Templates

A template groups snippets into a reusable policy set. Instead of assigning individual snippets to devices, you compose snippets into templates, then assign templates to organizational units. This creates a clean hierarchy: Snippets → Templates → OUs → Devices.

Template Position

Each template has a position that determines where its firewall rules are placed relative to the device’s own rules. Like priority, position only affects rules. It’s set when the template is created and can’t be changed afterwards: to change it, create a new template with the position you want.

Position	Meaning
PREPEND	Rules are placed before the device’s own rules. Use this for organization-wide security policies that rules configured locally shouldn’t override (e.g., drop invalid packets, block bogon ranges).
APPEND	Rules are placed after the device’s own rules, except legacy ones (see below). Use this for catch-all policies like logging or default-deny rules that should only apply to traffic not already handled by earlier rules.

OPNsense evaluates firewall rules in sections — floating rules first, then interface-group rules, then rules on a single interface — and NetDefense orders rules only inside a section. With NetDefense agent 1.23.0 or later (verified on OPNsense 26.7), PREPEND rules come before the device’s own rules of the same section, and APPEND rules after them, except legacy rules (not yet migrated), which OPNsense always evaluates last in a section. A device upgraded from OPNsense 26.1 or earlier keeps its default LAN rules as legacy rules until they’re migrated under Firewall > Migration assistant (shown while legacy rules exist), so on LAN an APPEND rule comes before them.

When a device gets the same rule snippet from a PREPEND template and from an APPEND template, the rule is placed as PREPEND.

Note

A PREPEND rule doesn’t come before every local rule. A device’s floating and interface-group rules are evaluated before a PREPEND rule on a single interface, and an APPEND rule on several interfaces is a floating rule, evaluated before the device’s single-interface rules. A sync warns when this puts a rule of the device ahead of a PREPEND rule, or after an APPEND rule. See Where rules land on the device.

To keep PREPEND rules first, a sync may raise the sequence numbers of the device’s own rules, keeping their order. The first sync after a PREPEND rule is added, or after the device’s agent is upgraded to 1.23.0, can change several of them, each as a separate configuration revision on the device and each listed in the sync result; later syncs leave them as they are while their order holds. See The device’s own rules can be renumbered.

See Policy Chain for a detailed explanation of how PREPEND and APPEND templates combine with snippet priorities to produce the final device configuration.

List Templates

View in NDWeb

ndcli template list

╭────────────────────────┬──────────┬──────────────────────────────────────────┬──────────┬──────────────────╮
│ Name                   │ Position │ Description                              │ Snippets │ Created          │
├────────────────────────┼──────────┼──────────────────────────────────────────┼──────────┼──────────────────┤
│ base-hardening         │ PREPEND  │ Drop invalid, rate-limit ICMP, anti-s... │ 5        │ 2026-02-20 19:18 │
│ corporate-services     │ PREPEND  │ Core corporate services: DNS, NTP, LD... │ 4        │ 2026-02-20 19:18 │
│ guest-isolation        │ PREPEND  │ Guest network isolation: internet-onl... │ 3        │ 2026-02-20 19:18 │
│ intrusion-prevention   │ PREPEND  │ GeoIP filtering, port scan detection,... │ 3        │ 2026-02-20 19:18 │
│ logging-and-monitoring │ APPEND   │ Traffic logging for accepted and drop... │ 2        │ 2026-02-20 19:18 │
╰────────────────────────┴──────────┴──────────────────────────────────────────┴──────────┴──────────────────╯

Describe a Template

View in NDWeb

ndcli template describe base-hardening

Name:        base-hardening
Description: Drop invalid, rate-limit ICMP, anti-spoofing, block bogons
Position:    PREPEND
Created:     2026-02-20 19:18:43
Updated:     2026-02-20 19:18:52

Snippets (5):
╭──────────────────────┬──────────┬───────┬──────────────────╮
│ Name                 │ Priority │ Type  │ Updated          │
├──────────────────────┼──────────┼───────┼──────────────────┤
│ drop-invalid-state   │ 10       │ RULE  │ 2026-02-20 19:18 │
│ rate-limit-icmp      │ 20       │ RULE  │ 2026-02-20 19:18 │
│ anti-spoofing        │ 30       │ RULE  │ 2026-02-20 19:18 │
│ log-and-drop-default │ 50       │ RULE  │ 2026-02-20 19:18 │
│ bogon-ranges         │ 1000     │ ALIAS │ 2026-02-20 19:18 │
╰──────────────────────┴──────────┴───────┴──────────────────╯