Skip to content

Templates

A template groups snippets into a reusable policy set. Instead of assigning individual snippets to devices, you compose snippets into templates, then assign templates to organizational units. This creates a clean hierarchy: Snippets → Templates → OUs → Devices.

Template Position

Section titled “Template Position”

Each template has a position that determines where its firewall rules are placed relative to the device’s own rules. Like priority, position only affects rules. It’s set when the template is created and can be changed later, with Edit on the template’s page in the web app or ndcli template update <name> --position APPEND.

PositionMeaning
PREPENDRules are placed before the device’s own rules. Use this for organization-wide security policies that rules configured locally shouldn’t override (e.g., drop invalid packets, block bogon ranges).
APPENDRules are placed after the device’s own rules, except legacy ones (see below). Use this for catch-all policies like logging or default-deny rules that should only apply to traffic not already handled by earlier rules.

OPNsense evaluates firewall rules in sections — floating rules first, then interface-group rules, then rules on a single interface — and NetDefense orders rules only inside a section. With NetDefense agent 1.23.0 or later (verified on OPNsense 26.7), PREPEND rules come before the device’s own rules of the same section, and APPEND rules after them, except legacy rules (not yet migrated), which OPNsense always evaluates last in a section. A device upgraded from OPNsense 26.1 or earlier keeps its default LAN rules as legacy rules until they’re migrated under Firewall > Migration assistant (shown while legacy rules exist), so on LAN an APPEND rule comes before them.

When a device gets the same rule snippet from a PREPEND template and from an APPEND template, the rule is placed as PREPEND.

To keep PREPEND rules first, a sync may raise the sequence numbers of the device’s own rules, keeping their order. The first sync after a PREPEND rule is added, or after the device’s agent is upgraded to 1.23.0, can change several of them, each as a separate configuration revision on the device and each listed in the sync result; later syncs leave them as they are while their order holds. See The device’s own rules can be renumbered.

See Policy Chain for a detailed explanation of how PREPEND and APPEND templates combine with snippet priorities to produce the final device configuration.

List Templates

Section titled “List Templates”

Open Templates in the sidebar. Each card shows a template with its PREPEND or APPEND position; + Create Template adds one. See Templates.

Describe a Template

Section titled “Describe a Template”

Click a template’s name. Its page shows the template’s position and description, its snippets grouped by type, its variable overrides and its software policies. See Template detail.