Parsec failing with errors when using FreeBSD Cloudflared on OPNSense router.

[Apprisco]

Docker hosted cloudflared with QUIC works perfectly.
Cloudflared on OPNSense shows corrupted encryption headers, using both 25.8.0 and 26.2.0. No clue what is going on

[kjake]

I haven't tried a realtime protocol like Parsec, which is going to be more sensitive to tunnel stability. Some of this will come down to networking.

I've updated the README.md specific to OPNsense:

Navigate to System -> Settings -> Tunables
Add or update:
kern.ipc.maxsockbuf = 16777216
net.inet.udp.recvspace = 8388608

With these set, you should no longer see log messages like wanted: 7168 kiB, got 41 kiB.

I also rebuilt 2026.2.0 with a small patch to more gracefully handle QUIC issues and should allow a failback to HTTP2 if they persist.

If you see lots of HTTP2 failback, you can also try running sysrc cloudflared_mode='tunnel --no-autoupdate --quic-disable-pmtu-discovery run' on your OPNsense host. This will add/update the key value in /etc/rc.conf to disable Path MTU Discovery (PMTUD), which could stabilize QUIC enough to avoid the HTTP2 failback.

I'm running this on my own OPNsense system now.

# /usr/local/bin/cloudflared --version
cloudflared version 2026.2.0 (built 2026-03-04-0053 UTC)

I am still seeing some socket: no buffer space available for UDP traffic, so I'm looking into other tweaks and will update here as I test more.

[Apprisco]

I tried the latest build target at

cloudflared version 2026.2.0 (built 2026-03-04-0053 UTC)

It did not resolve the issue with Parsec with the additional tunables persisted in opnsense.

Is there any way you can try testing with Parsec? It is a pretty common RDP program, though Moonlight does work through the connection just fine. According to Parsec, the issue is isolated with the FreeBSD CF build (as the docker build works fine)

[kjake]

Thanks for trying. I can look at setting it up, but it will take me some time.

[Apprisco]

Yup, still no dice. I believe something is being handled wrong with encrypted packets on the FreeBSD build, and isn't really a QUIC stability issue. There's also nothing logged in cloudflared anywhere, simply parsec packets fail.

Please let me know if you get around to this- I was stupid and shut down my docker VM and now i'm locked out of my home network.. and sometimes you do have to reboot the docker host ya know?