_AUTOCONF}}
prefix delegation: IPv6 prefix delegation over PPPoE is not yet supported from this page

MSS-clamp firewall rule

match on {{IF}} scrub (max-mss {{PPPOE_MSS}})

Negotiated addresses

local {{PPPOE_LOCAL}} → peer {{PPPOE_PEER}}

Negotiating… no IPCP addresses yet (the session is not established).

WAN checklist

{{#WAN_ALL_MET}}configured as an uplink{{/WAN_ALL_MET}}

firewall step: {{WAN_VERDICT_PF}}
monitor step: {{WAN_VERDICT_GW}}

{{W_LABEL}}: {{#W_MET}}{{W_TEXT}}{{/W_MET}}{{#W_UNMET}}{{W_TEXT}}{{/W_UNMET}}{{#W_OTHER}}{{W_TEXT}}{{/W_OTHER}}{{#W_HAS_HREF}} {{W_LINK}}{{/W_HAS_HREF}}

Tunnel ({{TUNNEL_TYPE}})

{{#TUNNEL_DRIFT_BADGE}}{{#B_OK}}in sync{{/B_OK}}{{#B_DRIFT}}drift{{/B_DRIFT}}{{#B_ERROR}}error{{/B_ERROR}}{{#B_SKIP}}not checked{{/B_SKIP}}{{/TUNNEL_DRIFT_BADGE}}

Outer source: {{TUNNEL_SRC}}
Outer destination: {{TUNNEL_DST}}
VNI / key: {{TUNNEL_VNETID}}
Parent: {{TUNNEL_PARENT}}
Inner address: {{TUNNEL_INNER_LOCAL}}{{#TUNNEL_HAS_REMOTE}} → {{TUNNEL_INNER_REMOTE}}{{/TUNNEL_HAS_REMOTE}}/{{TUNNEL_INNER_PREFIXLEN}}

The tunnel type is fixed once created — delete and recreate to change it. The parent, outer endpoints, and other settings can be edited below.

Confirm endpoint change

A live endpoint change by {{TUNNEL_PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{TUNNEL_PENDING_REMAINING}} seconds unless you keep it.

If this page stops loading after the change, do nothing — the tunnel reverts to its previous endpoints by itself at the deadline.

Automatic revert failed — manual recovery required. From the console: ogmaprotectctl tunnel cancel {{TUNNEL_PENDING_TXN}}

Edit endpoints

Edit inner address

Edit MTU

Edit tunnel settings

Adjust packet-handling settings for this tunnel. Leave a field unchanged to keep its current value. TTL and DF cannot be cleared once set (delete and recreate the tunnel to remove them).

Choose Set and enter a value — 0 is a valid VNI, not “unset”.{{#TUNNEL_VNETID_CLEARABLE}} Choose Remove to unset it entirely.{{/TUNNEL_VNETID_CLEARABLE}}

Tunnel TTL (0-255)

Don't fragment (DF)

Change parent interface

This learning-mode vxlan joins its multicast group on the parent. Changing the parent briefly bounces the interface (down→up). Choosing “point-to-point” clears the parent and switches the tunnel to a unicast destination.

Parent interface

Bridge members

Current members

No members configured
{{M_NAME}}{{#M_HAS_DISPLAY}} {{M_DISPLAY}}{{/M_HAS_DISPLAY}} {{#M_IS_VLAN}}{{#M_HAS_VLAN_ID}}VLAN {{M_VLAN_ID}} · {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{^M_HAS_VLAN_ID}}on {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{/M_IS_VLAN}}{{^M_IS_VLAN}}{{#M_HAS_ADDR}}{{M_ADDR}}{{/M_HAS_ADDR}}{{#M_HAS_SEP}} · {{/M_HAS_SEP}}{{#M_HAS_VLAN_COUNT}}{{M_VLAN_COUNT}} VLAN{{#M_VLAN_PLURAL}}s{{/M_VLAN_PLURAL}}{{/M_HAS_VLAN_COUNT}}{{#M_HAS_BARE}}{{M_BARE}}{{/M_HAS_BARE}}{{/M_IS_VLAN}} {{#M_HAS_WARN}}⚠{{/M_HAS_WARN}}

Add or remove members

No eligible member interfaces found.

