Release v1.13.0

Mehr Verwaltung pro Firewall und ein Abgleich der Cluster-Knoten. Alles über
dieselbe abgesicherte Engine wie in 1.12.0 und live auf drei Test-Firewalls
geprüft, siehe Handbuch „Erweiterung 1.13.0“:

- **Netzwerk › Geräte:** LAGG, Bridge, Loopback und GRE. Dazu Gateway-Gruppen,
  DNS-Weiterleitungen (Unbound) und DHCP-Bereiche (dnsmasq).
- **Neue Gruppe „Host-System“:** Tunables (immer mit Bestätigung, Vorgaben nur per
  „Überschreiben“), Cron, Syslog-Ziele und ZFS-Snapshots (anlegen und löschen; der
  aktive Snapshot ist geschützt, das Aktivieren bleibt OPNsense selbst überlassen).
- **Netzwerk › Abgleich:** zeigt Unterschiede in der Netzwerk-Konfiguration zwischen den
  Knoten eines Clusters. Neuer Alarm „Netzwerk-Abweichung im Cluster“ (Einstellungen ›
  Benachrichtigungen, Migration 0004).
- **Auf den Partner übertragen:** Nach dem Anlegen eines Objekts lässt es sich mit
  einem Klick auch auf dem anderen Cluster-Knoten anlegen (eigene Vorschau, eigenes Backup).
- **Kopfzeile:** Mit acht Gruppen zeigt die Navigation die Namen ab 1150 px, darunter
  nur Icons, damit Suche und Abmelden in einer Zeile bleiben.

CHANGELOG.md

@@ -31,6 +31,146 @@ den Einstellungen.
 Nächste Codenamen (der Reihe nach, wenn die jeweils nächste MINOR-Version
 ansteht): Merlin …
 
+## [1.13.0] "Buzzard" — 2026-10-09
+
+Mehr Verwaltung pro Firewall und ein Abgleich der Cluster-Knoten. Alles über
+dieselbe abgesicherte Engine wie in 1.12.0 und live auf drei Test-Firewalls
+geprüft, siehe Handbuch „Erweiterung 1.13.0“:
+
+- **Netzwerk › Geräte:** LAGG, Bridge, Loopback und GRE. Dazu Gateway-Gruppen,
+  DNS-Weiterleitungen (Unbound) und DHCP-Bereiche (dnsmasq).
+- **Neue Gruppe „Host-System“:** Tunables (immer mit Bestätigung, Vorgaben nur per
+  „Überschreiben“), Cron, Syslog-Ziele und ZFS-Snapshots (anlegen und löschen; der
+  aktive Snapshot ist geschützt, das Aktivieren bleibt OPNsense selbst überlassen).
+- **Netzwerk › Abgleich:** zeigt Unterschiede in der Netzwerk-Konfiguration zwischen den
+  Knoten eines Clusters. Neuer Alarm „Netzwerk-Abweichung im Cluster“ (Einstellungen ›
+  Benachrichtigungen, Migration 0004).
+- **Auf den Partner übertragen:** Nach dem Anlegen eines Objekts lässt es sich mit
+  einem Klick auch auf dem anderen Cluster-Knoten anlegen (eigene Vorschau, eigenes Backup).
+- **Kopfzeile:** Mit acht Gruppen zeigt die Navigation die Namen ab 1150 px, darunter
+  nur Icons, damit Suche und Abmelden in einer Zeile bleiben.
+
+## [1.12.0] "Condor" — 2026-10-09
+
+Netzwerk-Verwaltung und Übernahme von Hand angelegter Regeln. Alles gegen die
+OPNsense-Core-Quellen geprüft und live auf drei Test-Firewalls (26.7.1 und
+26.7.6) getestet, siehe Handbuch „Netzwerk, DNS und DHCP“:
+
+- **Neuer Bereich „Netzwerk“:** Inventar je Firewall (Schnittstellen mit
+  Adressen und CARP-Zustand, VLANs, virtuelle IPs, Gateways, Routen, DNS-Einträge,
+  DHCP) und Änderungen daran: anlegen, bearbeiten, löschen für VLANs, virtuelle
+  IPs, Gateways, statische Routen, Schnittstellen-Zuweisung samt IP-Konfiguration,
+  Unbound-DNS-Einträge, dnsmasq-Hosts sowie Kea-Subnetze und -Reservierungen.
+- **Abgesichert:** Jede Änderung läuft über eine Vorschau mit Diff und einem Token,
+  der den Firewall-Stand erfasst. Vor dem Schreiben wird ein Konfig-Backup
+  gespeichert (ohne Backup keine Änderung), danach angewendet und zurückgelesen.
+  OPNexus erkennt, über welche Schnittstelle es die Firewall erreicht; Änderungen,
+  die diese Verbindung kappen können (Verwaltungs-Schnittstelle, Standard-Gateway,
+  Standardroute, Route über die Firewall-Adresse), brauchen eine ausdrückliche
+  Bestätigung mit Eingabe des Firewall-Namens. Es gibt bewusst **keinen**
+  automatischen Rollback: OPNexus kann eine Änderung nicht zurücknehmen, wenn sie
+  seine eigene Verbindung trennt. Das Backup vor der Änderung ist der Rückweg.
+- **Schnittstellen-Löschen:** OPNsense entfernt dabei selbst alle Regeln, die die
+  Schnittstelle nutzen. Die Vorschau listet sie, die Bestätigung ist Pflicht.
+  Bereits auf der Firewall vorgemerkte Änderungen blockieren eine neue Änderung.
+- **IP-Konfiguration per API gibt es erst ab OPNsense 26.7.6.** Auf 26.7.1 ist die
+  Zuweisungsliste nur lesbar; OPNexus erkennt das an den Daten und sperrt die
+  Änderung mit Begründung.
+- **Von der Firewall übernehmen:** Regeln, die direkt in OPNsense angelegt wurden,
+  lassen sich in OPNexus übernehmen, bearbeiten und ausrollen. Die Übernahme schreibt
+  nichts auf die Firewall. Regeln, die das Modell verfälschen würde (invertierte
+  Quelle/Ziel, mehrere Schnittstellen, keine Quick-Regel, …), werden mit Grund
+  abgelehnt. Neu: Regeln haben ein Protokollieren-Flag (`log`, Migration 0003),
+  damit es beim Bearbeiten nicht still verloren geht; nicht modellierte Felder
+  (Gateway, Zustandsoptionen, …) bleiben auf der Firewall unverändert.
+- **Geheimnisse:** Das CARP-Passwort (liefert OPNsense im Klartext) und der
+  Kea-DDNS-Schlüssel werden nie zurückgegeben, gespeichert oder auditiert.
+- **Host-Adresse änderbar:** Hosts › Bearbeiten hat jetzt das Feld „Adresse“. Nach
+  einer Änderung der Verwaltungs-IP muss der Host nicht mehr gelöscht und neu
+  angelegt werden; Verlauf und Zuordnungen bleiben erhalten. Meldet eine Änderung
+  „angewendet, aber nicht prüfbar“, weist die Oberfläche darauf hin.
+- **Fehler aus den Live-Tests, die Mocks nicht gezeigt haben:** Jede Änderung einer
+  virtuellen IP muss die Adresse (`network`) wiederholen, sonst leert OPNsense sie
+  bzw. lehnt ab; die Prüfung nach dem Anwenden vergleicht jetzt den vollständigen
+  Soll-Zustand statt nur der gesendeten Felder. Dazu: Gateway-Priorität als Zahl,
+  Routen mit `enabled` statt `disabled`, Beschreibungsmuster der Schnittstellen,
+  gesperrte Schnittstellen, Pflicht-Backup vor jeder Änderung.
+- **Hinweis zu den Versionen:** Die IP-Konfiguration von Schnittstellen per API gibt
+  es erst ab OPNsense 26.7.6. Mit 26.7.5 (die Prod-Firewalls) sind VLANs, virtuelle
+  IPs, Gateways, Routen, DNS und DHCP verwaltbar, Schnittstellen nur lesbar.
+
+## [1.11.1] "Merlin" — 2026-10-09
+
+Fehler aus dem ersten Live-Test der bisher nur gemockten Funktionen auf drei
+echten OPNsense-Firewalls (alle in den Tests mit Mocks unsichtbar geblieben).
+Live bestätigt sind jetzt auch das Major-Upgrade über den Update Center
+(25.7 → 26.1 → 26.7, je mit Backup und Abschluss-Bestätigung), WireGuard,
+OpenVPN, IPsec, Zertifikate, ACME (Staging), hierarchische Policies,
+Benachrichtigungen und der HA-Config-Sync:
+
+- **Zertifikate (Trust-Store) und ACME ließen sich nicht pushen:** Die URLs
+  endeten auf `…Action` (`/trust/cert/addAction`), OPNsense kennt aber nur
+  `/trust/cert/add`, `set`, `del` bzw. `/acmeclient/…/add`, `update`, `del` (404).
+  Die Mocks hatten denselben Tippfehler. Ein neuer Test prüft den Client-Quelltext
+  gegen dieses Muster.
+- **OpenVPN-Deploy scheiterte immer:** Die Firewall verlangt `vpnid` und vergibt
+  es nicht selbst. OPNexus wählt jetzt die nächste freie. Außerdem erwarten
+  `cert`/`ca` (OpenVPN) und `caref` (Zertifikat signieren) die **refid** der
+  Trust-Store-Einträge, der Picker lieferte die Zeilen-UUID. Die Listen
+  `/hosts/{id}/certificates` und `/cas` liefern jetzt `refid`; im
+  Zertifikatsformular gibt es ein CA-Dropdown statt eines Freitextfelds.
+- **WireGuard meldete „Erfolg“ ohne laufenden Tunnel:** Ist der globale Dienst
+  (VPN › WireGuard › Allgemein) aus, entsteht trotz geschriebener Konfiguration
+  kein Interface. Der Deploy schaltet den Dienst jetzt ein.
+- **Dienststeuerung:** Das Backend prüfte weder, ob der Dienst existiert, noch ob
+  er gesperrt ist (pf, webgui, routing …). Beides war nur in der UI gesperrt;
+  unbekannte Namen meldete die Firewall trotzdem als „ok“. Jetzt 404
+  `SERVICE_NOT_FOUND` bzw. 409 `SERVICE_LOCKED`.
+- **Fehlertexte der Firewall unleserlich:** Die Redaktion maskierte jede
+  Validierungsmeldung, deren Feldname `cert`, `crt` oder `auth` enthält
+  („instance.cert: [redacted]“). In `validations` lösen diese drei Namen die
+  Maskierung nicht mehr aus; echte Geheimnisfelder bleiben maskiert. Das
+  Löschen eines benutzten Zertifikats nennt jetzt den Grund der Firewall
+  („Item in use by OpenVPN …“) statt eines allgemeinen Fehlers.
+- **Drift-Alarme flackerten beim Neustart eines Cluster-Mitglieds:** Mit nur
+  einem erreichbaren Host gab es nichts zu vergleichen, offene Regel-/NAT-Drift-
+  und Zertifikatsprobleme wurden „gelöst“ und danach neu geöffnet (je ein
+  Meldungspaar pro Problem). Offene Probleme bleiben jetzt unverändert, solange
+  sie nicht beurteilbar sind.
+- **IPsec lief nach dem Deploy nicht:** Der globale IPsec-Schalter war aus, die
+  Verbindungen wurden gespeichert, `reconfigure` antwortete „ok“, OPNexus meldete
+  „Erfolg“ (gleiche Klasse wie bei WireGuard). Der Deploy schaltet ihn jetzt ein;
+  zwischen zwei Test-FWs steht der Tunnel (Phase 1 verbunden).
+- **Löschen scheiterte ohne Grund:** Wenn die Firewall ein Löschen ablehnt (Alias
+  noch in einer Regel, Zertifikat in Benutzung), nennt die Meldung jetzt den Grund
+  der Firewall (`UPSTREAM_REJECTED`) statt „Anfrage fehlgeschlagen“.
+- **Kaputte Eingaben:** Ein NUL-Zeichen in einem Textfeld ergab einen 500er samt
+  abgebrochener Verbindung, ebenso ein langes oder NUL-haltiges Pfadsegment (der
+  Audit-Eintrag übernahm es ungeprüft in `VARCHAR(36)`). Jetzt 422 bzw. 404/422;
+  ein Fuzz-Lauf über alle 188 Routen findet keine 5xx mehr.
+- **`opnexus rollback` landete auf der falschen Version:** Zurückgesetzt wurde auf
+  die vom Backend gemeldete Programmversion statt auf den vorher eingestellten
+  Image-Tag. Bei Release-Candidates (rc1-Images melden schon `1.11.0`) führte das
+  auf das neuere Release. Jetzt wird der vorherige exakte Tag wiederhergestellt.
+- **Handy-Ansicht (375px) zoomte aus:** Die ausgeblendete Überschrift der
+  Aktionsspalte (`sr-only`, absolut positioniert) lag außerhalb der scrollbaren
+  Tabellenkarte und machte die Seite bis zu doppelt so breit (Hosts, Benutzer,
+  Host-Details). Scroll-Container sind jetzt der Bezugsrahmen.
+- **Überschriften-Reihenfolge:** Kartentitel in den Listen (OpenVPN, IPsec,
+  WireGuard, NAT) sind `h2` statt `h3`, sichtbar erst mit Daten; axe meldet auf
+  allen Seiten, hell und dunkel, nichts mehr.
+
+- **CARP-Wartungsfenster mit Auto-Revert:** Nach dem automatischen Zurückschalten
+  blieb die Aktion „CARP-Übergabe“ (`carp_enter`) offen. Sie ließ sich nicht mehr
+  bestätigen (der Host ist ja nicht mehr im Wartungsmodus) und blockierte alle
+  Deploys und Updates im Cluster (`OPEN_HOST_MAINTENANCE_BLOCKS_DEPLOY`), bis
+  jemand sie von Hand abbrach. Der Auto-Revert schließt die Aktion jetzt selbst
+  (Status „abgebrochen“, Audit-Eintrag). Schlägt das Zurückschalten fehl, bleibt
+  sie bewusst offen. Gefunden beim Live-Test gegen zwei OPNsense-26.7-Firewalls.
+- **Update Center, Protokoll-Fenster:** Nach einem Update mit Neustart ist das
+  Protokoll der Firewall leer; angezeigt wurde dann nur das Wort „error“, obwohl
+  das Update erfolgreich war. Jetzt steht dort ein erklärender Hinweis.
+
 ## [1.11.0] "Merlin" — 2026-10-07
 
 Sicherheitsüberprüfung vom 2026-10-07, umgesetzte Korrekturen.

README.de.md

@@ -7,7 +7,7 @@ Zentrale Verwaltung mehrerer [OPNsense](https://opnsense.org)-Firewalls: Regeln,
 
 ![Zentrale Firewall-Regeln](website/assets/screenshots/de/rules-light-desktop.webp)
 
-> **Stand:** `1.11.0-rc2` ist der aktuelle öffentliche Release-Candidate (er löst `1.11.0-rc1` und die `1.10.x`-Kandidaten ab). Entwickelt wurde gegen echte OPNsense-Instanzen, eine frische Installation aus den veröffentlichten Images ist aber noch nicht im Feld erprobt — bitte Ecken und Kanten melden.
+> **Stand:** `1.13.0` ist die aktuelle stabile Version. Entwickelt und getestet wurde gegen echte OPNsense-Instanzen; eine frische Installation aus dem Release-Bundle sowie Updates und Rollbacks sind durchgängig geprüft. Ecken und Kanten bitte melden.
 
 ## Funktionen
 
@@ -16,6 +16,7 @@ Zentrale Verwaltung mehrerer [OPNsense](https://opnsense.org)-Firewalls: Regeln,
 - **Sichere Änderungen** — jede Änderung läuft *Prüfen → Ausrollen → Bestätigen*; bleibt die Bestätigung im Zeitfenster aus, rollt OPNexus zurück.
 - **Hierarchische Policies** — Pre-/Post-Rulebases mit Vererbung über Gruppenbäume.
 - **VPN** — IPsec-Site-to-Site, OpenVPN und WireGuard, einmal definiert und ausgerollt.
+- **Netzwerk** — Schnittstellen, VLANs, virtuelle IPs, Gateways, Routen, LAGG/Bridge/GRE, DNS und DHCP je Firewall, dazu Tunables, Cron, Syslog und Snapshots, ein Abgleich der Cluster-Knoten, mit Diff-Vorschau, Backup vor jeder Änderung und Schutz davor, die eigene Verbindung zu kappen; von Hand angelegte Regeln lassen sich übernehmen.
 - **Zertifikate** — Trust-Store für alle Firewalls und Ausstellung per ACME / Let's Encrypt.
 - **Logs & Audit** — zentrale Log-Suche mit Korrelation, Dashboards und lückenloser Deploy-Verlauf.
 - **Update-Center** — Firmware-Updates für die Flotte, mit Blick auf HA-Reihenfolge und Wartungsmodus.
@@ -46,7 +47,7 @@ Für den Zugriff von anderen Rechnern und den Produktivbetrieb mit TLS (mitgelie
 
 ```bash
 OPNEXUS_IMAGE_REPO=git.opnexus.dev/opnexus
-OPNEXUS_VERSION=1.11.0-rc2
+OPNEXUS_VERSION=1.13.0
 ```
 
 ```bash

README.md

@@ -7,7 +7,7 @@ Central management for multiple [OPNsense](https://opnsense.org) firewalls: rule
 
 ![Central firewall rules](website/assets/screenshots/en/rules-light-desktop.webp)
 
-> **Status:** `1.11.0-rc2` is the current public release candidate (it replaces `1.11.0-rc1` and the `1.10.x` candidates). It has been developed against real OPNsense instances, but a fresh install from the published images has not been field-tested yet — please expect rough edges and report them.
+> **Status:** `1.13.0` is the current stable release. It has been developed and tested against real OPNsense instances; a clean install from the release bundle, updates and rollbacks have been verified end to end. Please report rough edges.
 
 ## What it does
 
@@ -16,6 +16,7 @@ Central management for multiple [OPNsense](https://opnsense.org) firewalls: rule
 - **Safe changes** — every change goes *preview → deploy → confirm*; without your confirmation inside the time window OPNexus rolls it back.
 - **Hierarchical policies** — pre/post rulebases with inheritance across group trees.
 - **VPN** — IPsec site-to-site, OpenVPN and WireGuard, defined once and rolled out.
+- **Network** — interfaces, VLANs, virtual IPs, gateways, routes, LAGG/bridge/GRE, DNS and DHCP per firewall, plus tunables, cron, syslog and snapshots, a comparison of cluster nodes, with a diff preview, a backup before every change and a guard against cutting your own connection; rules created by hand on a firewall can be adopted.
 - **Certificates** — trust store for all firewalls and ACME / Let's Encrypt issuance.
 - **Logs & audit** — central log search with correlation, dashboards and a complete deploy audit trail.
 - **Update center** — firmware updates for the fleet, aware of HA order and maintenance mode.
@@ -48,7 +49,7 @@ For access from other machines and for production use with TLS (bundled Caddy pr
 
