Removal

This guide explains how to completely remove the NetDefense plugin and its repository configuration from your OPNsense firewall.

Before You Begin

Caution

Removing the NetDefense plugin will:

• Stop all communication with the NetDefense server
• Mark the device as offline in your NetDefense dashboard
• End remote management of this device until you reinstall the plugin

The device registration stays in your NetDefense account, so you can reactivate it by reinstalling the plugin later.

Remove the Plugin

Via Web Interface

1. Navigate to System > Firmware > Plugins

2. Find os-netdefense in the list of installed plugins

3. Click the trash icon next to the plugin to uninstall

4. Confirm the removal when prompted

Via Command Line

1. Connect to your OPNsense device

   ssh root@your-opnsense-ip

2. Stop the NetDefense service

   service ndagent stop

3. Remove the package

   pkg remove os-netdefense

4. Confirm the removal when prompted (type y)

Remove Repository Configuration

If you no longer want to receive NetDefense updates or want to completely remove all traces of the repository:

1. Remove the repository configuration file

   rm /usr/local/etc/pkg/repos/netdefense.conf

2. Remove the fingerprints directory

   rm -rf /usr/local/etc/pkg/fingerprints/netdefense

3. Update the package database

   pkg update -f

Complete Removal Script

For a complete removal of the plugin and repository configuration, run this script:

#!/bin/sh

echo "Stopping NetDefense Agent..."
service ndagent stop 2>/dev/null

echo "Removing NetDefense package..."
pkg remove -y os-netdefense

echo "Removing repository configuration..."
rm -f /usr/local/etc/pkg/repos/netdefense.conf

echo "Removing fingerprints..."
rm -rf /usr/local/etc/pkg/fingerprints/netdefense

echo "Updating package database..."
pkg update -f

echo "NetDefense removal complete."

Verify Removal

After removal, verify all components are gone:

pkg info os-netdefense

service ndagent status

ls /usr/local/etc/pkg/repos/netdefense.conf

ls /usr/local/etc/pkg/fingerprints/netdefense

What Gets Removed

Removed

• NetDefense Agent binary (/usr/local/bin/ndagent)
• Service configuration
• Web interface plugin files
• Log configuration templates
• Action configuration files

Preserved

• System logs (in /var/log/)
• NetDefense account registration
• OPNsense system configuration (config.xml)

Clean Up Configuration Data

The removal process does not delete the NetDefense configuration stored in OPNsense’s config.xml. This allows for easy reinstallation with existing settings. To completely remove the configuration data:

Danger

Only perform this step if you want to completely erase all NetDefense settings from your device. This action cannot be undone.

Via Web Interface

1. Navigate to System > Configuration > Backups

2. Click Download to create a backup of your current configuration

3. Edit the downloaded XML file and remove the <netdefense> section under <OPNsense>

4. Navigate to System > Configuration > Backups

5. Upload the modified configuration file

Via Command Line

cp /conf/config.xml /conf/config.xml.backup

configctl template reload OPNsense/NetDefense

Cleanup Logs

If you want to remove NetDefense-related logs:

rm -f /var/log/ndagent.log

Tip

We recommend keeping log files for auditing purposes. OPNsense automatically rotates logs, so they won’t grow indefinitely.

Reinstallation

If you need to reinstall NetDefense later:

• Follow the Installation guide to set up the repository again
• Your previous configuration is preserved unless you cleaned up config.xml
• The device will reconnect automatically using its existing Device ID

NetDefense Account Cleanup

Removing the plugin from your device does not remove the device from your NetDefense account. To fully remove the device, use NDCLI:

# List devices to find the exact name
ndcli device list

# Remove the device from your organization
ndcli device remove <device-name>

Caution

Permanently deletes the device. On its next contact the device removes all NetDefense-managed configuration (firewall rules, aliases, VPN, users, external authentication servers, certificates and CAs, package repositories) except certificates and CAs still in use by a service, uninstalls the NetDefense agent and repository, and cannot be restored. Re-adding it requires a fresh installation.

This means the manual removal steps earlier on this page aren’t needed for a device that’s still online and reachable — it does them itself on its next contact. They’re still worth running if the device is already offline or unreachable. See Remove a Device for the full behavior.

This frees up the device slot in your NetDefense account.

Before removing a device that used an authentication server

If a login order on the device was ever edited by hand to include a server NetDefense manages, take the managed server out of that hand-edited order before removing the device. Decommission never rewrites an order it didn’t write itself (it only logs the fact — see below), so a stale name left behind will silently reactivate if a server with that exact name is ever created again later, on this device or another one that shares the same login-order policy.

After removing a device that used an authentication server

If the device you removed had an external authentication server configured — LDAP or Active Directory — two follow-ups aren’t automatic:

• Rotate the directory-side bind password, unconditionally. The device’s decommission process deletes the authentication server snippet’s entry on the firewall, but it has no way to invalidate the credential on the directory server itself — a copy of the old device’s config (a downloaded backup, for instance) can still use it to authenticate against your directory. Rotate the password even if you believe nothing else used that bind account:

  ndcli variable org set ldap_bind_password --value-stdin < ./new-bindpw.txt

  Change the password on the directory side first, then update the variable, then sync any remaining devices that authenticate against the same directory account so they pick up the new value. If a server on another device still binds with the same account through a device- or OU-level override of the same variable, update that override the same way.

• Check /var/log/ndagent-decommission.log on the firewall for a leftover authentication-related entry — decommission preserves system logs, so it’s still there after the plugin uninstalls itself. Look for:

  • the auth family failing after its retries — servers and the bind password may remain on the device;
  • ORDER_REFERENCES_DELETED_SERVER — a login order that still names a server decommission just deleted, because that order wasn’t NetDefense’s to rewrite;
  • ORDER_CHANGED_SINCE_WRITTEN — the login order was edited by hand since NetDefense last wrote it, so decommission left it alone rather than resetting it to the OPNsense default.

  Update or remove any leftover order entry yourself if the device is being repurposed rather than scrapped.

See Authentication Servers for why the password rotation matters even after the device itself is gone.