{{/M_NONE}}{{^M_NONE}} {{M_NAME}}{{#M_HAS_DISPLAY}} {{M_DISPLAY}}{{/M_HAS_DISPLAY}} {{#M_IS_VLAN}}{{#M_HAS_VLAN_ID}}VLAN {{M_VLAN_ID}} · {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{^M_HAS_VLAN_ID}}on {{M_PARENT}}{{/M_HAS_VLAN_ID}}{{/M_IS_VLAN}}{{^M_IS_VLAN}}{{#M_HAS_ADDR}}{{M_ADDR}}{{/M_HAS_ADDR}}{{#M_HAS_SEP}} · {{/M_HAS_SEP}}{{#M_HAS_VLAN_COUNT}}{{M_VLAN_COUNT}} VLAN{{#M_VLAN_PLURAL}}s{{/M_VLAN_PLURAL}}{{/M_HAS_VLAN_COUNT}}{{#M_HAS_BARE}}{{M_BARE}}{{/M_HAS_BARE}}{{/M_IS_VLAN}} {{#M_HAS_WARN}}⚠{{/M_HAS_WARN}} {{/M_NONE}}{{/MEMBER_OPTIONS}}

Hover ⚠ for cautions — e.g. an interface already in another bridge (checking it moves it here), or a physical port with VLAN children.

Bridge L2 settings

MAC address {{#BRIDGE_HAS_VETHER}}

An OpenBSD bridge presents the MAC of its L3 carrier interface (a vether). Set a static MAC here, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55.

Reset to the default MAC and renew it now (briefly re-MACs the carrier) {{/BRIDGE_HAS_VETHER}} {{#BRIDGE_NO_VETHER}}

This bridge has no L3 interface yet, so it has no MAC to manage. Add an IPv4/IPv6 address to the bridge first — its MAC is that carrier interface (a vether).

Spanning tree (RSTP/STP)

Spanning tree runs per member — enable it on the members below. The protocol and timers here are bridge-wide.

Protocol Priority (0–61440) Hello time (1–2s) Fwd delay (4–30s) Max age (6–40s) Hold count (1–10)

Per-member options

DISCOVER floods unknown-destination frames out the port; Learning caches source MACs; Block non-IP drops non-IP/ARP frames; STP enables spanning tree on the port. Port priority (0–240) and path cost (1–200000000) are optional RSTP tuning.

Member	Discover	Learning	Block non-IP	STP	Port priority	Path cost
{{BF_MEMBER}}

You do not have write access to this bridge. Use the Live stats view to inspect its current MAC, spanning-tree state, and per-member flags.

VLAN settings

Parent interface {{#VLAN_CAN_EDIT_PARENT}}

The physical interface this VLAN tags on. Re-pointing moves the VLAN to a different port.

This VLAN's parent ({{VLAN_SETTINGS_PARENT}}) is fixed by its name. To use a different parent, delete this VLAN and create one on that interface.

MTU

1280–65535. Leave blank to use the default (1500). Writes mtu 9000 to hostname.{{IF}}, or removes the line when blank.

Routing domain

The routing table this interface and its connected routes live in. Management stays in routing domain 0 (Default). Writes rdomain N as the first line of hostname.{{IF}}, or removes the line for Default.

routing domain: {{VLAN_RDOMAIN_LABEL}} · follows {{VLAN_RDOMAIN_FOLLOWS_IF}}; set the routing domain on the bridge

New domain…

Name Id

Choose New domain… in the list above, then save: the domain is created and this interface moves into it. Letters, digits, space, . _ -; ids 1–255.

More named domains exist than this page can list; new domains are created from the console until some are removed.

Moving the interface to another routing domain re-applies its addresses; devices on it lose connectivity for a moment.

MAC address

Set a static MAC, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55. Writes lladdr 02:11:22:33:44:55 to hostname.{{IF}}, or removes the line when blank.

Reset to the default MAC and renew it now

Interface groups

Space-separated user groups (for pf rules etc.). 1–15 of letters/digits/_/-, not ending in a digit. The automatic vlan group is always present and isn't listed here. Writes one group <name> line per group to hostname.{{IF}}, or removes them when blank.

You do not have write access to this VLAN.

Advanced settings

MTU, routing domain, description, MAC and interface groups

MTU

1280–65535. Leave blank to use the default (1500). Writes mtu 9000 to hostname.{{IF}}, or removes the line when blank.