 ```bash
 OPNEXUS_IMAGE_REPO=git.opnexus.dev/opnexus
-OPNEXUS_VERSION=1.11.0-rc2
+OPNEXUS_VERSION=1.13.0
 ```
 
 ```bash

backend/app/errors.py

@@ -99,6 +99,13 @@ class ErrorCode(str, Enum):
     REGELLISTE_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_ERNEUT_529D7203 = "REGELLISTE_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_ERNEUT_529D7203"
     REGEL_HAT_KEINE_ZIEL_HOSTS = "REGEL_HAT_KEINE_ZIEL_HOSTS"
     REGEL_NICHT_GEFUNDEN = "REGEL_NICHT_GEFUNDEN"
+    NETWORK_ACK_REQUIRED = "NETWORK_ACK_REQUIRED"
+    NETWORK_APPLY_UNCERTAIN = "NETWORK_APPLY_UNCERTAIN"
+    NETWORK_BACKUP_FAILED = "NETWORK_BACKUP_FAILED"
+    NETWORK_CHANGE_BLOCKED = "NETWORK_CHANGE_BLOCKED"
+    NETWORK_FIELD_INVALID = "NETWORK_FIELD_INVALID"
+    NETWORK_ITEM_NOT_FOUND = "NETWORK_ITEM_NOT_FOUND"
+    RULE_NOT_ADOPTABLE = "RULE_NOT_ADOPTABLE"
     REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_BF51B6B0 = "REGEL_WURDE_INZWISCHEN_GEAENDERT_NEU_LADEN_UND_AENDERUNGEN_BF51B6B0"
     RESTORE_VORGANG_NICHT_GEFUNDEN = "RESTORE_VORGANG_NICHT_GEFUNDEN"
     ROLLBACK_ERNEUT_FEHLGESCHLAGEN_PRUEFE_DIE_ERREICHBARKEIT_DER_FIREWALL = "ROLLBACK_ERNEUT_FEHLGESCHLAGEN_PRUEFE_DIE_ERREICHBARKEIT_DER_FIREWALL"
@@ -134,6 +141,10 @@ class ErrorCode(str, Enum):
     OPEN_DEPLOYMENT_DRAFT_UNCHANGED = "OPEN_DEPLOYMENT_DRAFT_UNCHANGED"
     OPEN_HOST_MAINTENANCE_BLOCKS_DEPLOY = "OPEN_HOST_MAINTENANCE_BLOCKS_DEPLOY"
     OPEN_RESTORE_BLOCKS_DEPLOY = "OPEN_RESTORE_BLOCKS_DEPLOY"
+    UPSTREAM_REJECTED = "UPSTREAM_REJECTED"
+    INVALID_CHARACTERS = "INVALID_CHARACTERS"
+    SERVICE_NOT_FOUND = "SERVICE_NOT_FOUND"
+    SERVICE_LOCKED = "SERVICE_LOCKED"
     READ_ONLY_ACCESS = "READ_ONLY_ACCESS"
 
 

backend/app/main.py

@@ -7,6 +7,9 @@ from fastapi import FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from sqlalchemy.exc import DBAPIError
+
+from app.errors import ErrorCode
 
 from app import models  # noqa: F401 - registers models with Base.metadata
 from app.auth_middleware import AuthMiddleware
@@ -33,6 +36,9 @@ from app.routers import ipsec as ipsec_router
 from app.routers import openvpn as openvpn_router
 from app.routers import wireguard as wireguard_router
 from app.routers import certificates as certificates_router
+from app.routers import network as network_router
+from app.routers import snapshots as snapshots_router
+from app.routers import network_drift as network_drift_router
 from app.routers import restore as restore_router
 from app.version import APP_VERSION
 from app.routers import dashboard as dashboard_router
@@ -289,6 +295,19 @@ async def _safe_validation_error(request: Request, exc: RequestValidationError):
     )
 
 
+@app.exception_handler(DBAPIError)
+async def _database_text_errors(request: Request, exc: DBAPIError):
+    """A NUL byte in any text field cannot be stored by Postgres and used to
+    surface as a 500 plus a dropped connection (found by fuzzing). That is bad
+    input, not a server fault. Anything else stays a normal 500."""
+    if type(exc.orig).__name__.endswith("CharacterNotInRepertoireError") or "0x00" in str(exc.orig):
+        return JSONResponse(
+            status_code=422,
+            content={"detail": {"code": ErrorCode.INVALID_CHARACTERS.value, "params": {}}},
+        )
+    raise exc
+
+
 app.add_middleware(AuthMiddleware)
 # Inside CORS so preflights are answered first; outside Auth so a forged
 # cross-site write is rejected before any session lookup happens.
@@ -374,5 +393,8 @@ app.include_router(restore_router.router, prefix="/api")
 app.include_router(dashboard_router.router, prefix="/api")
 app.include_router(cluster_router.router, prefix="/api")
 app.include_router(services_router.router, prefix="/api")
+app.include_router(network_router.router, prefix="/api")
+app.include_router(snapshots_router.router, prefix="/api")
+app.include_router(network_drift_router.router, prefix="/api")
 app.include_router(resource_samples_router.router, prefix="/api")
 app.include_router(scheduled_maintenance_router.router, prefix="/api")

backend/app/models/notification.py

@@ -48,6 +48,7 @@ class NotificationSettings(Base):
     maintenance_unknown_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
     carp_health_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
     nat_drift_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
+    network_drift_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
     carp_auto_revert_failed_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
 
     poll_interval_seconds: Mapped[int] = mapped_column(Integer, default=300)

backend/app/models/rule.py

@@ -1,7 +1,7 @@
 import uuid
 from datetime import datetime, timezone
 
-from sqlalchemy import Boolean, DateTime, String
+from sqlalchemy import Boolean, DateTime, String, false
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
@@ -29,6 +29,7 @@ class FirewallRule(Base):
     destination_net: Mapped[str] = mapped_column(String(128), default="any")
     destination_port: Mapped[str | None] = mapped_column(String(32), nullable=True)
     enabled: Mapped[bool] = mapped_column(Boolean, default=True)
+    log: Mapped[bool] = mapped_column(Boolean, default=False, server_default=false())
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), default=lambda: datetime.now(timezone.utc)
     )

backend/app/routers/aliases.py

@@ -146,7 +146,7 @@ async def delete_alias(alias_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         await undeploy_alias(db, alias)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(alias, attribute_names=["deployments"])
     await db.delete(alias)
     await db.commit()

backend/app/routers/certificates.py

@@ -112,7 +112,7 @@ async def delete_managed_certificate(cert_id: uuid.UUID, db: AsyncSession = Depe
     try:
         await managed_certificate_service.delete_certificate(db, cert, host)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
 
 
 # ── ACME accounts ──────────────────────────────────────────────────────
@@ -197,7 +197,7 @@ async def delete_acme_account(account_id: uuid.UUID, db: AsyncSession = Depends(
     try:
         await acme_service.delete_account(db, account, host)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
 
 
 # ── ACME certificate requests ─────────────────────────────────────────
@@ -298,4 +298,4 @@ async def delete_acme_certificate_request(request_id: uuid.UUID, db: AsyncSessio
     try:
         await acme_service.delete_certificate_request(db, req, host)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc

backend/app/routers/hosts.py

@@ -155,6 +155,8 @@ async def update_host(host_id: uuid.UUID, payload: HostUpdate, db: AsyncSession
         if existing:
             raise api_error(409, ErrorCode.HOST_MIT_DIESEM_NAMEN_EXISTIERT_BEREITS)
         host.name = payload.name
+    if payload.base_url is not None:
+        host.base_url = payload.base_url
     if payload.verify_tls is not None:
         host.verify_tls = payload.verify_tls
     if payload.clear_tls_pin:

backend/app/routers/ipsec.py

@@ -174,7 +174,7 @@ async def delete_tunnel(tunnel_id: uuid.UUID, db: AsyncSession = Depends(get_db)
     try:
         await undeploy_tunnel(db, tunnel)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(tunnel, attribute_names=["deployments"])
     ipsec_psk_store.delete_secret(tunnel.id)
     await db.delete(tunnel)

backend/app/routers/network.py

@@ -0,0 +1,90 @@
+import re
+import uuid
+
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.errors import ErrorCode, api_error
+from app.models.host import OpnsenseHost
+from app.routers.hosts import _upstream_error
+from app.schemas.network import (
+    HostNetwork, NetworkChangeExecute, NetworkChangePreview, NetworkChangeRequest, NetworkChangeResult,
+)
+from app.services import network_change_service, network_service
+from app.services.policy_service import policy_lock
+from app.services.opnsense_client import OpnsenseAPIError
+
+router = APIRouter(prefix="/hosts/{host_id}/network", tags=["network"])
+
+
+@router.get("", response_model=HostNetwork)
+async def host_network(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
+    host = await db.get(OpnsenseHost, host_id)
+    if not host:
+        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
+    try:
+        return await network_service.get_host_network(host)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc
+
+
+async def _host_or_404(db: AsyncSession, host_id: uuid.UUID) -> OpnsenseHost:
+    host = await db.get(OpnsenseHost, host_id)
+    if not host:
+        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
+    return host
+
+
+@router.post("/changes/preview", response_model=NetworkChangePreview)
+async def preview_change(host_id: uuid.UUID, payload: NetworkChangeRequest, db: AsyncSession = Depends(get_db)):
+    host = await _host_or_404(db, host_id)
+    try:
+        plan = await network_change_service.preview(db, host, payload.kind, payload.action, payload.uuid, payload.fields)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc
+    return {k: v for k, v in plan.items() if not k.startswith("_")}
+
+
+@router.post("/changes", response_model=NetworkChangeResult)
+async def execute_change(host_id: uuid.UUID, payload: NetworkChangeExecute, db: AsyncSession = Depends(get_db)):
+    await policy_lock(db)
+    host = await _host_or_404(db, host_id)
+    return await network_change_service.execute(
+        db, host, payload.kind, payload.action, payload.uuid, payload.fields, payload.preview_token, payload.acknowledge)
+
+
+@router.get("/template/{kind}")
+async def change_template(host_id: uuid.UUID, kind: str, db: AsyncSession = Depends(get_db)):
+    """Blank form for one kind, with the choices this firewall accepts for its select fields."""
+    if kind not in network_change_service.FIELDS:
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    host = await _host_or_404(db, host_id)
+    try:
+        return await network_change_service.template(host, kind)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc
+
+
+@router.get("/item/{kind}/{item_uuid}")
+async def current_item(host_id: uuid.UUID, kind: str, item_uuid: str, db: AsyncSession = Depends(get_db)):
+    """The object's current values on the firewall, for pre-filling an edit form."""
+    if kind not in network_change_service.FIELDS or not re.fullmatch(r"[A-Za-z0-9_.:-]{1,64}", item_uuid):
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    host = await _host_or_404(db, host_id)
+    try:
+        return await network_change_service.item(host, kind, item_uuid)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc
+
+
+@router.get("/objects/{kind}")
+async def list_objects(host_id: uuid.UUID, kind: str, db: AsyncSession = Depends(get_db)):
+    """Rows of a generic object kind (tunables, cron jobs, LAGG, ...), reduced to their display columns."""
+    if kind not in network_change_service.OBJECT_COLUMNS:
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    host = await _host_or_404(db, host_id)
+    try:
+        return await network_change_service.list_objects(host, kind)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc

backend/app/routers/network_drift.py

@@ -0,0 +1,29 @@
+from collections import defaultdict
+
+from fastapi import APIRouter, Depends
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.models.host import OpnsenseHost
+from app.services import network_drift_service
+
+router = APIRouter(prefix="/network", tags=["network"])
+
+
+@router.get("/drift")
+async def network_drift(db: AsyncSession = Depends(get_db)):
+    """Per cluster: differences in the network configuration between its nodes (live read of every node)."""
+    hosts = (await db.scalars(select(OpnsenseHost).where(OpnsenseHost.enabled.is_(True)).order_by(OpnsenseHost.name))).all()
+    by_cluster: dict[str, list[OpnsenseHost]] = defaultdict(list)
+    for host in hosts:
+        if host.cluster_name:
+            by_cluster[host.cluster_name].append(host)
+    clusters = []
+    for name, members in sorted(by_cluster.items()):
+        if len(members) < 2:
+            continue
+        differences, compared, unreachable = await network_drift_service.compute_cluster(members)
+        clusters.append({"name": name, "hosts": [h.name for h in members], "compared": compared,
+                         "unreachable": unreachable, "differences": differences})
+    return {"clusters": clusters}

backend/app/routers/one_to_one.py

@@ -168,7 +168,7 @@ async def delete_one_to_one_rule(rule_id: uuid.UUID, db: AsyncSession = Depends(
     try:
         await undeploy_one_to_one(db, rule)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(rule, attribute_names=["deployments"])
     await db.delete(rule)
     await db.commit()
@@ -268,4 +268,4 @@ async def live_rules(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         return split_rows(await opnsense_client.search_one_to_one_rules(host))
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc

backend/app/routers/openvpn.py

@@ -176,7 +176,7 @@ async def delete_instance(instance_id: uuid.UUID, db: AsyncSession = Depends(get
     try:
         await undeploy_instance(db, instance)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(instance, attribute_names=["deployments"])
     openvpn_key_store.delete_secret(instance.id)
     await db.delete(instance)

backend/app/routers/outbound_nat.py

@@ -175,7 +175,7 @@ async def delete_outbound_nat_rule(rule_id: uuid.UUID, db: AsyncSession = Depend
     try:
         await undeploy_outbound_nat(db, rule)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(rule, attribute_names=["deployments"])
     await db.delete(rule)
     await db.commit()
@@ -275,7 +275,7 @@ async def live_rules(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         return split_rows(await opnsense_client.search_outbound_nat_rules(host))
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
 
 
 @router.get("/hosts/{host_id}/mode")

backend/app/routers/policy_hierarchy.py

@@ -294,7 +294,7 @@ async def delete_rule(rule_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         await undeploy_hierarchy_rule(db, rule)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(rule, attribute_names=["deployments"])
     await db.delete(rule)
     await db.commit()

backend/app/routers/port_forward.py

@@ -170,7 +170,7 @@ async def delete_port_forward_rule(rule_id: uuid.UUID, db: AsyncSession = Depend
     try:
         await undeploy_port_forward(db, rule)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(rule, attribute_names=["deployments"])
     await db.delete(rule)
     await db.commit()
@@ -270,4 +270,4 @@ async def live_rules(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         return split_rows(await opnsense_client.search_port_forward_rules(host))
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc

backend/app/routers/rules.py

@@ -17,6 +17,8 @@ from app.services.alias_service import check_alias_consistency, describe_alias_c
 from app.services.interface_service import check_interface_consistency
 from app.services.opnsense_client import OpnsenseAPIError
 from app.services.rule_deploy_service import confirm_rule, deploy_rule, undeploy_rule, revert_deployment
+from app.services import rule_adopt_service
+from app.schemas.rule import AdoptRequest, UnmanagedRule
 
 router = APIRouter(prefix="/rules", tags=["rules"])
 
@@ -59,6 +61,7 @@ def _to_read(
         destination_net=rule.destination_net,
         destination_port=rule.destination_port,
         enabled=rule.enabled,
+        log=rule.log,
         created_at=rule.created_at,
         updated_at=rule.updated_at,
         target_host_ids=[host.id for host in rule.targets],
@@ -84,6 +87,42 @@ async def list_rules(db: AsyncSession = Depends(get_db)):
     return [_to_read(rule, rule.targets, rule.deployments) for rule in rules]
 
 
+@router.get("/unmanaged", response_model=list[UnmanagedRule])
+async def list_unmanaged_rules(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
+    """Rules found on the host that OPNexus does not manage yet (live read)."""
+    host = await db.get(OpnsenseHost, host_id)
+    if not host:
+        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
+    try:
+        return await rule_adopt_service.list_unmanaged(db, host)
+    except OpnsenseAPIError as exc:
+        raise api_error(502, ErrorCode.HOST_REQUEST_FAILED, host=host.name) from exc
+
+
+@router.post("/adopt", response_model=RuleRead, status_code=201)
+async def adopt_rule(payload: AdoptRequest, db: AsyncSession = Depends(get_db)):
+    """Takes over a hand-made rule. Writes nothing to the firewall."""
+    await policy_lock(db)
+    host = await db.get(OpnsenseHost, payload.host_id)
+    if not host:
+        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
+    try:
+        rule = await rule_adopt_service.adopt(db, host, payload.rule_uuid)
+    except rule_adopt_service.RuleNotFoundOnHost as exc:
+        raise api_error(404, ErrorCode.REGEL_NICHT_GEFUNDEN) from exc
+    except rule_adopt_service.NotAdoptable as exc:
+        raise api_error(409, ErrorCode.RULE_NOT_ADOPTABLE, reasons=", ".join(exc.reasons)) from exc
+    except OpnsenseAPIError as exc:
+        raise api_error(502, ErrorCode.HOST_REQUEST_FAILED, host=host.name) from exc
+    await db.commit()
+    # The new object sits in the session without its relationships loaded; db.get() would return it as-is.
+    rule = (await db.execute(
+        select(FirewallRule).where(FirewallRule.id == rule.id).options(*_load_options())
+        .execution_options(populate_existing=True)
+    )).scalar_one()
+    return _to_read(rule, rule.targets, rule.deployments)
+
+
 @router.post("", response_model=RuleRead, status_code=201)
 async def create_rule(payload: RuleCreate, db: AsyncSession = Depends(get_db)):
     await policy_lock(db)
@@ -101,6 +140,7 @@ async def create_rule(payload: RuleCreate, db: AsyncSession = Depends(get_db)):
         destination_net=payload.destination_net,
         destination_port=payload.destination_port,
         enabled=payload.enabled,
+        log=payload.log,
         targets=hosts,
         groups=groups,
     )
@@ -172,7 +212,7 @@ async def delete_rule(rule_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     try:
         await undeploy_rule(db, rule)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(rule, attribute_names=["deployments"])
     await db.delete(rule)
     await db.commit()

backend/app/routers/services.py

@@ -31,6 +31,19 @@ async def _control(host_id: uuid.UUID, name: str, action: str, fn, db: AsyncSess
     await policy_lock(db)
     host = await host_or_404(db, host_id)
     await ensure_no_maintenance(db, [host])
+    # The UI greys out locked services, but the API must not rely on that:
+    # unknown names are accepted by the firewall with "ok", and locked ones
+    # (pf, webgui, routing, ...) can be stopped through it.
+    try:
+        listing = await client.search_services(host)
+    except client.OpnsenseAPIError as exc:
+        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+    rows = listing.get("rows", []) if isinstance(listing, dict) else []
+    row = next((r for r in rows if name in (r.get("id"), r.get("name"))), None)
+    if row is None:
+        raise api_error(404, ErrorCode.SERVICE_NOT_FOUND, service=name)
+    if row.get("locked") in (1, "1", True):
+        raise api_error(409, ErrorCode.SERVICE_LOCKED, service=name)
     await audit_service.persist(
         kind="host", action=action, status="requested",
         host_id=str(host.id), host_name=host.name,

backend/app/routers/snapshots.py

@@ -0,0 +1,55 @@
+import uuid
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.errors import ErrorCode, api_error
+from app.models.host import OpnsenseHost
+from app.routers.hosts import _upstream_error
+from app.services import snapshot_service
+from app.services.host_maintenance_service import ensure_no_maintenance
+from app.services.opnsense_client import OpnsenseAPIError
+from app.services.policy_service import policy_lock
+
+router = APIRouter(prefix="/hosts/{host_id}/snapshots", tags=["snapshots"])
+
+
+class SnapshotCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=64)
+    note: str = Field(default="", max_length=200)
+
+
+async def _host(db: AsyncSession, host_id: uuid.UUID) -> OpnsenseHost:
+    host = await db.get(OpnsenseHost, host_id)
+    if not host:
+        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
+    return host
+
+
+@router.get("")
+async def list_snapshots(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
+    host = await _host(db, host_id)
+    try:
+        return await snapshot_service.list_snapshots(host)
+    except OpnsenseAPIError as exc:
+        raise _upstream_error(host, exc) from exc
+
+
+@router.post("", status_code=201)
+async def create_snapshot(host_id: uuid.UUID, payload: SnapshotCreate, db: AsyncSession = Depends(get_db)):
+    await policy_lock(db)
+    host = await _host(db, host_id)
+    await ensure_no_maintenance(db, [host])
+    return await snapshot_service.create(host, payload.name, payload.note)
+
+
+@router.delete("/{snapshot_uuid}", status_code=204)
+async def delete_snapshot(host_id: uuid.UUID, snapshot_uuid: str, db: AsyncSession = Depends(get_db)):
+    await policy_lock(db)
+    host = await _host(db, host_id)
+    await ensure_no_maintenance(db, [host])
+    if not snapshot_uuid.replace("-", "").isalnum() or len(snapshot_uuid) > 64:
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    await snapshot_service.delete(host, snapshot_uuid)

backend/app/routers/wireguard.py

@@ -187,7 +187,7 @@ async def delete_tunnel(tunnel_id: uuid.UUID, db: AsyncSession = Depends(get_db)
     try:
         await undeploy_tunnel(db, tunnel)
     except OpnsenseAPIError as exc:
-        raise api_error(502, ErrorCode.UPSTREAM_REQUEST_FAILED) from exc
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)) from exc
     await db.refresh(tunnel, attribute_names=["deployments"])
     wireguard_key_store.delete_private_key(tunnel.id)
     wireguard_key_store.delete_psk(tunnel.id)

backend/app/schemas/host.py

@@ -47,6 +47,8 @@ class HostUpdate(BaseModel):
     recreate is still the way to rotate a host's API key for now."""
 
