Review lost local inspection before adding an OPNsense IPS bypass

Bottom line: Approve the inspection exception before considering a performance benefit. Name the exact local traffic pairs that would bypass IPS and keep the remaining inspected paths visible.

Source fact: what the authority says

The OPNsense IPS bypass tutorial warns that traffic between the selected local networks will no longer be inspected. Its prerequisites enable IPS mode and select only internal interfaces, not WAN. The rules use source and destination prefixes, Pass action and the Bypass checkbox. The tutorial says the one-rule IPv6 prefix approach works only when the prefix is static.

What the source does not establish

This article reviews an inspection exception, not a recommendation to bypass all private networks. It does not promise a measured speed increase or establish equivalent coverage from another control.

Applicability questions

• Which internal source and destination networks would the bypass cover?
• Is the installed IPS interface arrangement within the guide’s stated prerequisites?
• Which security requirement currently depends on inspecting that local traffic?
• Is the IPv6 prefix static for the proposed rule population?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends treating the bypass first as an inspection-coverage decision, not an automatic tuning improvement. Draw the proposed source and destination population and have the security owner identify which internal paths would leave the intended inspection scope. Exclude the change if that loss conflicts with the accepted monitoring requirement.

Review the actual IPS interface arrangement against the guide before constructing a trial rule. Keep IPv4 and IPv6 populations distinct in the diagram. Where an IPv6 prefix is not established as static, stop and obtain an alternative reviewed design instead of assuming a manually entered prefix will remain appropriate.

Prepare an isolated representative traffic case with harmless local activity and an outside-population control. Write the expected inspection observations before enabling the trial. Keep performance measurement in a separate, explicitly designed comparison; do not promise an improvement from the existence of the optimization recipe alone.

Limit any approved trial to the reviewed networks and preserve the prior rules. Name the person who may remove the bypass if inspection coverage differs from the plan. Avoid combining the exercise with a ruleset update, capture-mode change or unrelated interface tuning that would make the observation difficult to interpret.

Verification and evidence

Proposed verification: inspect the exact source and destination networks, action and bypass selection against the approved diagram. In the isolated exercise, compare the agreed inspection observations for the covered local case and outside-population control. Record the effective interface and rule configuration with the actual outcomes, including unexpected continued or missing inspection.

Have the security owner review the resulting coverage before considering wider deployment. Reconcile the actual IPv6 prefix separately from the rule text. Retain before-and-after rules and any approved measurements, and keep an inconclusive observation as a reason to stop rather than evidence that every local flow is safe to bypass.

Official references

• OPNsense — IPS Bypass local traffic from inspection — official product documentation; confirm the installed release and configuration.

Source review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change.