Routing domain

routing domain: {{IFACE_RDOMAIN_LABEL}} · follows {{IFACE_RDOMAIN_FOLLOWS_IF}}; set the routing domain on the bridge

New domain…

Name Id

Choose New domain… in the list above, then save: the domain is created and this interface moves into it. Letters, digits, space, . _ -; ids 1–255.

More named domains exist than this page can list; new domains are created from the console until some are removed.

Moving the interface to another routing domain re-applies its addresses{{#IFACE_RDOMAIN_WARN_MEMBERS}} and every member's{{/IFACE_RDOMAIN_WARN_MEMBERS}}; devices on it lose connectivity for a moment.

Description

A free-text label stored on the interface itself (ifconfig description), visible in the system config. Up to 63 characters; no double quotes. Writes description "…" to hostname.{{IF}}, or removes the line when blank.

MAC address

Set a static MAC, or leave blank to inherit the kernel default. Use a unicast address (first octet even), e.g. 02:11:22:33:44:55. Changing the MAC of the management (default-route) interface is refused. Writes lladdr 02:11:22:33:44:55 to hostname.{{IF}}, or removes the line when blank.

Reset to the default MAC and renew it now

Interface groups

Space-separated user groups (for pf rules etc.). 1–15 of letters/digits/_/-, not ending in a digit. Kernel auto-groups aren't listed here. Writes one group <name> line per group to hostname.{{IF}}, or removes them when blank.

A routing-domain change is saved now, never staged.

Re-asserting pushes the configured MTU, description, MAC and groups to the running interface without changing the configuration file. It also adopts any address the interface currently holds into the configuration — the review sheet shows exactly what would change before anything is applied.

You do not have write access to this interface.

VLAN interfaces

802.1Q VLANs on this physical port. Bridging a VLAN adds it to a bridge without removing its parent relationship here.

{{V_NAME}} {{#V_HAS_TAG}} VLAN {{V_ID}}{{/V_HAS_TAG}}{{#V_HAS_BRIDGE}} bridged in {{V_BRIDGE}}{{/V_HAS_BRIDGE}}

On interface now (not in hostname file)

These addresses are active on the kernel but not saved in hostname.{{IF}}. Add any you want to persist across reboot.

Family	Address	Prefix	Action
{{LI_FAM}}	{{LI_ADDR}}	{{LI_PREFIX}}	{{#LI_ADD}} {{/LI_ADD}}{{#LI_UNSUP}}Unsupported netmask{{/LI_UNSUP}}

Add IP address

Type the address with its prefix, like 10.0.0.1/24, or type the address alone and set the prefix below. New addresses become aliases unless you make the new one primary.

With the DHCP client on, new IPv4 addresses are static aliases only (same-subnet aliases often use /32).

IP address no family yet

Network prefix /24 or /64

{{#ADDRESS_CAN_WINDOW}} Apply with an auto-revert safety window — the address goes live but reverts by itself unless you confirm it within seconds. Recommended when changing the primary address remotely: if the change cuts your connection you regain it automatically. Not available on DHCP-addressed interfaces. Leave unchecked to apply immediately. {{/ADDRESS_CAN_WINDOW}} {{#IFACE_IS_DEFAULT_EGRESS}}

This interface is most likely how you are connected. Making an address primary here briefly removes its addresses, so the safety window above is required and has been ticked for you.

Making an address primary is unavailable here: this interface carries the IPv6 default route and is DHCP-addressed, so the auto-revert safety window that would protect the change cannot be used. Turn the DHCP client off first, or make the change from the console.

{{SIDE_HOSTNAME_TEXT}}

State, addressing & label

Administrative state

Click to stage bringing the interface {{#STATE_SWITCH_ON}}down{{/STATE_SWITCH_ON}}{{^STATE_SWITCH_ON}}up{{/STATE_SWITCH_ON}}; apply it from the staged-changes bar.

Link restart

restart: down until {{BOUNCE_UP_AT}} · {{BOUNCE_REMAINING}} s left · reload to see the link
restart: {{BOUNCE_WAITING}} · reload to see the link

last restart: {{BOUNCE_LAST}}

Applying network change…

This can take a minute; the page will update when it completes.