     name: str | None = Field(default=None, min_length=1, max_length=120)
+    # New address of the firewall, e.g. after its management IP was changed.
+    base_url: str | None = Field(default=None, min_length=1, max_length=255)
     verify_tls: bool | None = None
     tls_ca_pem: str | None = Field(default=None, max_length=32768)
     clear_tls_pin: bool = False
@@ -56,6 +58,11 @@ class HostUpdate(BaseModel):
     policy_hierarchy_group_id: uuid.UUID | None = None
     clear_policy_hierarchy_group_id: bool = False  # same ambiguity as clear_cluster_name above
 
+    @field_validator("base_url")
+    @classmethod
+    def _base_url_is_safe(cls, value: str | None) -> str | None:
+        return validate_base_url(value) if value is not None else None
+
 
 class HostRead(BaseModel):
     model_config = ConfigDict(from_attributes=True)
@@ -123,6 +130,9 @@ CertStatus = Literal["valid", "expiring_soon", "expired", "unknown"]
 
 class HostCertificate(BaseModel):
     uuid: str
+    # OPNsense's own cross-references (OpenVPN cert/ca, Trust-Store caref) use
+    # this id, not the row UUID.
+    refid: str = ""
     descr: str
     common_name: str | None
     issuer: str
@@ -135,6 +145,7 @@ class HostCertificate(BaseModel):
 
 class HostCa(BaseModel):
     uuid: str
+    refid: str = ""
     descr: str
     common_name: str | None
     valid_from: datetime | None

backend/app/schemas/network.py

@@ -0,0 +1,183 @@
+from typing import Any, Literal
+
+from pydantic import BaseModel, Field
+
+
+class NetAddress(BaseModel):
+    address: str  # CIDR, e.g. 192.168.1.2/24
+    # Set for CARP addresses only
+    vhid: str | None = None
+    carp_status: str | None = None
+
+
+class NetInterface(BaseModel):
+    device: str
+    identifier: str | None  # OPNsense's own name (wan, lan, opt3) — None when unassigned
+    description: str
+    status: str
+    enabled: bool
+    is_physical: bool
+    mtu: str | None
+    mac: str | None
+    media: str | None
+    vlan_tag: str | None
+    vlan_parent: str | None
+    ipv4_type: str | None  # "Static IPv4" / "DHCP" ... (assigned interfaces only)
+    ipv6_type: str | None
+    addresses: list[NetAddress]
+    pending_action: str | None = None
+    # Listed in the firewall's interface assignment (wan, lan, optN) — only those can be edited or removed.
+    assigned: bool = False
+    # This is the interface the firewall answers OPNexus on. Changing it can cut the connection.
+    is_management: bool = False
+
+
+class NetVlan(BaseModel):
+    uuid: str
+    parent: str
+    tag: str
+    pcp: str | None
+    description: str
+    device: str | None
+
+
+class NetVip(BaseModel):
+    """No CARP password here, by design: OPNsense returns it in plain text."""
+    uuid: str
+    interface: str
+    interface_label: str
+    mode: str
+    address: str
+    vhid: str | None
+    advbase: str | None
+    advskew: str | None
+    description: str
+
+
+class NetGateway(BaseModel):
+    uuid: str
+    name: str
+    description: str
+    interface: str
+    interface_label: str
+    ip_protocol: str
+    address: str
+    is_default: bool
+    disabled: bool
+    priority: str | None
+    status: str
+
+
+class NetRoute(BaseModel):
+    uuid: str
+    network: str
+    gateway: str
+    description: str
+    disabled: bool
+
+
+class NetDnsHost(BaseModel):
+    uuid: str
+    hostname: str
+    domain: str
+    record_type: str
+    server: str
+    enabled: bool
+    description: str
+
+
+class NetDhcpHost(BaseModel):
+    uuid: str
+    host: str
+    domain: str
+    ip: str
+    hwaddr: str
+    lease_time: str
+    description: str
+
+
+class NetKeaSubnet(BaseModel):
+    uuid: str
+    subnet: str
+    pools: str
+    routers: str
+    dns_servers: str
+    description: str
+
+
+class NetKeaReservation(BaseModel):
+    uuid: str
+    subnet: str
+    ip_address: str
+    hw_address: str
+    hostname: str
+    description: str
+
+
+class HostNetwork(BaseModel):
+    host_id: str
+    host_name: str
+    interfaces: list[NetInterface]
+    vlans: list[NetVlan]
+    vips: list[NetVip]
+    gateways: list[NetGateway]
+    routes: list[NetRoute]
+    dns_hosts: list[NetDnsHost] = []
+    dhcp_hosts: list[NetDhcpHost] = []
+    kea_subnets: list[NetKeaSubnet] = []
+    kea_reservations: list[NetKeaReservation] = []
+    management_device: str | None
+    # The firewall's own API can set interface IPs/types (OPNsense >= ~26.7.6). Older 26.7.x
+    # only lists assignments. Detected from the data, not from a version number.
+    can_configure_interfaces: bool
+    # Sections the firewall could not deliver (e.g. older OPNsense without that API) — never silently empty.
+    unavailable: list[str]
+
+
+class NetworkChangeRequest(BaseModel):
+    kind: Literal["vlan", "vip", "gateway", "route", "interface", "dns_host", "dhcp_host", "kea_subnet", "kea_reservation",
+                  "tunable", "cron_job", "syslog_destination", "gateway_group", "lagg", "bridge", "loopback", "gre", "dns_forward", "dhcp_range"]
+    action: Literal["add", "set", "del"]
+    # Goes into a URL path, so only plain identifiers.
+    uuid: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_.:-]{1,64}$")
+    fields: dict[str, Any] = Field(default_factory=dict)
+
+
+class NetworkChangeExecute(NetworkChangeRequest):
+    preview_token: str = Field(min_length=64, max_length=64)
+    acknowledge: bool = False
+
+
+class NetworkChangeRisk(BaseModel):
+    code: str
+    params: dict[str, Any] = Field(default_factory=dict)
+
+
+class NetworkFieldChange(BaseModel):
+    field: str
+    before: str | None
+    after: str | None
+
+
+class NetworkChangePreview(BaseModel):
+    token: str
+    kind: str
+    action: str
+    uuid: str | None
+    host_id: str
+    host_name: str
+    changes: list[NetworkFieldChange]
+    risks: list[NetworkChangeRisk]
+    warnings: list[NetworkChangeRisk]
+    blocks: list[NetworkChangeRisk]
+    requires_acknowledgement: bool
+    management_device: str | None
+    can_execute: bool
+
+
+class NetworkChangeResult(BaseModel):
+    status: str
+    uuid: str | None
+    verified: bool
+    mismatches: list[str]
+    backup_id: str

backend/app/schemas/notification.py

@@ -9,7 +9,7 @@ from app.config import settings
 SmtpSecurity = Literal["none", "starttls", "ssl"]
 ProblemType = Literal[
     "host_offline", "cert_expiry", "rule_drift", "revert_failed", "maintenance_unknown",
-    "carp_split_brain", "nat_drift", "carp_auto_revert_failed",
+    "carp_split_brain", "nat_drift", "carp_auto_revert_failed", "network_drift",
 ]
 
 
@@ -36,6 +36,7 @@ class NotificationSettingsRead(BaseModel):
     maintenance_unknown_enabled: bool
     carp_health_enabled: bool
     nat_drift_enabled: bool
+    network_drift_enabled: bool = True
     carp_auto_revert_failed_enabled: bool
 
     poll_interval_seconds: int
@@ -71,6 +72,7 @@ class NotificationSettingsUpdate(BaseModel):
     maintenance_unknown_enabled: bool | None = None
     carp_health_enabled: bool | None = None
     nat_drift_enabled: bool | None = None
+    network_drift_enabled: bool | None = None
     carp_auto_revert_failed_enabled: bool | None = None
 
     poll_interval_seconds: int | None = Field(

backend/app/schemas/rule.py

@@ -17,6 +17,7 @@ class RuleCreate(BaseModel):
     destination_net: str = Field(default="any", min_length=1, max_length=128)
     destination_port: str | None = Field(default=None, max_length=32)
     enabled: bool = True
+    log: bool = False
     target_host_ids: list[uuid.UUID] = Field(default_factory=list)
     target_group_ids: list[uuid.UUID] = Field(default_factory=list)
 
@@ -56,6 +57,7 @@ class RuleRead(BaseModel):
     destination_net: str
     destination_port: str | None
     enabled: bool
+    log: bool = False
     created_at: datetime
     updated_at: datetime
     target_host_ids: list[uuid.UUID]
@@ -72,3 +74,27 @@ class RuleEdit(RuleCreate):
 
 class DeployApproval(BaseModel):
     preview_token: str = Field(min_length=64, max_length=64)
+
+
+class AdoptRequest(BaseModel):
+    host_id: uuid.UUID
+    rule_uuid: str = Field(min_length=1, max_length=64)
+
+
+class UnmanagedRule(BaseModel):
+    uuid: str
+    description: str
+    interface: str
+    interface_label: str
+    direction: str
+    action: str
+    protocol: str
+    source_net: str
+    source_port: str
+    destination_net: str
+    destination_port: str
+    enabled: bool
+    log: bool
+    adoptable: bool
+    # Codes such as "negated_source" or "not_quick"; the UI turns them into text.
+    reasons: list[str]

backend/app/services/alias_deploy_service.py

@@ -135,7 +135,7 @@ async def undeploy_alias(db: AsyncSession, alias: FirewallAlias) -> None:
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/audit_service.py

@@ -15,10 +15,27 @@ from app.models.audit import AuditEvent
 context = ContextVar("audit_context", default=None)
 
 
+# Column widths of audit_events. entity_id/host_id/action are taken from the
+# request path BEFORE the router validated it, so a junk segment (300 chars,
+# or a NUL byte which Postgres text cannot store) used to turn into a 500 or a
+# dropped connection instead of a plain 404/422 (found by fuzzing, 2026-10-09).
+_LIMITS = {"correlation_id": 36, "actor": 150, "kind": 32, "action": 40, "status": 32,
+           "entity_id": 36, "entity_name": 255, "host_id": 36, "host_name": 255}
+
+
+def _clean(key, value):
+    if not isinstance(value, str):
+        return value
+    value = value.replace("\x00", "")
+    limit = _LIMITS.get(key)
+    return value[:limit] if limit else value
+
+
 def make_event(**values):
     ctx = context.get() or {}
-    return AuditEvent(actor=ctx.get("actor", "system:rollback"),
-                      correlation_id=ctx.get("id", str(uuid.uuid4())), **values)
+    values = {k: _clean(k, v) for k, v in values.items()}
+    return AuditEvent(actor=_clean("actor", ctx.get("actor", "system:rollback")),
+                      correlation_id=_clean("correlation_id", ctx.get("id", str(uuid.uuid4()))), **values)
 
 
 async def persist(**values):

backend/app/services/carp_maintenance_window_service.py

@@ -19,6 +19,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models.carp_maintenance_window import CarpMaintenanceWindow
 from app.models.host import OpnsenseHost
+from app.models.host_operation import HostOperation
 from app.services import audit_service, host_status_service
 from app.services import opnsense_client as client
 
@@ -63,6 +64,26 @@ async def close_windows_for_manual_leave(db: AsyncSession, host: OpnsenseHost) -
     await db.commit()
 
 
+async def _close_enter_operations(db: AsyncSession, host: OpnsenseHost, message: str) -> None:
+    """Closes the host's still-open `carp_enter` maintenance record once the
+    window has been resolved by the timer. Without this the record stays
+    "submitted" forever: acknowledge cannot succeed (the host is no longer in
+    maintenance) and `ensure_no_maintenance` keeps blocking every deploy and
+    update in the cluster until someone cancels it by hand."""
+    result = await db.execute(
+        select(HostOperation).where(
+            HostOperation.host_id == host.id, HostOperation.action == "carp_enter", HostOperation.status == "submitted",
+        )
+    )
+    for op in result.scalars().all():
+        op.status = "cancelled"
+        op.message = message
+        await audit_service.persist(
+            kind="host", action="carp_enter", status="cancelled",
+            host_id=str(host.id), host_name=host.name, entity_id=str(op.id), message=message,
+        )
+
+
 async def sweep_expired(db: AsyncSession) -> list[CarpMaintenanceWindow]:
     result = await db.execute(
         select(CarpMaintenanceWindow).where(
@@ -88,6 +109,7 @@ async def sweep_expired(db: AsyncSession) -> list[CarpMaintenanceWindow]:
                 window.status = "cancelled_manual"
                 window.resolved_at = _now()
                 window.message = "Host war beim Ablauf bereits nicht mehr im CARP-Wartungsmodus."
+                await _close_enter_operations(db, host, window.message)
                 resolved.append(window)
                 continue
             result_payload = await client.toggle_carp_maintenance(host)
@@ -96,6 +118,7 @@ async def sweep_expired(db: AsyncSession) -> list[CarpMaintenanceWindow]:
             window.status = "reverted"
             window.resolved_at = _now()
             window.message = "Automatisch nach Ablauf des Zeitfensters in den Normalbetrieb zurückgeschaltet."
+            await _close_enter_operations(db, host, window.message)
             await audit_service.persist(
                 kind="host", action="carp_auto_revert", status="submitted",
                 host_id=str(host.id), host_name=host.name, entity_id=str(window.id),

backend/app/services/ipsec_deploy_service.py

@@ -254,6 +254,9 @@ async def _deploy_to_host(db: AsyncSession, tunnel: IpsecTunnel, host: OpnsenseH
 
     try:
         await _write_config(host, payloads, deployment)
+        # Same trap as WireGuard: with the global IPsec switch off the config
+        # is stored but nothing runs, and reconfigure still answers ok.
+        await opnsense_client.ensure_ipsec_enabled(host)
     except OpnsenseAPIError as exc:
         deployment.status = "error"
         deployment.message = str(exc)
@@ -324,7 +327,7 @@ async def undeploy_tunnel(db: AsyncSession, tunnel: IpsecTunnel) -> None:
         except OpnsenseAPIError as exc:
             deployment.status = "error"
             deployment.message = str(exc)
-            failures.append(host.name)
+            failures.append(f"{host.name} ({str(exc)[:200]})")
             continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/live_certificates_service.py

@@ -44,6 +44,7 @@ def _row_to_certificate(row: dict) -> HostCertificate:
 
     return HostCertificate(
         uuid=row.get("uuid", ""),
+        refid=row.get("refid", ""),
         descr=row.get("descr") or "(ohne Beschreibung)",
         common_name=row.get("commonname") or None,
         issuer=row.get("%caref") or "Selbstsigniert",
@@ -68,6 +69,7 @@ def _row_to_ca(row: dict) -> HostCa:
 
     return HostCa(
         uuid=row.get("uuid", ""),
+        refid=row.get("refid", ""),
         descr=row.get("descr") or "(ohne Beschreibung)",
         common_name=row.get("commonname") or None,
         valid_from=valid_from,

backend/app/services/nat_drift_service.py

@@ -62,6 +62,10 @@ async def _live_rows_or_none(host: OpnsenseHost, nat_type: str) -> list[dict] |
 
 
 async def compute_cluster_drift(hosts: list[OpnsenseHost], nat_type: str) -> list[dict]:
+    return (await compute_cluster_drift_with_reachable(hosts, nat_type))[0]
+
+
+async def compute_cluster_drift_with_reachable(hosts: list[OpnsenseHost], nat_type: str) -> tuple[list[dict], set]:
     """Same shape/contract as rule_drift_service.compute_cluster_drift:
     one row per fingerprint missing from at least one reachable host."""
     _, fingerprint_fn = _SPECS[nat_type]
@@ -78,4 +82,4 @@ async def compute_cluster_drift(hosts: list[OpnsenseHost], nat_type: str) -> lis
     for entry in by_fingerprint.values():
         entry["reachable_host_ids"] = reachable_ids
 
