Templates

Templates are named bundles of snippets. You assign templates to OUs or directly to devices, and NetDefense computes each device’s final configuration by merging every applicable template in the right order. Read the concept overview in Templates and Policy Chain.

Templates list

Each row is one template, with a colour-coded PREPEND or APPEND badge — that’s the template’s position in the policy chain. The position applies to the template’s firewall rules. OPNsense evaluates floating rules, then interface-group rules, then single-interface rules. With NetDefense agent 1.23.0 or later, PREPEND rules come before the device’s own rules in each section, and APPEND rules after them. Legacy rules (not yet migrated) always stay last in their section, after APPEND rules too. To keep PREPEND rules first, the agent may raise the sequence numbers of the device’s own rules; their order is kept and every change is listed in the sync task’s result. See Where rules land on the device.

Each row’s … menu offers Rename and Delete. Click the template name to open its detail page, which has the Edit button.

Use + Create Template to start a new one. You’ll need a name, a position, and an optional description; you can add snippets afterwards.

Template detail

Template Information holds the metadata: name, position, description, and timestamps. A template’s chain position is set when you create it. To change it, create a new template with the position you want, attach its snippets there, and assign it in place of the old one.

Snippets groups the assigned snippets by type (Aliases, Rules, Groups, Users, Host Overrides, etc.) and shows each with its priority and name. The lower the priority number the earlier it applies inside the template. Use the All Types filter to focus on one kind. + Add snippets… opens a multi-select picker scoped to the active organization; the trash icon detaches a snippet (the snippet itself is not deleted).

Variable Overrides sets variable values that apply when this template is computed — useful when a single template should ship with its own default for a parameter regardless of where it’s assigned. The standard precedence still applies: a device override beats an OU override which beats a template override which beats the organization default.

Scrolling further reveals Assignments — every OU and device this template is attached to.