IPv4 addressing

DHCP client

primary: {{#DHCP_CLIENT_ON}}lease · added become alias{{/DHCP_CLIENT_ON}}{{^DHCP_CLIENT_ON}}first configured address{{/DHCP_CLIENT_ON}}
lease: {{LEASE_ADDR}}
gateway: {{LEASE_GW}}{{#LEASE_HAS_PRIO}} prio {{LEASE_PRIO}}{{/LEASE_HAS_PRIO}} routes
expires: {{LEASE_EXP}}

{{INET_COUNT}} configured IPv4 address(es) become aliases; the lease provides the primary address.

{{/DHCP_ALIAS_NOTICE}} {{#DHCP_OPTIONS}} Use DHCP DNS Use DHCP default route {{/DHCP_OPTIONS}} {{#DHCP_ROUTE_OTHER_EGRESS}}

This router already has an IPv4 default route via {{DHCP_OTHER_EGRESS_IF}}. The lease’s default route will be installed alongside it; which one the kernel prefers is shown on the Routes page.

Turning the DHCP client off drops the lease and the default route it installed — add a static address that reaches you first.

Turning the DHCP client on or adding an address creates a virtual L3 interface (vether) on this bridge to carry it.

IPv6 addressing

Prefix delegation (WAN){{#V6_FWD_OFF}} needs forwarding{{/V6_FWD_OFF}}

Request an IPv6 prefix on this uplink and split it onto internal interfaces (dhcp6leased). One delegate token per line: em1, em1/60, or reserve to hold a gap.

Router advertisement (LAN){{#V6_FWD_OFF}} needs forwarding{{/V6_FWD_OFF}}

Advertise this interface’s prefixes to downstream clients (rad). Optionally advertise this router as their DNS resolver (RDNSS); the address is resolved from the DNS listen address. RA cannot be enabled on an uplink that accepts router advertisements.

autoconf: {{#V6_AUTOCONF6}}on{{/V6_AUTOCONF6}}{{^V6_AUTOCONF6}}off{{/V6_AUTOCONF6}}
forwarding: {{#V6_FWD_OFF}}{{V6_FORWARDING}} network tuning{{/V6_FWD_OFF}}{{^V6_FWD_OFF}}{{V6_FORWARDING}}{{/V6_FWD_OFF}}
gateway: {{V6_DEFAULT6}}
rdnss: {{V6_LEARNED_RDNSS}}

Display name

Routes via {{IF}}

No route in the kernel table uses this interface.

{{SR_DEST}}: {{SR_GW}} {{SR_META}}

{{SIDE_ROUTES_MORE_N}} more on the Routes page.

{{/SIDE_ROUTES_MORE}} Routes page →

Neighbours on {{IF}}

{{SIDE_ARP_COUNT}} ARP · {{SIDE_NDP_COUNT}} NDP

{{SA_IP}}: {{SA_MAC}}{{#SA_HAS_META}} {{SA_META}}{{/SA_HAS_META}}

{{SIDE_ARP_MORE_N}} more in the ARP table.

{{/SIDE_ARP_MORE}} ARP table →

Danger zone

Removes this interface from the configuration and destroys it in the kernel. This cannot be undone.

Live Connection Log Feed

Streaming logs for this interface.

Time	Source	Program	Message

Log lines from /var/log that mention this interface — kernel link-state changes and DHCP-client (dhcpleased/slaacd) activity. If a WAN port shows no IP, lease requests appear here. Requires the log:*:read capability.

{{DISPLAY_NAME}}

{{IF}}

Review staged changes

Confirm IPv6 change

Confirm address change

Addresses

WireGuard tunnel

PPPoE client

MSS-clamp firewall rule

WAN checklist

Tunnel ({{TUNNEL_TYPE}})

Confirm endpoint change

Bridge members

Bridge L2 settings

VLAN settings

Advanced settings

VLAN interfaces

On interface now (not in hostname file)

Add IP address

Live Connection Log Feed

Interface status

Staged changes

Review staged changes

Confirm IPv6 change

Confirm address change

Addresses

WireGuard tunnel

PPPoE client

MSS-clamp firewall rule

WAN checklist

Tunnel ({{TUNNEL_TYPE}})

Confirm endpoint change

Bridge members

Bridge L2 settings

VLAN settings

Advanced settings

VLAN interfaces

On interface now (not in hostname file)

Add IP address

Live Connection Log Feed