-    return [entry for entry in by_fingerprint.values() if len(entry["present_on"]) < len(reachable_ids)]
+    return [entry for entry in by_fingerprint.values() if len(entry["present_on"]) < len(reachable_ids)], reachable_ids

backend/app/services/network_change_service.py

@@ -0,0 +1,449 @@
+"""Changes to VLANs, virtual IPs, gateways and static routes of ONE firewall.
+
+Unlike rules, these objects are specific to a firewall (own IPs, own VLAN
+layout), so there is no central copy and no multi-host push: the firewall is the
+source of truth and every change goes straight to it, but only through a
+preview/execute pair:
+
+  preview  reads the live state, computes the diff and the risks, and returns a
+           token that covers exactly that state.
+  execute  re-reads the live state, refuses if it no longer matches the token,
+           refuses risky changes without an explicit acknowledgement, saves a
+           fresh config backup, writes the object, applies it, and reads it back
+           to check that the firewall really holds what was asked for.
+
+The main risk is cutting the connection OPNexus itself uses (the interface or
+address the firewall is reached on, the default route, a route that swallows the
+management address). Those cases are detected from the firewall's own
+interface list and need the acknowledgement. OPNexus cannot undo a change that
+cuts it off, so there is deliberately NO automatic rollback here — the backup
+taken before the change is the way back.
+
+Secrets (the CARP password) are never returned, hashed into the token only, and
+never written to the audit log.
+"""
+import hashlib
+import ipaddress
+import json
+import re
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.errors import ErrorCode, api_error
+from app.models.host import OpnsenseHost
+from app.services import audit_service, backup_store, network_service, opnsense_client
+from app.services.host_maintenance_service import ensure_no_maintenance
+from app.services.opnsense_client import OpnsenseAPIError
+
+# Only these fields can be sent; anything else is rejected, never forwarded.
+FIELDS: dict[str, set[str]] = {
+    "vlan": {"if", "tag", "pcp", "proto", "descr"},
+    "vip": {"interface", "mode", "network", "vhid", "advbase", "advskew", "password", "descr", "nosync", "peer", "peer6"},
+    "gateway": {"disabled", "name", "descr", "interface", "ipprotocol", "gateway", "defaultgw", "fargw",
+                "monitor_disable", "monitor", "priority", "weight"},
+    "route": {"network", "gateway", "descr", "enabled"},
+    "dns_host": {"enabled", "hostname", "domain", "rr", "server", "mx", "mxprio", "addptr", "description"},
+    "dhcp_host": {"host", "domain", "local", "ip", "hwaddr", "client_id", "lease_time", "ignore", "descr"},
+    "kea_subnet": {"subnet", "pools", "valid_lifetime", "next_server", "description", "option_data.routers",
+                   "option_data.domain_name_servers", "option_data.domain_name", "option_data.ntp_servers"},
+    "kea_reservation": {"subnet", "ip_address", "hw_address", "client_id", "hostname", "description", "next_server"},
+    "tunable": {"tunable", "value", "descr"},
+    "cron_job": {"enabled", "minutes", "hours", "days", "months", "weekdays", "who", "command", "parameters", "description"},
+    "syslog_destination": {"enabled", "transport", "program", "level", "facility", "hostname", "port", "rfc5424", "description"},
+    "gateway_group": {"name", "item", "item2", "item3", "item4", "item5", "trigger", "poolopts", "descr"},
+    "lagg": {"members", "primary_member", "proto", "lacp_fast_timeout", "use_flowid", "lagghash", "lacp_strict", "mtu", "descr"},
+    "bridge": {"members", "linklocal", "enablestp", "proto", "descr"},
+    "loopback": {"deviceId", "description"},
+    "gre": {"local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "tunnel-remote-net", "descr"},
+    "dns_forward": {"enabled", "type", "domain", "server", "port", "verify", "forward_tcp_upstream", "forward_first", "description"},
+    "dhcp_range": {"interface", "start_addr", "end_addr", "subnet_mask", "lease_time", "domain_type", "domain", "description"},
+    "interface": {"if", "descr", "enable", "type4", "ipaddr", "gateway", "type6", "ipaddrv6", "gatewayv6", "mtu",
+                  "blockpriv", "blockbogons", "lock"},
+}
+SECRET_FIELDS: dict[str, set[str]] = {"vip": {"password"}}
+# Section of HostNetwork that must be readable for the kind to be managed on this firewall.
+SECTION = {"vlan": "vlans", "vip": "vips", "gateway": "gateways", "route": "routes", "interface": "assignments",
+           "dns_host": "dns_hosts", "dhcp_host": "dhcp_hosts", "kea_subnet": "kea_subnets",
+           "kea_reservation": "kea_reservations"}
+# Columns the generic object lists show (the firewall's own field names). Lists never carry fields outside FIELDS.
+OBJECT_COLUMNS: dict[str, list[str]] = {
+    "tunable": ["tunable", "value", "default_value", "descr"],
+    "cron_job": ["enabled", "minutes", "hours", "days", "months", "weekdays", "command", "description"],
+    "syslog_destination": ["enabled", "transport", "hostname", "port", "program", "level", "description"],
+    "gateway_group": ["name", "item", "item2", "item3", "trigger", "descr"],
+    "lagg": ["laggif", "members", "proto", "descr"],
+    "bridge": ["bridgeif", "members", "proto", "descr"],
+    "loopback": ["deviceId", "description"],
+    "gre": ["greif", "local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "descr"],
+    "dns_forward": ["enabled", "type", "domain", "server", "port", "description"],
+    "dhcp_range": ["interface", "start_addr", "end_addr", "subnet_mask", "lease_time", "description"],
+}
+# These change how the network is wired; the others (DNS/DHCP data) cannot cut the connection to the firewall.
+WIRING_KINDS = {"vlan", "vip", "gateway", "route", "interface", "lagg", "bridge", "gre"}
+_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
+
+
+def validate_fields(kind: str, fields: dict) -> dict[str, str]:
+    allowed = FIELDS[kind]
+    clean: dict[str, str] = {}
+    for key, value in fields.items():
+        if key not in allowed:
+            raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field=str(key)[:40])
+        if isinstance(value, bool):
+            value = "1" if value else "0"
+        if value is None:
+            value = ""
+        if not isinstance(value, (str, int)) or isinstance(value, bool):
+            raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field=key)
+        text = str(value).strip()
+        if len(text) > 255 or _CONTROL.search(text):
+            raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field=key)
+        clean[key] = text
+    return clean
+
+
+def _explode(node: dict) -> dict:
+    """Kea nests its DHCP options one level deep; treat them as "option_data.<name>" like the whitelist does."""
+    out: dict = {}
+    for key, value in node.items():
+        if key == "option_data" and isinstance(value, dict):
+            for child, inner in value.items():
+                out[f"option_data.{child}"] = inner
+        else:
+            out[key] = value
+    return out
+
+
+def flatten(kind: str, node: dict) -> dict[str, str]:
+    """OPNsense answers select fields as {option: {selected: 0|1}}; reduce to the selected value(s)."""
+    out: dict[str, str] = {}
+    for key, value in _explode(node).items():
+        if key in SECRET_FIELDS.get(kind, set()):
+            continue
+        if isinstance(value, dict):
+            selected = [k for k, o in value.items() if isinstance(o, dict) and o.get("selected") and k != ""]
+            if value and all(isinstance(o, dict) and "selected" in o for o in value.values()):
+                out[key] = ",".join(selected)
+            continue
+        out[key] = "" if value is None else str(value)
+    return out
+
+
+def _ip(text: str):
+    try:
+        return ipaddress.ip_interface(text.strip()).ip
+    except ValueError:
+        return None
+
+
+def _network(text: str):
+    try:
+        return ipaddress.ip_network(text.strip(), strict=False)
+    except ValueError:
+        return None
+
+
+def _risk(code: str, **params) -> dict:
+    return {"code": code, "params": params}
+
+
+def assess(kind: str, action: str, uuid: str | None, before: dict, after: dict,
+           net, mgmt_addresses: set, peers: list[str], context: dict | None = None) -> tuple[list[dict], list[dict], list[dict]]:
+    """Returns (risks needing acknowledgement, plain warnings, hard blocks)."""
+    risks: list[dict] = []
+    warnings: list[dict] = []
+    blocks: list[dict] = []
+    mgmt_device = net.management_device
+    mgmt_iface = next((i for i in net.interfaces if i.device == mgmt_device), None)
+    mgmt_ident = mgmt_iface.identifier if mgmt_iface else None
+
+    if SECTION.get(kind) in net.unavailable:
+        blocks.append(_risk("api_unavailable", section=SECTION[kind]))
+    if mgmt_device is None and kind in WIRING_KINDS:
+        # We cannot tell what this change could cut, so treat every change to existing objects as risky.
+        if action in ("set", "del"):
+            risks.append(_risk("management_unknown"))
+
+    context = context or {}
+    if kind == "interface":
+        if not net.can_configure_interfaces:
+            blocks.append(_risk("interface_api_unavailable"))
+        if context.get("pending"):
+            blocks.append(_risk("interface_changes_pending"))
+        if action in ("set", "del") and mgmt_ident and uuid == mgmt_ident:
+            risks.append(_risk("management_interface", device=mgmt_device))
+        if action == "del" and before.get("lock") == "1":
+            # OPNsense refuses to remove a locked interface; say so now instead of failing at apply time.
+            blocks.append(_risk("interface_locked"))
+        if action == "del":
+            rules = context.get("rules_using") or []
+            if rules:
+                risks.append(_risk("interface_rules_removed", count=len(rules), names=", ".join(rules[:5])))
+        if action in ("set", "del") and uuid in ("wan", "lan") and uuid != mgmt_ident:
+            warnings.append(_risk("core_interface", name=uuid))
+
+    if kind in ("lagg", "bridge"):
+        members = {m for side in (before, after) for m in side.get("members", "").split(",") if m}
+        if mgmt_device and mgmt_device in members:
+            risks.append(_risk("management_member", device=mgmt_device))
+        elif mgmt_device is None and action in ("set", "del"):
+            pass  # already covered by management_unknown above
+    if kind == "tunable":
+        # sysctl values can change how the whole system behaves (and some only apply after a reboot).
+        risks.append(_risk("tunable_change"))
+        if action in ("set", "del") and uuid and "-" not in uuid:
+            # A built-in default (its id is not a UUID): the firewall would create a new entry instead of
+            # changing it, so overriding one is an "add", not an edit.
+            blocks.append(_risk("tunable_default_row"))
+    if kind == "gateway_group" and action == "del":
+        warnings.append(_risk("gateway_group_in_use"))
+
+    if kind == "vlan" and action in ("set", "del"):
+        device = next((v.device for v in net.vlans if v.uuid == uuid), None)
+        if device and device == mgmt_device:
+            risks.append(_risk("management_interface", device=device))
+
+    if kind == "vip":
+        for side in (before, after) if action != "add" else (after,):
+            ip = _ip(side.get("network", "")) if side.get("network") else None
+            if ip is not None and ip in mgmt_addresses:
+                risks.append(_risk("management_address", address=str(ip)))
+                break
+        if "carp" in (before.get("mode"), after.get("mode")):
+            warnings.append(_risk("carp_change"))
+
+    if kind == "gateway":
+        current = next((g for g in net.gateways if g.uuid == uuid), None)
+        if current is not None and action in ("set", "del"):
+            if current.is_default:
+                risks.append(_risk("default_gateway", name=current.name))
+            if mgmt_ident and current.interface == mgmt_ident:
+                risks.append(_risk("management_gateway", name=current.name))
+        if action in ("add", "set") and after.get("defaultgw") == "1" and (current is None or not current.is_default):
+            risks.append(_risk("default_gateway_change"))
+
+    if kind == "route":
+        for side in (before, after) if action != "add" else (after,):
+            network = _network(side.get("network", "")) if side.get("network") else None
+            if network is None:
+                continue
+            if network.prefixlen == 0:
+                risks.append(_risk("default_route", network=str(network)))
+                break
+            if any(a.version == network.version and a in network for a in mgmt_addresses):
+                risks.append(_risk("route_covers_management", network=str(network)))
+                break
+
+    if peers:
+        warnings.append(_risk("cluster_peers", hosts=", ".join(peers)))
+    # De-duplicate while keeping order.
+    seen, unique = set(), []
+    for r in risks:
+        key = json.dumps(r, sort_keys=True)
+        if key not in seen:
+            seen.add(key)
+            unique.append(r)
+    return unique, warnings, blocks
+
+
+def _token(host: OpnsenseHost, kind: str, action: str, uuid: str | None, fields: dict, before: dict, mgmt_device) -> str:
+    state = {
+        "host": str(host.id), "url": host.base_url, "kind": kind, "action": action, "uuid": uuid,
+        # hash, so a secret never sits in the token's input in the clear
+        "fields": hashlib.sha256(json.dumps(fields, sort_keys=True).encode()).hexdigest(),
+        "before": before, "mgmt": mgmt_device,
+    }
+    return hashlib.sha256(json.dumps(state, sort_keys=True).encode()).hexdigest()
+
+
+def _public(kind: str, fields: dict) -> dict:
+    return {k: ("(gesetzt)" if k in SECRET_FIELDS.get(kind, set()) and v else v) for k, v in fields.items()
+            if not (k in SECRET_FIELDS.get(kind, set()) and not v)}
+
+
+async def _peers(db: AsyncSession, host: OpnsenseHost) -> list[str]:
+    if not host.cluster_name:
+        return []
+    rows = await db.scalars(select(OpnsenseHost.name).where(
+        OpnsenseHost.cluster_name == host.cluster_name, OpnsenseHost.id != host.id).order_by(OpnsenseHost.name))
+    return list(rows.all())
+
+
+async def list_objects(host: OpnsenseHost, kind: str) -> dict:
+    """Rows of one generic object kind, reduced to the columns above (plus uuid) — never whole rows,
+    so nothing the list does not need (or must not show) leaves the server."""
+    columns = OBJECT_COLUMNS[kind]
+    try:
+        rows = await opnsense_client.search_network_objects(host, kind)
+    except OpnsenseAPIError as exc:
+        if "404" in str(exc):
+            return {"available": False, "columns": columns, "rows": []}   # this OPNsense version lacks the API
+        raise
+    out = []
+    for row in rows:
+        item = {"uuid": str(row.get("uuid", ""))}
+        for col in columns:
+            value = row.get(col)
+            item[col] = "" if value is None or isinstance(value, (dict, list)) else str(value)
+        out.append(item)
+    return {"available": True, "columns": columns, "rows": out}
+
+
+async def _rules_using(host: OpnsenseHost, identifier: str) -> list[str]:
+    """Descriptions of the user-made rules that name this interface (OPNsense deletes them with it)."""
+    data = await opnsense_client.search_rules(host, all_rows=True)
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [str(r.get("description") or r.get("uuid")) for r in rows
+            if isinstance(r, dict) and not r.get("is_automatic")
+            and identifier in str(r.get("interface") or "").split(",")]
+
+
+async def preview(db: AsyncSession, host: OpnsenseHost, kind: str, action: str, uuid: str | None, fields: dict) -> dict:
+    fields = validate_fields(kind, fields)
+    if action in ("set", "del") and not uuid:
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    net = await network_service.get_host_network(host)
+    before: dict[str, str] = {}
+    if action in ("set", "del"):
+        node = await opnsense_client.get_network_item(host, kind, uuid)
+        if not node or not any(v not in ("", None) for v in node.values() if not isinstance(v, dict)):
+            raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+        # Only the fields that may be sent: the rest (e.g. Kea's DDNS key secret) never reaches the token or the audit log.
+        before = {k: v for k, v in flatten(kind, node).items() if k in FIELDS[kind]}
+    after = {} if action == "del" else ({**before, **fields} if action == "set" else dict(fields))
+    mgmt_addresses = await network_service.management_addresses(host)
+    context: dict = {}
+    if kind == "interface":
+        if net.can_configure_interfaces:
+            context["pending"] = await opnsense_client.interface_changes_pending(host)
+        if action == "del":
+            context["rules_using"] = await _rules_using(host, uuid)
+    risks, warnings, blocks = assess(kind, action, uuid, before, after, net, mgmt_addresses, await _peers(db, host), context)
+    secret = SECRET_FIELDS.get(kind, set())
+    changes = []
+    for key in sorted(set(before) | set(fields)):
+        old, new = before.get(key), fields.get(key) if action != "del" else None
+        if action == "del":
+            if old not in (None, "") and key in FIELDS[kind]:
+                changes.append({"field": key, "before": old, "after": None})
+        elif key in fields and (action == "add" or old != new):
+            if key in secret:
+                changes.append({"field": key, "before": None, "after": "(gesetzt)" if new else None})
+            else:
+                changes.append({"field": key, "before": old, "after": new})
+    token = _token(host, kind, action, uuid, fields, before, net.management_device)
+    return {
+        "token": token, "kind": kind, "action": action, "uuid": uuid, "host_id": str(host.id), "host_name": host.name,
+        "changes": changes, "risks": risks, "warnings": warnings, "blocks": blocks,
+        "requires_acknowledgement": bool(risks), "management_device": net.management_device,
+        "can_execute": not blocks and (action == "del" or bool(changes)),
+        "_fields": fields, "_before": before,
+    }
+
+
+def _matches(expected: dict[str, str], actual: dict[str, str], secret: set[str]) -> list[str]:
+    return [k for k, v in expected.items() if k not in secret and actual.get(k, "") != v]
+
+
+async def _verify(host: OpnsenseHost, kind: str, action: str, uuid: str | None, fields: dict) -> tuple[bool, list[str]]:
+    try:
+        if action == "del":
+            present = await opnsense_client.list_network_item_uuids(host, kind)
+            return (uuid not in present), ([] if uuid not in present else ["still_present"])
+        actual = flatten(kind, await opnsense_client.get_network_item(host, kind, uuid))
+        mismatches = _matches(fields, actual, SECRET_FIELDS.get(kind, set()))
+        return (not mismatches), mismatches
+    except OpnsenseAPIError:
+        return False, ["unreadable"]
+
+
+async def execute(db: AsyncSession, host: OpnsenseHost, kind: str, action: str, uuid: str | None, fields: dict,
+                  token: str, acknowledged: bool) -> dict:
+    await ensure_no_maintenance(db, [host])
+    try:
+        plan = await preview(db, host, kind, action, uuid, fields)
+    except OpnsenseAPIError as exc:
+        raise api_error(502, ErrorCode.HOST_REQUEST_FAILED, host=host.name) from exc
+    if plan["token"] != token:
+        raise api_error(409, ErrorCode.ENTWURF_ODER_ZIELE_WURDEN_GEAENDERT_VORSCHAU_ERNEUT_OEFFNEN)
+    if plan["blocks"]:
+        raise api_error(409, ErrorCode.NETWORK_CHANGE_BLOCKED, reasons=", ".join(b["code"] for b in plan["blocks"]))
+    if not plan["can_execute"]:
+        raise api_error(409, ErrorCode.NETWORK_CHANGE_BLOCKED, reasons="nothing_to_change")
+    if plan["requires_acknowledgement"] and not acknowledged:
+        raise api_error(409, ErrorCode.NETWORK_ACK_REQUIRED, reasons=", ".join(r["code"] for r in plan["risks"]))
+
+    fields = plan["_fields"]
+    send = dict(fields)
+    if kind == "vip" and action == "set" and plan["_before"].get("network"):
+        # VipSettingsController::getVipOverlay blanks address and prefix whenever "network" is missing from
+        # the request, so every VIP update must repeat it (found live: a partial set was rejected / could wipe it).
+        send.setdefault("network", plan["_before"]["network"])
+    # What the object must look like afterwards: for an edit that is everything it had, plus the change.
+    expected = {**plan["_before"], **send} if action == "set" else dict(send)
+    entity = fields.get("name") or fields.get("descr") or plan["_before"].get("name") or plan["_before"].get("descr") or kind
+    audit = {"kind": "network", "action": f"{kind}.{action}"[:40], "entity_id": uuid, "entity_name": entity,
+             "host_id": str(host.id), "host_name": host.name}
+    details = {"before": plan["_before"], "after": _public(kind, fields) if action != "del" else None,
+               "risks": [r["code"] for r in plan["risks"]], "acknowledged": acknowledged}
+
+    # Way back: a config backup taken right before the change. No backup, no change.
+    try:
+        backup_id = backup_store.save_snapshot(host.id, await opnsense_client.download_backup(host))
+    except OpnsenseAPIError as exc:
+        await audit_service.persist(**audit, status="aborted", message="Backup vor der Änderung fehlgeschlagen", details=details)
+        raise api_error(502, ErrorCode.NETWORK_BACKUP_FAILED, host=host.name) from exc
+    details["backup_id"] = backup_id
+    await audit_service.persist(**audit, status="started", message=None, details=details)
+
+    try:
+        result = await opnsense_client.write_network_item(host, kind, action, uuid, send)
+    except OpnsenseAPIError as exc:
+        await audit_service.persist(**audit, status="rejected", message=str(exc)[:500], details=details)
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)[:300]) from exc
+    new_uuid = uuid or (result.get("uuid") if isinstance(result, dict) else None)
+    try:
+        await opnsense_client.reconfigure_network(host, kind)
+    except OpnsenseAPIError as exc:
+        # Written but not (provably) applied: say so instead of reporting success.
+        await audit_service.persist(**audit, status="apply_uncertain", message=str(exc)[:500], details=details)
+        raise api_error(502, ErrorCode.NETWORK_APPLY_UNCERTAIN, host=host.name, backup_id=backup_id) from exc
+
+    verified, mismatches = await _verify(host, kind, action, new_uuid, expected)
+    await audit_service.persist(**audit, status="applied" if verified else "unverified",
+                                message=None if verified else ", ".join(mismatches)[:500], details=details)
+    return {"status": "applied", "uuid": new_uuid, "verified": verified, "mismatches": mismatches, "backup_id": backup_id}
+
+
+def _options(value: dict) -> list[dict]:
+    return [{"value": k, "label": str(o.get("value", k)) if isinstance(o, dict) else str(k), "selected": bool(isinstance(o, dict) and o.get("selected"))}
+            for k, o in value.items()]
+
+
+async def template(host: OpnsenseHost, kind: str) -> dict:
+    """The firewall's own blank form for this kind: field defaults and, for select fields, the choices it
+    accepts right now (e.g. only the gateways it considers valid for a route)."""
+    node = _explode(await opnsense_client.get_network_item(host, kind, None))
+    out: dict[str, dict] = {}
+    for key in sorted(FIELDS[kind]):
+        if key not in node:
+            continue
+        value = node[key]
+        if isinstance(value, dict) and value and all(isinstance(o, dict) and "selected" in o for o in value.values()):
+            options = _options(value)
+            # Free-text list fields (IPs, MACs, DNS servers) arrive in this shape too; the form decides how to show them.
+            out[key] = {"value": ",".join(o["value"] for o in options if o["selected"] and o["value"] != ""), "options": options}
+        elif key in SECRET_FIELDS.get(kind, set()):
+            out[key] = {"value": "", "options": None}
+        else:
+            out[key] = {"value": "" if value is None or isinstance(value, dict) else str(value), "options": None}
+    return out
+
+
+async def item(host: OpnsenseHost, kind: str, uuid: str) -> dict[str, str]:
+    """One object as the firewall holds it right now, reduced to the fields that may be sent (no secrets)."""
+    node = await opnsense_client.get_network_item(host, kind, uuid)
+    if not node or not any(v not in ("", None) for v in node.values() if not isinstance(v, dict)):
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    return {k: v for k, v in flatten(kind, node).items() if k in FIELDS[kind]}

backend/app/services/network_drift_service.py

@@ -0,0 +1,86 @@
+"""Compares the network configuration of the nodes of an HA cluster.
+
+Interfaces, VLANs, virtual IPs, gateways, routes, DNS and DHCP objects should
+be the same on both nodes of a pair; a VLAN or gateway that exists on one node
+only is exactly the kind of difference that breaks a failover months later.
+
+Per-node values are deliberately NOT compared: interface addresses, CARP
+advskew/password and the active default gateway legitimately differ between
+the nodes. What is compared is the identity of each object (its key) and the
+settings that must agree (its signature). A category is skipped when any
+reachable node cannot deliver it (older OPNsense), instead of reporting that
+as a difference.
+"""
+from app.models.host import OpnsenseHost
+from app.schemas.network import HostNetwork
+from app.services import network_service
+from app.services.opnsense_client import OpnsenseAPIError
+
+CATEGORIES = ["interfaces", "vlans", "vips", "gateways", "routes", "dns_hosts", "dhcp_hosts", "kea_subnets", "kea_reservations"]
+
+
+def signatures(net: HostNetwork) -> dict[str, dict[str, str]]:
+    out: dict[str, dict[str, str]] = {c: {} for c in CATEGORIES}
+    for i in net.interfaces:
+        if i.assigned and i.identifier:
+            out["interfaces"][i.identifier] = f"{i.description}|{i.vlan_tag or ''}|{i.ipv4_type or ''}"
+    for v in net.vlans:
+        out["vlans"][f"{v.tag}@{v.parent}"] = v.description
+    for v in net.vips:
+        if v.mode == "carp":
+            out["vips"][f"carp:{v.vhid}"] = f"{v.address}|{v.advbase or ''}|{v.description}"
+        else:
+            out["vips"][f"{v.mode}:{v.address}"] = v.description
+    for g in net.gateways:
+        out["gateways"][g.name] = f"{g.interface}|{g.ip_protocol}|{g.address}|{g.disabled}"
+    for r in net.routes:
+        out["routes"][r.network] = f"{r.gateway}|{r.disabled}"
+    for d in net.dns_hosts:
+        out["dns_hosts"][f"{d.hostname}.{d.domain}|{d.record_type}"] = f"{d.server}|{d.enabled}"
+    for h in net.dhcp_hosts:
+        out["dhcp_hosts"][f"{h.host}.{h.domain}"] = f"{h.ip}|{h.hwaddr}"
+    for s in net.kea_subnets:
+        out["kea_subnets"][s.subnet] = f"{s.pools}|{s.routers}|{s.dns_servers}"
+    for k in net.kea_reservations:
+        out["kea_reservations"][f"{k.ip_address}|{k.hw_address}"] = k.hostname
+    return out
+
+
+# Which HostNetwork.unavailable entry makes a category incomparable.
+_UNAVAILABLE_KEY = {"interfaces": "assignments"}
+
+
+def compare(per_host: dict[str, HostNetwork]) -> list[dict]:
+    """per_host: host name -> its network. Returns one row per object that is missing on a node or differs."""
+    names = sorted(per_host)
+    sigs = {n: signatures(per_host[n]) for n in names}
+    rows: list[dict] = []
+    for category in CATEGORIES:
+        skip_key = _UNAVAILABLE_KEY.get(category, category)
+        if any(skip_key in per_host[n].unavailable for n in names):
+            continue
+        keys = sorted({k for n in names for k in sigs[n][category]})
+        for key in keys:
+            present = {n: sigs[n][category][key] for n in names if key in sigs[n][category]}
+            if len(present) < len(names):
+                rows.append({"category": category, "key": key, "status": "missing",
+                             "present_on": sorted(present), "missing_from": sorted(set(names) - set(present)),
+                             "signatures": present})
+            elif len(set(present.values())) > 1:
+                rows.append({"category": category, "key": key, "status": "different",
+                             "present_on": names, "missing_from": [], "signatures": present})
+    return rows
+
+
+async def compute_cluster(hosts: list[OpnsenseHost]) -> tuple[list[dict], list[str], list[str]]:
+    """Returns (differences, compared host names, unreachable host names)."""
+    per_host: dict[str, HostNetwork] = {}
+    unreachable: list[str] = []
+    for host in hosts:
+        try:
+            per_host[host.name] = await network_service.get_host_network(host)
+        except OpnsenseAPIError:
+            unreachable.append(host.name)
+    if len(per_host) < 2:
+        return [], sorted(per_host), sorted(unreachable)
+    return compare(per_host), sorted(per_host), sorted(unreachable)

backend/app/services/network_service.py

@@ -0,0 +1,250 @@
+"""Read-only network inventory of one firewall: interfaces, VLANs, virtual
+IPs (CARP), gateways and static routes, straight from the firewall.
+
+Also works out which interface the firewall answers OPNexus on. Every later
+write feature in this area (VLAN/IP/gateway changes) must refuse or escalate
+changes to that interface — an apply there can cut the very connection OPNexus
+would need to undo it.
+
+Shapes verified live on OPNsense 26.7.1 and 26.7.6 (see opnsense_client).
+"""
+import asyncio
+import ipaddress
+import socket
+from urllib.parse import urlparse
+
+from app.models.host import OpnsenseHost
+from app.schemas.network import (
+    HostNetwork,
+    NetAddress,
+    NetGateway,
+    NetDhcpHost,
+    NetDnsHost,
+    NetInterface,
+    NetKeaReservation,
+    NetKeaSubnet,
+    NetRoute,
+    NetVip,
+    NetVlan,
+)
+from app.services import opnsense_client
+from app.services.opnsense_client import OpnsenseAPIError
+
+
+def _rows(data) -> list[dict]:
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [r for r in rows if isinstance(r, dict)]
+
+
+def _flag(value) -> bool:
+    return value in ("1", 1, True)
+
+
+def _text(value) -> str:
+    return "" if value is None else str(value)
+
+
+def _opt(value) -> str | None:
+    """OPNsense is inconsistent about number vs. string (a gateway priority came back as 254, not "254")."""
+    return None if value in (None, "") else str(value)
+
+
+async def management_addresses(host: OpnsenseHost) -> set:
+    """IP addresses OPNexus uses to reach this firewall (literal or resolved)."""
+    hostname = urlparse(host.base_url).hostname
+    if not hostname:
+        return set()
+    try:
+        return {ipaddress.ip_address(hostname)}
+    except ValueError:
+        pass
+    try:
+        infos = await asyncio.get_running_loop().getaddrinfo(hostname, None, type=socket.SOCK_STREAM)
+    except OSError:
+        return set()
+    found = set()
+    for info in infos:
+        try:
+            found.add(ipaddress.ip_address(info[4][0].split("%")[0]))
+        except ValueError:
+            continue
+    return found
+
+
+def _addresses(row: dict) -> list[NetAddress]:
+    result = []
+    for key in ("ipv4", "ipv6"):
+        for entry in row.get(key) or []:
+            if isinstance(entry, dict) and entry.get("ipaddr"):
+                result.append(NetAddress(
+                    address=str(entry["ipaddr"]),
+                    vhid=_opt(entry.get("vhid")),
+                    carp_status=_opt(entry.get("status")),
+                ))
+    return result
+
+
+def _address_ip(address: str):
+    try:
+        return ipaddress.ip_interface(address).ip
+    except ValueError:
+        return None
+
+
+def _interface(row: dict, assignments: dict[str, dict], management: set) -> NetInterface:
+    identifier = row.get("identifier") or None
+    assigned = assignments.get(identifier or "") or {}
+    addresses = _addresses(row)
+    vlan = row.get("vlan") or {}
+    return NetInterface(
+        device=_text(row.get("device")),
+        identifier=identifier,
+        description=_text(row.get("description")),
+        status=_text(row.get("status")),
+        enabled=_flag(row.get("enabled", True)) if "enabled" in row else True,
+        is_physical=bool(row.get("is_physical")),
+        mtu=_opt(row.get("mtu")),
+        mac=_opt(row.get("macaddr")),
+        media=_opt(row.get("media")),
+        vlan_tag=_opt((vlan.get("tag") if isinstance(vlan, dict) else None) or row.get("vlan_tag")),
+        vlan_parent=_opt(vlan.get("parent")) if isinstance(vlan, dict) else None,
+        ipv4_type=assigned.get("%type4") or None,
+        ipv6_type=assigned.get("%type6") or None,
+        addresses=addresses,
+        pending_action=assigned.get("pending_action") or None,
+        assigned=bool(identifier and identifier in assignments),
+        is_management=any(_address_ip(a.address) in management for a in addresses if not a.vhid),
+    )
+
+
+def _vlan(row: dict) -> NetVlan:
+    return NetVlan(
+        uuid=_text(row.get("uuid")),
+        parent=_text(row.get("if")),
+        tag=_text(row.get("tag")),
+        pcp=_opt(row.get("pcp")),
+        description=_text(row.get("descr")),
+        device=(row.get("vlanif") or "").split(" ")[0] or None,
+    )
+
+
+def _vip(row: dict) -> NetVip:
+    # Deliberately picks fields by name: the row also carries the CARP password.
+    return NetVip(
+        uuid=_text(row.get("uuid")),
+        interface=_text(row.get("interface")),
+        interface_label=_text(row.get("%interface") or row.get("interface")),
+        mode=_text(row.get("mode")),
+        address=_text(row.get("address") or row.get("subnet")),
+        vhid=_opt(row.get("vhid")),
+        advbase=_opt(row.get("advbase")),
+        advskew=_opt(row.get("advskew")),
+        description=_text(row.get("descr")),
+    )
+
+
+def _gateway(row: dict) -> NetGateway:
+    return NetGateway(
+        uuid=_text(row.get("uuid")),
+        name=_text(row.get("name")),
+        description=_text(row.get("descr")),
+        interface=_text(row.get("interface")),
+        interface_label=_text(row.get("interface_descr") or row.get("interface")),
+        ip_protocol=_text(row.get("ipprotocol")),
+        address=_text(row.get("gateway")),
+        is_default=bool(row.get("defaultgw")),
+        disabled=bool(row.get("disabled")),
+        priority=_opt(row.get("priority")),
+        status=_text(row.get("status")),
+    )
+
+
+def _route(row: dict) -> NetRoute:
+    return NetRoute(
+        uuid=_text(row.get("uuid")),
+        network=_text(row.get("network")),
+        gateway=_text(row.get("gateway")),
+        description=_text(row.get("descr")),
+        # list rows carry "enabled" ("1"/"0"); older shapes a "disabled" flag
+        disabled=_flag(row.get("disabled")) or row.get("enabled") in ("0", 0, False),
+    )
+
+
+def _dns_host(row: dict) -> NetDnsHost:
+    return NetDnsHost(
+        uuid=_text(row.get("uuid")), hostname=_text(row.get("hostname")), domain=_text(row.get("domain")),
+        record_type=_text(row.get("rr")), server=_text(row.get("server")), enabled=_flag(row.get("enabled")),
+        description=_text(row.get("description")),
+    )
+
+
+def _dhcp_host(row: dict) -> NetDhcpHost:
+    return NetDhcpHost(
+        uuid=_text(row.get("uuid")), host=_text(row.get("host")), domain=_text(row.get("domain")),
+        ip=_text(row.get("ip")), hwaddr=_text(row.get("hwaddr")), lease_time=_text(row.get("lease_time")),
+        description=_text(row.get("descr")),
+    )
+
+
+def _kea_subnet(row: dict) -> NetKeaSubnet:
+    # Picked by name on purpose: the row also carries the DDNS key secret.
+    return NetKeaSubnet(
+        uuid=_text(row.get("uuid")), subnet=_text(row.get("subnet")), pools=_text(row.get("pools")),
+        routers=_text(row.get("option_data.routers")), dns_servers=_text(row.get("option_data.domain_name_servers")),
+        description=_text(row.get("description")),
+    )
+
+
+def _kea_reservation(row: dict) -> NetKeaReservation:
+    return NetKeaReservation(
+        uuid=_text(row.get("uuid")), subnet=_text(row.get("%subnet") or row.get("subnet")),
+        ip_address=_text(row.get("ip_address")), hw_address=_text(row.get("hw_address")),
+        hostname=_text(row.get("hostname")), description=_text(row.get("description")),
+    )
+
+
+async def _optional(name: str, call, unavailable: list[str]) -> list[dict]:
+    try:
+        return _rows(await call)
+    except OpnsenseAPIError:
+        unavailable.append(name)
+        return []
+
+
+async def get_host_network(host: OpnsenseHost) -> HostNetwork:
+    """Raises OpnsenseAPIError when the interface list itself is unavailable
+    (host down); every other section degrades to `unavailable` instead."""
+    info_rows = _rows(await opnsense_client.get_interfaces_info(host))
+    unavailable: list[str] = []
+    (assignment_rows, vlan_rows, vip_rows, gateway_rows, route_rows,
+     dns_rows, dhcp_rows, kea_subnet_rows, kea_reservation_rows) = await asyncio.gather(
+        _optional("assignments", opnsense_client.search_interface_assignments(host), unavailable),
+        _optional("vlans", opnsense_client.search_vlans(host), unavailable),
+        _optional("vips", opnsense_client.search_vips(host), unavailable),
+        _optional("gateways", opnsense_client.search_gateways(host), unavailable),
+        _optional("routes", opnsense_client.search_static_routes(host), unavailable),
+        _optional("dns_hosts", opnsense_client.search_dns_hosts(host), unavailable),
+        _optional("dhcp_hosts", opnsense_client.search_dhcp_hosts(host), unavailable),
+        _optional("kea_subnets", opnsense_client.search_kea_subnets(host), unavailable),
+        _optional("kea_reservations", opnsense_client.search_kea_reservations(host), unavailable),
+    )
+    management = await management_addresses(host)
+    assignments = {_text(r.get("identifier")): r for r in assignment_rows if r.get("identifier")}
+    interfaces = [_interface(r, assignments, management) for r in info_rows]
+    management_device = next((i.device for i in interfaces if i.is_management), None)
+    return HostNetwork(
+        host_id=str(host.id),
+        host_name=host.name,
+        interfaces=interfaces,
+        vlans=[_vlan(r) for r in vlan_rows],
+        vips=[_vip(r) for r in vip_rows],
+        gateways=[_gateway(r) for r in gateway_rows],
+        routes=[_route(r) for r in route_rows],
+        dns_hosts=[_dns_host(r) for r in dns_rows if not r.get("isAlias")],
+        dhcp_hosts=[_dhcp_host(r) for r in dhcp_rows],
+        kea_subnets=[_kea_subnet(r) for r in kea_subnet_rows],
+        kea_reservations=[_kea_reservation(r) for r in kea_reservation_rows],
+        management_device=management_device,
+        can_configure_interfaces=any("type4" in r for r in assignment_rows),
+        unavailable=sorted(unavailable),
+    )

backend/app/services/notification_checks.py

@@ -14,7 +14,8 @@ from app.models.one_to_one_deployment import OneToOneDeployment
 from app.models.outbound_nat_deployment import OutboundNatDeployment
 from app.models.port_forward_deployment import PortForwardDeployment
 from app.models.rule_deployment import RuleDeployment
-from app.services import nat_drift_service, rule_drift_service
+from app.services import nat_drift_service, network_drift_service, rule_drift_service
+from app.services.notification_dedup import Problems
 from app.services.host_status_service import get_statuses
 from app.services.live_certificates_service import get_live_certificates
 from app.services.opnsense_client import OpnsenseAPIError
@@ -53,13 +54,15 @@ async def check_host_offline(db: AsyncSession) -> dict[str, dict]:
 
 async def check_certificates(db: AsyncSession) -> dict[str, dict]:
     hosts = await _enabled_hosts(db)
-    problems: dict[str, dict] = {}
+    problems = Problems()
     for host in hosts:
         try:
             certs = await get_live_certificates(host)
         except OpnsenseAPIError:
             # Unreachable — already reported by check_host_offline, no need
-            # to double-report it here as a certificate problem.
+            # to double-report it here as a certificate problem. Its open
+            # certificate problems stay as they are (not evaluable now).
+            problems.preserve_prefixes.add(f"{host.id}:")
             continue
         for cert in certs:
             if cert.status not in ("expiring_soon", "expired"):
@@ -83,12 +86,18 @@ async def check_rule_drift(db: AsyncSession) -> dict[str, dict]:
         if host.cluster_name:
             by_cluster[host.cluster_name].append(host)
 
-    problems: dict[str, dict] = {}
+    problems = Problems()
     for cluster_name, cluster_hosts in by_cluster.items():
         if len(cluster_hosts) < 2:
             continue
         names_by_id = {h.id: h.name for h in cluster_hosts}
-        for row in await rule_drift_service.compute_cluster_drift(cluster_hosts):
+        rows, reachable = await rule_drift_service.compute_cluster_drift_with_reachable(cluster_hosts)
+        if len(reachable) < 2:
+            # A member is down (reboot/update): drift cannot be judged, so keep
+            # what is open instead of resolving it and re-opening it later.
+            problems.preserve_prefixes.add(f"{cluster_name}:")
+            continue
+        for row in rows:
             key = f"{cluster_name}:{row['fingerprint']}"
             present_names = sorted(names_by_id[hid] for hid in row["present_on"])
             missing_names = sorted(
@@ -113,13 +122,17 @@ async def check_nat_drift(db: AsyncSession) -> dict[str, dict]:
         if host.cluster_name:
             by_cluster[host.cluster_name].append(host)
 
-    problems: dict[str, dict] = {}
+    problems = Problems()
     for cluster_name, cluster_hosts in by_cluster.items():
         if len(cluster_hosts) < 2:
             continue
         names_by_id = {h.id: h.name for h in cluster_hosts}
         for nat_type in _NAT_TYPE_LABELS:
-            for row in await nat_drift_service.compute_cluster_drift(cluster_hosts, nat_type):
+            rows, reachable = await nat_drift_service.compute_cluster_drift_with_reachable(cluster_hosts, nat_type)
+            if len(reachable) < 2:
+                problems.preserve_prefixes.add(f"{cluster_name}:{nat_type}:")
+                continue
+            for row in rows:
                 key = f"{cluster_name}:{nat_type}:{row['fingerprint']}"
                 present_names = sorted(names_by_id[hid] for hid in row["present_on"])
                 missing_names = sorted(
@@ -135,6 +148,40 @@ async def check_nat_drift(db: AsyncSession) -> dict[str, dict]:
     return problems
 
 
+_NETWORK_LABELS = {
+    "interfaces": "Schnittstelle", "vlans": "VLAN", "vips": "Virtuelle IP", "gateways": "Gateway", "routes": "Route",
+    "dns_hosts": "DNS-Eintrag", "dhcp_hosts": "DHCP-Host", "kea_subnets": "DHCP-Subnetz", "kea_reservations": "DHCP-Reservierung",
+}
+
+
+async def check_network_drift(db: AsyncSession) -> dict[str, dict]:
+    hosts = await _enabled_hosts(db)
+    by_cluster: dict[str, list[OpnsenseHost]] = defaultdict(list)
+    for host in hosts:
+        if host.cluster_name:
+            by_cluster[host.cluster_name].append(host)
+
+    problems = Problems()
+    for cluster_name, cluster_hosts in by_cluster.items():
+        if len(cluster_hosts) < 2:
+            continue
+        differences, compared, _unreachable = await network_drift_service.compute_cluster(cluster_hosts)
+        if len(compared) < 2:
+            # Not evaluable right now (a node is down, which check_host_offline reports): keep what is open.
+            problems.preserve_prefixes.add(f"{cluster_name}:")
+            continue
+        for row in differences:
+            key = f"{cluster_name}:{row['category']}:{row['key']}"
+            problems[key] = {
+                "cluster_name": cluster_name,
+                "object": f"{_NETWORK_LABELS.get(row['category'], row['category'])} {row['key']}",
+                "status": "fehlt auf einem Knoten" if row["status"] == "missing" else "Einstellungen weichen ab",
+                "present_on": row["present_on"],
+                "missing_from": row["missing_from"],
+            }
+    return problems
+
+
 async def check_revert_failed(db: AsyncSession) -> dict[str, dict]:
     problems: dict[str, dict] = {}
     for deployment_type, model, id_attr in _DEPLOYMENT_MODELS:

backend/app/services/notification_dedup.py

@@ -13,6 +13,17 @@ def _now() -> datetime:
     return datetime.now(timezone.utc)
 
 
+class Problems(dict):
+    """The result of a check ({dedup_key: context}) plus the key prefixes the
+    check could NOT evaluate this round (e.g. a cluster member is offline, so
+    drift is not computable). Open problems under such a prefix are left alone
+    instead of being resolved and re-opened on the next round."""
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.preserve_prefixes: set[str] = set()
+
+
 async def diff_and_update(
     db: AsyncSession, problem_type: str, current: dict[str, dict]
 ) -> tuple[list[NotificationProblem], list[NotificationProblem]]:
@@ -74,8 +85,9 @@ async def diff_and_update(
             existing.last_seen_at = now
             existing.context = context
 
+    preserve = tuple(getattr(current, "preserve_prefixes", ()))
     for key, row in open_rows.items():
-        if key not in current:
+        if key not in current and not (preserve and key.startswith(preserve)):
             row.status = "resolved"
             row.resolved_at = now
             resolved.append(row)

backend/app/services/notification_delivery.py

@@ -31,6 +31,7 @@ _LABELS = {
     "maintenance_unknown": "Wartungsergebnis unklar",
     "carp_split_brain": "CARP-Zustand kritisch",
     "nat_drift": "NAT-Drift im Cluster",
+    "network_drift": "Netzwerk-Abweichung im Cluster",
     "carp_auto_revert_failed": "CARP-Auto-Revert fehlgeschlagen",
 }
 

backend/app/services/notification_service.py

@@ -28,6 +28,7 @@ _CHECKS = [
     ("maintenance_unknown", "maintenance_unknown_enabled", notification_checks.check_maintenance_unknown),
     ("carp_split_brain", "carp_health_enabled", notification_checks.check_carp_health),
     ("nat_drift", "nat_drift_enabled", notification_checks.check_nat_drift),
+    ("network_drift", "network_drift_enabled", notification_checks.check_network_drift),
     ("carp_auto_revert_failed", "carp_auto_revert_failed_enabled", notification_checks.check_carp_auto_revert_failed),
 ]
 

backend/app/services/notification_settings_service.py

@@ -25,7 +25,7 @@ async def update_settings(db: AsyncSession, payload: NotificationSettingsUpdate)
         "smtp_from_address", "smtp_to_addresses",
         "host_offline_enabled", "cert_expiring_enabled", "rule_drift_enabled",
         "revert_failed_enabled", "maintenance_unknown_enabled", "carp_health_enabled", "nat_drift_enabled",
-        "carp_auto_revert_failed_enabled",
+        "network_drift_enabled", "carp_auto_revert_failed_enabled",
         "poll_interval_seconds",
     ]
     for field in simple_fields:

backend/app/services/one_to_one_deploy_service.py

@@ -140,7 +140,7 @@ async def undeploy_one_to_one(db: AsyncSession, rule: OneToOneRule) -> None:
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/openvpn_deploy_service.py

@@ -15,7 +15,8 @@ citations):
   Instances.Instance: vpnid (VPNIdField, Required, MinimumValue 1, NO
   <Default> — never sent by this app; OPNsense's own UI never prompts for
   one either, so its field-type presumably auto-assigns one the same way
-  on addAction — NOT independently verified, flagged rather than guessed),
+  on addAction — VERIFIED LIVE 2026-10-09 on 26.7.5: it is NOT auto-assigned, add() fails
+  with "instance.vpnid: A value is required." — see _next_vpnid),
   enabled (BooleanField, Default 1), dev_type (OptionValues
   tun/tap/ovpn(DCO), Default "tun" — never sent, relies on the model
   default exactly like IPsec relies on Child.mode defaulting to "tunnel"),
@@ -27,7 +28,8 @@ citations):
   section below, this is the key finding that reshaped v1), server
   (NetworkField, NetMaskRequired Y — server-role tunnel network), cert /
   ca (CertificateField, i.e. ModelRelationField into OPNsense's own
-  Trust\\Cert store), tls_key (ModelRelationField -> this SAME model's
+  Trust\\Cert store; values are the Trust-Store REFIDs, not row UUIDs —
+  verified live 2026-10-09), tls_key (ModelRelationField -> this SAME model's
   StaticKeys.StaticKey, display "description,mode"), auth/data-ciphers
   (cipher suite OptionFields — v1 always omits these, relying on
   OPNsense's own defaults, exactly like IPsec's proposals default to
@@ -238,6 +240,18 @@ def build_payloads(instance: OpenVpnInstance, host_id: uuid.UUID) -> dict:
     }
 
 
+async def _next_vpnid(host: OpnsenseHost) -> str:
+    data = await opnsense_client.search_openvpn_instances(host)
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    used = []
+    for row in rows:
+        try:
+            used.append(int(row.get("vpnid")))
+        except (TypeError, ValueError):
+            continue
+    return str(max(used, default=0) + 1)
+
+
 async def _write_config(host: OpnsenseHost, payloads: dict, deployment: OpenVpnInstanceDeployment) -> None:
     """Writes the StaticKey (if enabled) then the Instance, in that
     dependency order, persisting each UUID onto `deployment` as soon as
@@ -270,6 +284,10 @@ async def _write_config(host: OpnsenseHost, payloads: dict, deployment: OpenVpnI
     if deployment.opnsense_instance_uuid:
         await opnsense_client.set_openvpn_instance(host, deployment.opnsense_instance_uuid, instance_wire)
     else:
+        # vpnid is Required and the firewall does NOT assign it (verified live
+        # on 26.7: "instance.vpnid: A value is required."), so pick the next
+        # free one. It stays untouched on later set() calls.
+        instance_wire["vpnid"] = await _next_vpnid(host)
         result = await opnsense_client.add_openvpn_instance(host, instance_wire)
         deployment.opnsense_instance_uuid = result.get("uuid") if isinstance(result, dict) else None
         if not deployment.opnsense_instance_uuid:
@@ -370,7 +388,7 @@ async def undeploy_instance(db: AsyncSession, instance: OpenVpnInstance) -> None
         except OpnsenseAPIError as exc:
             deployment.status = "error"
             deployment.message = str(exc)
-            failures.append(host.name)
+            failures.append(f"{host.name} ({str(exc)[:200]})")
             continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/opnsense_client.py

@@ -557,6 +557,19 @@ async def del_ipsec_psk(host: OpnsenseHost, uuid_: str) -> dict:
     return _mutation_result(await _request(host, "POST", f"/ipsec/preSharedKeys/delItem/{uuid_}"), "IPsec Pre-Shared-Key entfernen", {"deleted", "not found"})
 
 
+async def ensure_ipsec_enabled(host: OpnsenseHost) -> bool:
+    """Switch the service-wide IPsec flag on (`ipsec/connections/isEnabled` /
+    `toggle/1`, ConnectionsController — it is NOT part of the service
+    controller). Without it the connections are stored but no daemon runs
+    (live 26.7.6: is_enabled=false, service status "disabled", yet
+    reconfigure answered ok). Returns True when it had to be switched on."""
+    data = await _request(host, "GET", "/ipsec/connections/is_enabled")
+    if isinstance(data, dict) and data.get("enabled") is True:
+        return False
+    _mutation_result(await _request(host, "POST", "/ipsec/connections/toggle/1"), "IPsec aktivieren", {"ok"})
+    return True
+
+
 async def reconfigure_ipsec(host: OpnsenseHost) -> dict:
     """`ipsec/service/reconfigure` (ServiceController::reconfigureAction,
     inherited from ApiMutableServiceControllerBase) — soft-reloads a
@@ -756,19 +769,12 @@ async def reconfigure_openvpn(host: OpnsenseHost) -> dict:
 #     ServiceController's own `$internalServiceEnabled = 'enabled'` /
 #     `$internalServiceClass = General::class` tie together for the
 #     framework's generic service-status plumbing. NOT INDEPENDENTLY
-#     VERIFIED: whether `wireguard configure` (the configd action
-#     reconfigureAction shells out to) actually brings up any wg-quick
-#     interface end-to-end while General.enabled=0 — reconfigureAction's
-#     OWN PHP body never reads $internalServiceEnabled at all (it always
-#     runs unconditionally), so this depends on configd's own action
-#     script content, which is out of the controller/model source layer
-#     this app's verification standard covers (same boundary IPsec/
-#     OpenVPN draw). Flagged as a real, source-confirmed structural
-#     difference from IPsec/OpenVPN (neither of which have an equivalent
-#     separate master switch) rather than silently ignored — see README:
-#     operators should confirm "VPN > WireGuard > General" is enabled at
-#     least once via the OPNsense UI before relying on OPNexus-pushed
-#     tunnels.
+#     VERIFIED LIVE (26.7.5, 2026-10-09): with General.enabled=0 a deploy
+#     writes Server+Peer correctly but NO wg interface comes up and
+#     `wireguard/service/show` stays empty, while OPNexus used to report
+#     "success". Enabling it (wireguard/general/set + reconfigure) brings
+#     wg0 up. wireguard_deploy_service therefore switches it on before the
+#     reconfigure (ensure_wireguard_enabled below); undeploy never touches it.
 #
 # Field names verified against Server.xml/Client.xml (fetched directly,
 # not summarized) — see wireguard_deploy_service.py for the exact
@@ -821,6 +827,21 @@ async def del_wireguard_peer(host: OpnsenseHost, uuid_: str) -> dict:
     return _mutation_result(await _request(host, "POST", f"/wireguard/client/delClient/{uuid_}"), "WireGuard-Peer entfernen", {"deleted", "not found"})
 
 
+async def ensure_wireguard_enabled(host: OpnsenseHost) -> bool:
+    """Turn the service-wide WireGuard switch (General.enabled, default 0) on
+    if it is off. Returns True when it had to be switched on."""
+    data = await _request(host, "GET", "/wireguard/general/get")
+    general = data.get("general", {}) if isinstance(data, dict) else {}
+    if str(general.get("enabled", "0")) == "1":
+        return False
+    _mutation_result(
+        await _request(host, "POST", "/wireguard/general/set", json={"general": {"enabled": "1"}}),
+        "WireGuard-Dienst aktivieren",
+        {"saved"},
+    )
+    return True
+
+
 async def reconfigure_wireguard(host: OpnsenseHost) -> dict:
     """`wireguard/service/reconfigure` (ServiceController::reconfigureAction)
     — runs interface registration + template reload + `wireguard configure`.
@@ -838,6 +859,10 @@ async def reconfigure_wireguard(host: OpnsenseHost) -> dict:
 # CertController.php directly) — see managed_certificate_service.py's
 # module docstring for the full field-mapping writeup.
 #
+# URL SEGMENTS ARE NOT PHP METHOD NAMES: the router strips the `Action`
+# suffix, so addAction() is POST /trust/cert/add (the `...Action` URL is a
+# 404 — found live 2026-10-09 on 26.7.5, the respx mocks had hidden it).
+#
 # CertController extends ApiMutableModelControllerBase exactly like
 # FilterController/ConnectionsController/etc: searchAction (already used
 # via search_certificates() above) / getAction / addAction / setAction /
@@ -866,11 +891,11 @@ def _trust_cert_result(data: Any, operation: str) -> dict:
 
 
 async def add_trust_cert(host: OpnsenseHost, payload: dict) -> dict:
-    return _trust_cert_result(await _request(host, "POST", "/trust/cert/addAction", json={"cert": payload}), "Zertifikat anlegen")
+    return _trust_cert_result(await _request(host, "POST", "/trust/cert/add", json={"cert": payload}), "Zertifikat anlegen")
 
 
 async def set_trust_cert(host: OpnsenseHost, uuid_: str, payload: dict) -> dict:
-    return _trust_cert_result(await _request(host, "POST", f"/trust/cert/setAction/{uuid_}", json={"cert": payload}), "Zertifikat ändern")
+    return _trust_cert_result(await _request(host, "POST", f"/trust/cert/set/{uuid_}", json={"cert": payload}), "Zertifikat ändern")
 
 
 async def del_trust_cert(host: OpnsenseHost, uuid_: str) -> dict:
@@ -879,7 +904,7 @@ async def del_trust_cert(host: OpnsenseHost, uuid_: str) -> dict:
     # matching every other del* call in this module (add_alias_item's
     # del_alias_item sibling etc.), so this reuses the same
     # {"deleted", "not found"} results set they all share.
-    return _mutation_result(await _request(host, "POST", f"/trust/cert/delAction/{uuid_}"), "Zertifikat entfernen", {"deleted", "not found"})
+    return _mutation_result(await _request(host, "POST", f"/trust/cert/del/{uuid_}"), "Zertifikat entfernen", {"deleted", "not found"})
 
 
 async def get_trust_cert(host: OpnsenseHost, uuid_: str) -> dict:
@@ -940,15 +965,15 @@ def _acme_result(data: Any, operation: str) -> dict:
 
 
 async def add_acme_account(host: OpnsenseHost, payload: dict) -> dict:
-    return _acme_result(await _request(host, "POST", "/acmeclient/accounts/addAction", json={"account": payload}), "ACME-Account anlegen")
+    return _acme_result(await _request(host, "POST", "/acmeclient/accounts/add", json={"account": payload}), "ACME-Account anlegen")
 
 
 async def update_acme_account(host: OpnsenseHost, uuid_: str, payload: dict) -> dict:
-    return _acme_result(await _request(host, "POST", f"/acmeclient/accounts/updateAction/{uuid_}", json={"account": payload}), "ACME-Account ändern")
+    return _acme_result(await _request(host, "POST", f"/acmeclient/accounts/update/{uuid_}", json={"account": payload}), "ACME-Account ändern")
 
 
 async def del_acme_account(host: OpnsenseHost, uuid_: str) -> dict:
-    return _mutation_result(await _request(host, "POST", f"/acmeclient/accounts/delAction/{uuid_}"), "ACME-Account entfernen", {"deleted", "not found"})
+    return _mutation_result(await _request(host, "POST", f"/acmeclient/accounts/del/{uuid_}"), "ACME-Account entfernen", {"deleted", "not found"})
 
 
 async def get_acme_account(host: OpnsenseHost, uuid_: str) -> dict:
@@ -956,15 +981,15 @@ async def get_acme_account(host: OpnsenseHost, uuid_: str) -> dict:
 
 
 async def add_acme_certificate(host: OpnsenseHost, payload: dict) -> dict:
-    return _acme_result(await _request(host, "POST", "/acmeclient/certificates/addAction", json={"certificate": payload}), "ACME-Zertifikatsanfrage anlegen")
+    return _acme_result(await _request(host, "POST", "/acmeclient/certificates/add", json={"certificate": payload}), "ACME-Zertifikatsanfrage anlegen")
 
 
 async def update_acme_certificate(host: OpnsenseHost, uuid_: str, payload: dict) -> dict:
-    return _acme_result(await _request(host, "POST", f"/acmeclient/certificates/updateAction/{uuid_}", json={"certificate": payload}), "ACME-Zertifikatsanfrage ändern")
+    return _acme_result(await _request(host, "POST", f"/acmeclient/certificates/update/{uuid_}", json={"certificate": payload}), "ACME-Zertifikatsanfrage ändern")
 
 
 async def del_acme_certificate(host: OpnsenseHost, uuid_: str) -> dict:
-    return _mutation_result(await _request(host, "POST", f"/acmeclient/certificates/delAction/{uuid_}"), "ACME-Zertifikatsanfrage entfernen", {"deleted", "not found"})
+    return _mutation_result(await _request(host, "POST", f"/acmeclient/certificates/del/{uuid_}"), "ACME-Zertifikatsanfrage entfernen", {"deleted", "not found"})
 
 
 async def get_acme_certificate(host: OpnsenseHost, uuid_: str) -> dict:
@@ -1002,3 +1027,206 @@ async def sign_acme_certificate(host: OpnsenseHost, uuid_: str) -> dict:
     against anything but a respx mock / fully-mocked write path in
     tests/verification."""
     return _acme_action_result(await _request(host, "POST", f"/acmeclient/certificates/sign/{uuid_}"), "ACME-Zertifikat ausstellen")
+
+
+# ── Network inventory (read-only) ────────────────────────────────────────
+# Interfaces\Api\{Overview,Assignment,VlanSettings,VipSettings}Controller,
+# Routing\Api\SettingsController and Routes\Api\RoutesController, verified
+# against core source (github.com/opnsense/core, master) AND live with real
+# read-only GETs on OPNsense 26.7.1/26.7.6 (2026-10-09). Shapes: the search*
+# calls return {"rows": [...]} (flat dicts with "%"-prefixed display
+# counterparts); interfacesInfo rows carry device/identifier/status/ipv4[].
+# Caution: vip_settings rows contain the CARP password in plain text — callers
+# must drop it (see network_service).
+async def get_interfaces_info(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/interfaces/overview/interfacesInfo", params={"rowCount": -1})
+
+
+async def search_interface_assignments(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/interfaces/assignment/searchItem", params={"rowCount": -1})
+
+
+async def search_vlans(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/interfaces/vlan_settings/searchItem", params={"rowCount": -1})
+
+
+async def search_vips(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/interfaces/vip_settings/searchItem", params={"rowCount": -1})
+
+
+async def search_gateways(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/routing/settings/searchGateway", params={"rowCount": -1})
+
+
+async def search_static_routes(host: OpnsenseHost) -> dict:
+    return await _request(host, "GET", "/routes/routes/searchroute", params={"rowCount": -1})
+
+
+# ── Network objects (write) ──────────────────────────────────────────────
+# One table for the four config objects handled by network_change_service.
+# Sources (core master, read 2026-10-09): Interfaces/Api/VlanSettingsController,
+# VipSettingsController, Routing/Api/SettingsController (gateways) and
+# Routes/Api/RoutesController. Each add/set takes {<body_key>: {fields}}; set/del
+# address the item by UUID; nothing takes effect before the object's reconfigure
+# call, which answers {"status": "ok"}. The VIP form posts address+prefix as ONE
+# field called "network".
+# The interface assignment (Interfaces/Api/AssignmentController, model NetworkInterface) is two-step:
+# add/set/del only stage the change (a todo file on the firewall); reconfigure ("interface apply") makes
+# it real. Its items are addressed by the interface identifier (wan, lan, opt1), not a UUID, and
+# deleting one makes OPNsense itself drop every rule/NAT entry that references it.
+NETWORK_ITEM_APIS = {
+    "vlan": {"body_key": "vlan", "base": "/interfaces/vlan_settings", "add": "addItem", "set": "setItem",
+             "del": "delItem", "get": "getItem", "search": "searchItem",
+             "reconfigure": "/interfaces/vlan_settings/reconfigure"},
+    "vip": {"body_key": "vip", "base": "/interfaces/vip_settings", "add": "addItem", "set": "setItem",
+            "del": "delItem", "get": "getItem", "search": "searchItem",
+            "reconfigure": "/interfaces/vip_settings/reconfigure"},
+    "gateway": {"body_key": "gateway_item", "base": "/routing/settings", "add": "addGateway", "set": "setGateway",
+                "del": "delGateway", "get": "getGateway", "search": "searchGateway",
+                "reconfigure": "/routing/settings/reconfigure"},
+    "route": {"body_key": "route", "base": "/routes/routes", "add": "addroute", "set": "setroute",
+              "del": "delroute", "get": "getroute", "search": "searchroute",
+              "reconfigure": "/routes/routes/reconfigure"},
+    "interface": {"body_key": "interface", "base": "/interfaces/assignment", "add": "addItem", "set": "setItem",
+                  "del": "delItem", "get": "getItem", "search": "searchItem",
+                  "reconfigure": "/interfaces/assignment/reconfigure"},
+    # DNS / DHCP (Unbound/Api/SettingsController, Dnsmasq/Api/SettingsController, Kea/Api/Dhcpv4Controller;
+    # reconfigure is the service controller's inherited action). Read 2026-10-09.
+    "dns_host": {"body_key": "host", "base": "/unbound/settings", "add": "addHostOverride", "set": "setHostOverride",
+                 "del": "delHostOverride", "get": "getHostOverride", "search": "searchHostOverride",
+                 "reconfigure": "/unbound/service/reconfigure"},
+    "dhcp_host": {"body_key": "host", "base": "/dnsmasq/settings", "add": "addHost", "set": "setHost",
+                  "del": "delHost", "get": "getHost", "search": "searchHost",
+                  "reconfigure": "/dnsmasq/service/reconfigure"},
+    "kea_subnet": {"body_key": "subnet4", "base": "/kea/dhcpv4", "add": "addSubnet", "set": "setSubnet",
+                   "del": "delSubnet", "get": "getSubnet", "search": "searchSubnet",
+                   "reconfigure": "/kea/service/reconfigure"},
+    # System / interface devices / DNS+DHCP extras (same controllers pattern; read 2026-10-09).
+    "tunable": {"body_key": "sysctl", "base": "/core/tunables", "add": "addItem", "set": "setItem", "del": "delItem",
+                "get": "getItem", "search": "searchItem", "reconfigure": "/core/tunables/reconfigure"},
+    "cron_job": {"body_key": "job", "base": "/cron/settings", "add": "addJob", "set": "setJob", "del": "delJob",
+                 "get": "getJob", "search": "searchJobs", "reconfigure": "/cron/service/reconfigure"},
+    "syslog_destination": {"body_key": "destination", "base": "/syslog/settings", "add": "addDestination",
+                           "set": "setDestination", "del": "delDestination", "get": "getDestination",
+                           "search": "searchDestinations", "reconfigure": "/syslog/service/reconfigure"},
+    "gateway_group": {"body_key": "gateway_group", "base": "/routing/group_settings", "add": "add", "set": "set",
+                      "del": "del", "get": "get", "search": "search", "reconfigure": "/routing/group_settings/reconfigure"},
+    "lagg": {"body_key": "lagg", "base": "/interfaces/lagg_settings", "add": "addItem", "set": "setItem",
+             "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/lagg_settings/reconfigure"},
+    "bridge": {"body_key": "bridge", "base": "/interfaces/bridge_settings", "add": "addItem", "set": "setItem",
+               "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/bridge_settings/reconfigure"},
+    "loopback": {"body_key": "loopback", "base": "/interfaces/loopback_settings", "add": "addItem", "set": "setItem",
+                 "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/loopback_settings/reconfigure"},
+    "gre": {"body_key": "gre", "base": "/interfaces/gre_settings", "add": "addItem", "set": "setItem",
+            "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/gre_settings/reconfigure"},
+    "dns_forward": {"body_key": "dot", "base": "/unbound/settings", "add": "addForward", "set": "setForward",
+                    "del": "delForward", "get": "getForward", "search": "searchForward",
+                    "reconfigure": "/unbound/service/reconfigure"},
+    "dhcp_range": {"body_key": "range", "base": "/dnsmasq/settings", "add": "addRange", "set": "setRange",
+                   "del": "delRange", "get": "getRange", "search": "searchRange",
+                   "reconfigure": "/dnsmasq/service/reconfigure"},
+    "kea_reservation": {"body_key": "reservation", "base": "/kea/dhcpv4", "add": "addReservation",
+                        "set": "setReservation", "del": "delReservation", "get": "getReservation",
+                        "search": "searchReservation", "reconfigure": "/kea/service/reconfigure"},
+}
+
+
+def _nest(fields: dict) -> dict:
+    """{"option_data.routers": "x"} -> {"option_data": {"routers": "x"}} (the wire form of Kea's option block)."""
+    out: dict = {}
+    for key, value in fields.items():
+        head, _, tail = key.partition(".")
+        if tail:
+            out.setdefault(head, {})[tail] = value
+        else:
+            out[key] = value
+    return out
+
+
+async def get_network_item(host: OpnsenseHost, kind: str, uuid: str | None) -> dict:
+    api = NETWORK_ITEM_APIS[kind]
+    path = f"{api['base']}/{api['get']}" + (f"/{uuid}" if uuid else "")
+    data = await _request(host, "GET", path)
+    item = data.get(api["body_key"]) if isinstance(data, dict) else None
+    return item if isinstance(item, dict) else {}
+
+
+async def write_network_item(host: OpnsenseHost, kind: str, action: str, uuid: str | None, fields: dict) -> dict:
+    api = NETWORK_ITEM_APIS[kind]
+    if action == "add":
+        return _mutation_result(
+            await _request(host, "POST", f"{api['base']}/{api['add']}", json={api["body_key"]: _nest(fields)}),
+            "Objekt anlegen", {"saved"})
+    if action == "set":
+        return _mutation_result(
+            await _request(host, "POST", f"{api['base']}/{api['set']}/{uuid}", json={api["body_key"]: _nest(fields)}),
+            "Objekt ändern", {"saved"})
+    return _mutation_result(
+        await _request(host, "POST", f"{api['base']}/{api['del']}/{uuid}"), "Objekt entfernen", {"deleted"})
+
+
+async def reconfigure_network(host: OpnsenseHost, kind: str) -> dict:
+    return _mutation_result(
+        await _request(host, "POST", NETWORK_ITEM_APIS[kind]["reconfigure"]), "Änderung anwenden", set())
+
+
+async def list_network_item_uuids(host: OpnsenseHost, kind: str) -> list[str]:
+    api = NETWORK_ITEM_APIS[kind]
+    data = await _request(host, "GET", f"{api['base']}/{api['search']}", params={"rowCount": -1})
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [str(r.get("uuid")) for r in rows if isinstance(r, dict) and r.get("uuid")]
+
+
+async def interface_changes_pending(host: OpnsenseHost) -> bool:
+    """True while staged interface changes wait for an apply (AssignmentController::pendingAction).
+    Our own apply would apply those too, so a change must not start on top of them."""
+    data = await _request(host, "GET", "/interfaces/assignment/pending")
+    return isinstance(data, dict) and data.get("status") == "pending"
+
+
+async def _search_all(host: OpnsenseHost, path: str) -> dict:
+    return await _request(host, "GET", path, params={"rowCount": -1})
+
+
+async def search_dns_hosts(host: OpnsenseHost) -> dict:
+    return await _search_all(host, "/unbound/settings/searchHostOverride")
+
+
+async def search_dhcp_hosts(host: OpnsenseHost) -> dict:
+    return await _search_all(host, "/dnsmasq/settings/searchHost")
+
+
+async def search_kea_subnets(host: OpnsenseHost) -> dict:
+    return await _search_all(host, "/kea/dhcpv4/searchSubnet")
+
+
+async def search_kea_reservations(host: OpnsenseHost) -> dict:
+    return await _search_all(host, "/kea/dhcpv4/searchReservation")
+
+
+async def search_network_objects(host: OpnsenseHost, kind: str) -> list[dict]:
+    api = NETWORK_ITEM_APIS[kind]
+    data = await _request(host, "GET", f"{api['base']}/{api['search']}", params={"rowCount": -1})
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [r for r in rows if isinstance(r, dict)]
+
+
+# ── ZFS snapshots (Core/Api/SnapshotsController, read 2026-10-09) ────────
+# Not a config object: flat form fields instead of {body_key: {...}}, no reconfigure, and the answers are
+# free-form ("OK" strings / {"status": ...}), so callers confirm by listing again.
+async def list_snapshots(host: OpnsenseHost) -> list[dict]:
+    data = await _request(host, "GET", "/core/snapshots/search", params={"rowCount": -1})
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [r for r in rows if isinstance(r, dict)]
+
+
+async def create_snapshot(host: OpnsenseHost, name: str, note: str = "") -> None:
+    data = await _request(host, "POST", "/core/snapshots/add", json={"name": name, "note": note})
+    if isinstance(data, dict) and (data.get("validations") or str(data.get("status", "")).lower() == "failed"):
+        raise OpnsenseAPIError(f"Snapshot anlegen von Firewall nicht bestätigt: {redact_data(data)}")
+
+
+async def delete_snapshot(host: OpnsenseHost, uuid: str) -> None:
+    data = await _request(host, "POST", f"/core/snapshots/del/{uuid}")
+    if isinstance(data, dict) and (data.get("validations") or str(data.get("status", "")).lower() == "failed"):
+        raise OpnsenseAPIError(f"Snapshot löschen von Firewall nicht bestätigt: {redact_data(data)}")

backend/app/services/outbound_nat_deploy_service.py

@@ -152,7 +152,7 @@ async def undeploy_outbound_nat(db: AsyncSession, rule: OutboundNatRule) -> None
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/policy_hierarchy_deploy_service.py

@@ -311,7 +311,7 @@ async def undeploy_hierarchy_rule(db: AsyncSession, rule: PolicyHierarchyRule) -
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/policy_service.py

@@ -7,7 +7,7 @@ from sqlalchemy import text
 from app.models.policy import RuleRevision
 from app.services.rule_deploy_service import _build_payload
 
-RULE_FIELDS = ("description", "interface", "direction", "ipprotocol", "protocol", "action", "source_net", "source_port", "destination_net", "destination_port", "enabled")
+RULE_FIELDS = ("description", "interface", "direction", "ipprotocol", "protocol", "action", "source_net", "source_port", "destination_net", "destination_port", "enabled", "log")
 
 
 async def policy_lock(db):

backend/app/services/port_forward_deploy_service.py

@@ -152,7 +152,7 @@ async def undeploy_port_forward(db: AsyncSession, rule: PortForwardRule) -> None
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/redaction.py

@@ -25,12 +25,27 @@ _PEM = re.compile(r"-----BEGIN [A-Z0-9 ]+-----.*?(?:-----END [A-Z0-9 ]+-----|$)"
 _PAIR = re.compile(r"(?i)\b([\w.\-]*(?:pass|secret|psk|token|private|api_?key|key)[\w.\-]*)\b([\"']?\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|[^\s,;&]+)")
 
 
-def _scrub_json(value: Any, key: str = "") -> Any:
+# Keys under which OPNsense lists per-field validation errors
+# ({"validations": {"instance.cert": "Please select a valid certificate"}}).
+# There the field name says WHICH field failed. "cert", "crt" and "auth" in it
+# do not make the message secret, so those three alone stop triggering the
+# redaction (otherwise every certificate/auth error from the firewall reads
+# "[redacted]"). Real secret names (psk, key, password, ...) still do.
+_VALIDATION_KEYS = {"validations", "validation"}
+_SECRET_KEY_IN_VALIDATIONS = re.compile(
+    r"pass|secret|psk|pre_?shared|private|prv|token|api_?key|apikey|credential|\bkey\b|_key|key_|tls_?key",
+    re.IGNORECASE,
+)
+
+
+def _scrub_json(value: Any, key: str = "", in_validations: bool = False) -> Any:
     if isinstance(value, dict):
-        return {k: _scrub_json(v, str(k)) for k, v in value.items()}
+        nested = in_validations or key in _VALIDATION_KEYS
+        return {k: _scrub_json(v, str(k), nested) for k, v in value.items()}
     if isinstance(value, list):
-        return [_scrub_json(v, key) for v in value]
-    if isinstance(value, str) and key and _SECRET_KEY.search(key):
+        return [_scrub_json(v, key, in_validations) for v in value]
+    pattern = _SECRET_KEY_IN_VALIDATIONS if in_validations else _SECRET_KEY
+    if isinstance(value, str) and key and pattern.search(key):
         return _REDACTED
     if isinstance(value, str):
         return _scrub_text(value)

backend/app/services/rule_adopt_service.py

@@ -0,0 +1,158 @@
+"""Takes over a firewall rule that was created by hand on a host, so it can be
+edited, versioned and deployed from OPNexus like any other rule.
+
+Adoption itself writes NOTHING to the firewall: it records the rule as it is
+right now (read fresh from the host at adoption time, never from what the
+browser sent) together with its OPNsense UUID. The first change afterwards goes
+through the normal preview → push → confirm/auto-revert flow.
+
+Only rules OPNexus can describe without distortion are adopted. A rule using
+something the model cannot express (several interfaces, an inverted source, a
+non-quick rule, ...) is refused with the reason instead of being imported in a
+way that would silently change its meaning on the next edit. Fields the model
+does not know about (gateway, state options, schedules, tags, ...) are left
+alone on the firewall: setRule only overwrites the fields it is sent.
+"""
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.host import OpnsenseHost
+from app.models.rule import FirewallRule
+from app.models.rule_deployment import RuleDeployment
+from app.services import opnsense_client
+from app.services.policy_service import revision
+from app.services.rule_deploy_service import _build_payload
+
+
+class RuleNotFoundOnHost(Exception):
+    pass
+
+
+class NotAdoptable(Exception):
+    def __init__(self, reasons: list[str]):
+        super().__init__(", ".join(reasons))
+        self.reasons = reasons
+
+
+def _on(value) -> bool:
+    return value in ("1", 1, True)
+
+
+def _clean(value) -> str:
+    return "" if value is None else str(value).strip()
+
+
+def reasons_not_adoptable(row: dict, managed_uuids: set[str]) -> list[str]:
+    """Machine-readable reasons (the UI translates them); empty = adoptable."""
+    reasons = []
+    if row.get("is_automatic"):
+        reasons.append("automatic")
+    if _clean(row.get("uuid")) in managed_uuids:
+        reasons.append("already_managed")
+    interface = _clean(row.get("interface"))
+    if not interface or "," in interface:
+        reasons.append("interface_not_single")
+    if _on(row.get("interfacenot")):
+        reasons.append("negated_interface")
+    if _on(row.get("source_not")):
+        reasons.append("negated_source")
+    if _on(row.get("destination_not")):
+        reasons.append("negated_destination")
+    if _clean(row.get("received-on")):
+        reasons.append("received_on")
+    if _clean(row.get("quick")) != "1":
+        reasons.append("not_quick")
+    if _clean(row.get("direction")) not in ("in", "out"):
+        reasons.append("direction_unsupported")
+    if _clean(row.get("action")) not in ("pass", "block", "reject"):
+        reasons.append("action_unsupported")
+    if _clean(row.get("ipprotocol")) not in ("inet", "inet6"):
+        reasons.append("ipprotocol_unsupported")
+    if not _clean(row.get("description")):
+        reasons.append("no_description")
+    return reasons
+
+
+async def _managed_uuids(db: AsyncSession, host: OpnsenseHost) -> set[str]:
+    rows = await db.scalars(
+        select(RuleDeployment.opnsense_rule_uuid).where(
+            RuleDeployment.host_id == host.id, RuleDeployment.opnsense_rule_uuid.is_not(None)
+        )
+    )
+    return set(rows.all())
+
+
+async def _live_rows(host: OpnsenseHost) -> list[dict]:
+    data = await opnsense_client.search_rules(host, all_rows=True)
+    rows = data.get("rows", []) if isinstance(data, dict) else []
+    return [r for r in rows if isinstance(r, dict) and r.get("uuid")]
+
+
+async def list_unmanaged(db: AsyncSession, host: OpnsenseHost) -> list[dict]:
+    managed = await _managed_uuids(db, host)
+    result = []
+    for row in await _live_rows(host):
+        if row.get("is_automatic"):
+            continue  # built-in/system rules never show up here at all
+        reasons = reasons_not_adoptable(row, managed)
+        if "already_managed" in reasons:
+            continue
+        result.append({
+            "uuid": _clean(row.get("uuid")),
+            "description": _clean(row.get("description")),
+            "interface": _clean(row.get("interface")),
+            "interface_label": _clean(row.get("%interface")) or _clean(row.get("interface")),
+            "direction": _clean(row.get("direction")),
+            "action": _clean(row.get("action")),
+            "protocol": _clean(row.get("protocol")) or "any",
+            "source_net": _clean(row.get("source_net")) or "any",
+            "source_port": _clean(row.get("source_port")),
+            "destination_net": _clean(row.get("destination_net")) or "any",
+            "destination_port": _clean(row.get("destination_port")),
+            "enabled": _on(row.get("enabled")),
+            "log": _on(row.get("log")),
+            "adoptable": not reasons,
+            "reasons": reasons,
+        })
+    return result
+
+
+async def adopt(db: AsyncSession, host: OpnsenseHost, rule_uuid: str) -> FirewallRule:
+    managed = await _managed_uuids(db, host)
+    row = next((r for r in await _live_rows(host) if _clean(r.get("uuid")) == rule_uuid), None)
+    if row is None:
+        raise RuleNotFoundOnHost(rule_uuid)
+    reasons = reasons_not_adoptable(row, managed)
+    if reasons:
+        raise NotAdoptable(reasons)
+
+    rule = FirewallRule(
+        description=_clean(row.get("description")),
+        interface=_clean(row.get("interface")),
+        direction=_clean(row.get("direction")),
+        ipprotocol=_clean(row.get("ipprotocol")),
+        protocol=_clean(row.get("protocol")) or "any",
+        action=_clean(row.get("action")),
+        source_net=_clean(row.get("source_net")) or "any",
+        source_port=_clean(row.get("source_port")) or None,
+        destination_net=_clean(row.get("destination_net")) or "any",
+        destination_port=_clean(row.get("destination_port")) or None,
+        enabled=_on(row.get("enabled")),
+        log=_on(row.get("log")),
+        targets=[host],
+        groups=[],
+    )
+    db.add(rule)
+    await db.flush()
+    revision(db, rule, "Von Firewall übernommen")
+    db.add(RuleDeployment(
+        rule_id=rule.id,
+        host_id=host.id,
+        status="success",
+        message="Von der Firewall übernommen",
+        opnsense_rule_uuid=rule_uuid,
+        last_payload=_build_payload(rule),
+        previous_payload=None,
+    ))
+    await db.flush()
+    return rule

backend/app/services/rule_deploy_service.py

@@ -50,7 +50,7 @@ def _build_payload(rule: FirewallRule) -> dict:
         "destination_net": rule.destination_net,
         "destination_port": rule.destination_port or "",
         "description": rule.description,
-        "log": "0",
+        "log": "1" if rule.log else "0",
     }
 
 
@@ -160,7 +160,7 @@ async def undeploy_rule(db: AsyncSession, rule: FirewallRule) -> None:
             except OpnsenseAPIError as exc:
                 deployment.status = "error"
                 deployment.message = str(exc)
-                failures.append(host.name)
+                failures.append(f"{host.name} ({str(exc)[:200]})")
                 continue
         await db.delete(deployment)
     await db.flush()

backend/app/services/rule_drift_service.py

@@ -38,6 +38,10 @@ async def _live_rules_or_none(host: OpnsenseHost) -> list[LiveRule] | None:
 
 
 async def compute_cluster_drift(hosts: list[OpnsenseHost]) -> list[dict]:
+    return (await compute_cluster_drift_with_reachable(hosts))[0]
+
+
+async def compute_cluster_drift_with_reachable(hosts: list[OpnsenseHost]) -> tuple[list[dict], set]:
     """Returns one row per fingerprint that isn't present on every reachable
     host in the cluster: {"fingerprint": str, "sample": LiveRule,
     "present_on": set[host_id], "reachable_host_ids": set[host_id]}.
@@ -58,4 +62,4 @@ async def compute_cluster_drift(hosts: list[OpnsenseHost]) -> list[dict]:
     for entry in by_fingerprint.values():
         entry["reachable_host_ids"] = reachable_ids
 
-    return [entry for entry in by_fingerprint.values() if len(entry["present_on"]) < len(reachable_ids)]
+    return [entry for entry in by_fingerprint.values() if len(entry["present_on"]) < len(reachable_ids)], reachable_ids

backend/app/services/snapshot_service.py

@@ -0,0 +1,73 @@
+"""ZFS snapshots (boot environments) of one firewall: list, create, delete.
+
+Snapshots are a safety net before bigger changes, not a rollback button:
+activating one needs a reboot and discards everything since, so that action is
+deliberately NOT offered here. Deleting refuses the active/next-boot snapshot
+(the firewall refuses too; we say so up front). Every step is audited.
+"""
+import re
+
+from app.errors import ErrorCode, api_error
+from app.models.host import OpnsenseHost
+from app.services import audit_service, opnsense_client
+from app.services.opnsense_client import OpnsenseAPIError
+
+NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
+
+
+def _row(row: dict) -> dict:
+    return {
+        "uuid": str(row.get("uuid", "")), "name": str(row.get("name", "")), "active": str(row.get("active", "")),
+        "size": str(row.get("size", "")), "created": str(row.get("created_str", "")),
+        "mountpoint": str(row.get("mountpoint", "")),
+    }
+
+
+async def list_snapshots(host: OpnsenseHost) -> dict:
+    try:
+        supported = (await opnsense_client._request(host, "GET", "/core/snapshots/isSupported")).get("supported")
+    except OpnsenseAPIError as exc:
+        if "404" in str(exc):
+            return {"supported": False, "rows": []}
+        raise
+    if not supported:
+        return {"supported": False, "rows": []}
+    return {"supported": True, "rows": [_row(r) for r in await opnsense_client.list_snapshots(host)]}
+
+
+async def create(host: OpnsenseHost, name: str, note: str) -> dict:
+    if not NAME.match(name):
+        raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field="name")
+    audit = {"kind": "snapshot", "action": "snapshot.add", "entity_name": name, "host_id": str(host.id), "host_name": host.name}
+    await audit_service.persist(**audit, status="started", message=None, details={"note": note[:200]})
+    try:
+        await opnsense_client.create_snapshot(host, name, note[:200])
+        created = next((r for r in await opnsense_client.list_snapshots(host) if r.get("name") == name), None)
+    except OpnsenseAPIError as exc:
+        await audit_service.persist(**audit, status="rejected", message=str(exc)[:500], details={})
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)[:300]) from exc
+    await audit_service.persist(**audit, status="applied" if created else "unverified", message=None, details={})
+    if not created:
+        raise api_error(502, ErrorCode.NETWORK_APPLY_UNCERTAIN, host=host.name, backup_id="-")
+    return _row(created)
+
+
+async def delete(host: OpnsenseHost, uuid: str) -> None:
+    rows = await opnsense_client.list_snapshots(host)
+    target = next((r for r in rows if str(r.get("uuid")) == uuid), None)
+    if target is None:
+        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
+    if str(target.get("active", "")).strip() not in ("", "-"):
+        # N = active now, R = active after reboot: removing either would break the boot environment.
+        raise api_error(409, ErrorCode.NETWORK_CHANGE_BLOCKED, reasons="snapshot_active")
+    audit = {"kind": "snapshot", "action": "snapshot.del", "entity_name": str(target.get("name")), "host_id": str(host.id), "host_name": host.name}
+    await audit_service.persist(**audit, status="started", message=None, details={})
+    try:
+        await opnsense_client.delete_snapshot(host, uuid)
+        still = any(str(r.get("uuid")) == uuid for r in await opnsense_client.list_snapshots(host))
+    except OpnsenseAPIError as exc:
+        await audit_service.persist(**audit, status="rejected", message=str(exc)[:500], details={})
+        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)[:300]) from exc
+    await audit_service.persist(**audit, status="unverified" if still else "applied", message=None, details={})
+    if still:
+        raise api_error(502, ErrorCode.NETWORK_APPLY_UNCERTAIN, host=host.name, backup_id="-")

backend/app/services/wireguard_deploy_service.py

@@ -324,6 +324,9 @@ async def _deploy_to_host(db: AsyncSession, tunnel: WireguardTunnel, host: Opnse
 
     try:
         await _write_config(host, payloads, deployment)
+        # Without the global switch the config is stored but no interface
+        # ever comes up (live-verified), so a "success" would be a lie.
+        await opnsense_client.ensure_wireguard_enabled(host)
     except OpnsenseAPIError as exc:
         deployment.status = "error"
         deployment.message = str(exc)
@@ -388,7 +391,7 @@ async def undeploy_tunnel(db: AsyncSession, tunnel: WireguardTunnel) -> None:
         except OpnsenseAPIError as exc:
             deployment.status = "error"
             deployment.message = str(exc)
-            failures.append(host.name)
+            failures.append(f"{host.name} ({str(exc)[:200]})")
             continue
         await db.delete(deployment)
     await db.flush()

backend/app/version.py

@@ -6,5 +6,5 @@ convention — but both are bumped together whenever a release ships).
 Versioning scheme: see CHANGELOG.md ("Versionierung").
 """
 
-APP_VERSION = "1.11.0"
-APP_CODENAME = "Merlin"
+APP_VERSION = "1.13.0"
+APP_CODENAME = "Buzzard"

backend/migrations/versions/0003_rule_log_flag.py

@@ -0,0 +1,24 @@
+"""Regeln: Protokollieren-Flag (log).
+
+Bisher schrieb jeder Push fest log=0. Damit eine von Hand angelegte Regel mit
+Protokollierung übernommen und danach bearbeitet werden kann, ohne dass das
+Flag still verloren geht, ist es jetzt ein Feld der Regel.
+
+Revision ID: 0003
+Revises: 0002
+Create Date: 2026-10-09
+"""
+from alembic import op
+
+revision = "0003"
+down_revision = "0002"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE firewall_rules ADD COLUMN IF NOT EXISTS log boolean NOT NULL DEFAULT false")
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE firewall_rules DROP COLUMN IF EXISTS log")

backend/migrations/versions/0004_network_drift_alert.py

@@ -0,0 +1,20 @@
+"""Benachrichtigung bei Netzwerk-Abweichungen zwischen den Knoten eines Clusters.
+
+Revision ID: 0004
+Revises: 0003
+Create Date: 2026-10-09
+"""
+from alembic import op
+
+revision = "0004"
+down_revision = "0003"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("ALTER TABLE notification_settings ADD COLUMN IF NOT EXISTS network_drift_enabled boolean NOT NULL DEFAULT true")
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE notification_settings DROP COLUMN IF EXISTS network_drift_enabled")

backend/tests/test_acme.py

@@ -75,7 +75,7 @@ async def test_push_acme_account_with_eab(client, respx_mock):
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]), )
     account_id = resp.json()["id"]
 
-    add_route = respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    add_route = respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     resp = await client.post(f"/api/acme/accounts/{account_id}/push")
@@ -97,7 +97,7 @@ async def test_register_account_regression_response_shape(client, respx_mock):
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
@@ -118,7 +118,7 @@ async def test_register_account_failed_precheck_shape(client, respx_mock):
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
@@ -175,7 +175,7 @@ async def test_push_certificate_request_injects_account_uuid(client, respx_mock)
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
@@ -183,7 +183,7 @@ async def test_push_certificate_request_injects_account_uuid(client, respx_mock)
     resp = await client.post("/api/acme/certificates", json=_cert_request_payload(host["id"], account_id))
     request_id = resp.json()["id"]
 
-    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/addAction$").mock(
+    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     resp = await client.post(f"/api/acme/certificates/{request_id}/push")
@@ -202,14 +202,14 @@ async def test_push_certificate_request_is_noop_when_unchanged(client, respx_moc
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
 
     resp = await client.post("/api/acme/certificates", json=_cert_request_payload(host["id"], account_id))
     request_id = resp.json()["id"]
-    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/addAction$").mock(
+    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     resp1 = await client.post(f"/api/acme/certificates/{request_id}/push")
@@ -230,7 +230,7 @@ async def test_push_certificate_request_repushes_after_account_switch(client, re
 
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"], name="Account A"))
     account_a = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         side_effect=[
             httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-a"}),
             httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-b"}),
@@ -243,7 +243,7 @@ async def test_push_certificate_request_repushes_after_account_switch(client, re
 
     resp = await client.post("/api/acme/certificates", json=_cert_request_payload(host["id"], account_a))
     request = resp.json()
-    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/addAction$").mock(
+    add_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     push_resp = await client.post(f"/api/acme/certificates/{request['id']}/push")
@@ -257,7 +257,7 @@ async def test_push_certificate_request_repushes_after_account_switch(client, re
     resp = await client.put(f"/api/acme/certificates/{request['id']}", json=edit_payload)
     assert resp.status_code == 200, resp.text
 
-    set_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/updateAction/.*").mock(
+    set_route = respx_mock.post(url__regex=r".*/acmeclient/certificates/update/.*").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     resp = await client.post(f"/api/acme/certificates/{request['id']}/push")
@@ -272,14 +272,14 @@ async def test_sign_is_async_trigger_not_a_success_claim(client, respx_mock):
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
 
     resp = await client.post("/api/acme/certificates", json=_cert_request_payload(host["id"], account_id))
     request_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/certificates/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/certificates/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     await client.post(f"/api/acme/certificates/{request_id}/push")
@@ -302,14 +302,14 @@ async def test_poll_certificate_status_updates_remote_fields(client, respx_mock)
     host = await _create_host(client, "fw1", "https://fw1.test")
     resp = await client.post("/api/acme/accounts", json=_account_payload(host["id"]))
     account_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/accounts/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/accounts/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "acct-uuid-1"})
     )
     await client.post(f"/api/acme/accounts/{account_id}/push")
 
     resp = await client.post("/api/acme/certificates", json=_cert_request_payload(host["id"], account_id))
     request_id = resp.json()["id"]
-    respx_mock.post(url__regex=r".*/acmeclient/certificates/addAction$").mock(
+    respx_mock.post(url__regex=r".*/acmeclient/certificates/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-req-uuid-1"})
     )
     await client.post(f"/api/acme/certificates/{request_id}/push")

backend/tests/test_aliases.py

@@ -128,6 +128,27 @@ async def test_delete_alias(client: AsyncClient, respx_mock):
     assert (await client.get("/api/aliases")).json() == []
 
 
+@pytest.mark.asyncio
+async def test_delete_alias_refused_by_firewall_names_the_reason(client: AsyncClient, respx_mock):
+    """Live 26.7: an alias still used by a rule cannot be removed; the user must
+    see why (it used to be a bare "request failed")."""
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    host = await _create_host(client, "fw1", "https://fw1.test")
+    r = (await client.post("/api/aliases", json=_alias_payload([host["id"]]))).json()
+    _mock_alias_push(respx_mock, "https://fw1.test")
+    assert (await client.post(f"/api/aliases/{r['id']}/deploy")).status_code == 200
+    assert (await client.post(f"/api/aliases/{r['id']}/confirm")).status_code == 200
+
+    respx_mock.post(url__regex=r".*/firewall/alias/delItem/.*").mock(
+        return_value=httpx.Response(200, json={"status": "failed", "message": "Alias is used by rule FW3 test block"})
+    )
+    resp = await client.delete(f"/api/aliases/{r['id']}")
+    assert resp.status_code == 502, resp.text
+    detail = resp.json()["detail"]
+    assert detail["code"] == "UPSTREAM_REJECTED"
+    assert "used by rule" in detail["params"]["reason"]
+
+
 @pytest.mark.asyncio
 async def test_deploy_alias_without_targets_rejected(client: AsyncClient):
     r = (await client.post("/api/aliases", json=_alias_payload([]))).json()

backend/tests/test_carp_auto_revert.py

@@ -157,6 +157,57 @@ async def test_sweep_reverts_expired_window(client, respx_mock):
         assert await carp_maintenance_window_service.active_window(db, uuid.UUID(primary["id"])) is None
 
 
+async def _enter_with_expired_window(client, primary):
+    plan = (await client.post(f"/api/hosts/{primary['id']}/maintenance/carp-preview")).json()
+    await client.post(
+        f"/api/hosts/{primary['id']}/maintenance/carp-execute",
+        json={"preview_id": plan["preview_id"], "confirm_name": "fw-primary", "acknowledge_downtime": True, "auto_revert_minutes": 30},
+    )
+    async with SessionLocal() as db:
+        window = await carp_maintenance_window_service.active_window(db, uuid.UUID(primary["id"]))
+        window.auto_revert_at = datetime.now(timezone.utc) - timedelta(seconds=1)
+        await db.commit()
+    return plan["preview_id"]
+
+
+async def test_sweep_revert_closes_the_enter_operation_and_unblocks_deploys(client, respx_mock):
+    """Nach dem Auto-Revert darf die carp_enter-Aktion nicht offen bleiben:
+    sie ließe sich nie mehr bestätigen und blockiert sonst alle Deploys im Cluster."""
+    from app.services.host_maintenance_service import ACTIVE, ensure_no_maintenance
+
+    roles, switch = _stateful_cluster(respx_mock)
+    primary, secondary = await _make_cluster(client)
+    op_id = await _enter_with_expired_window(client, primary)
+
+    async with SessionLocal() as db:
+        op = await db.get(HostOperation, uuid.UUID(op_id))
+        assert op.status == "submitted"
+        await carp_maintenance_window_service.sweep_expired(db)
+
+    async with SessionLocal() as db:
+        op = await db.get(HostOperation, uuid.UUID(op_id))
+        assert op.status == "cancelled" and op.status not in ACTIVE
+        assert "Automatisch" in op.message
+        host = await db.get(__import__("app.models.host", fromlist=["OpnsenseHost"]).OpnsenseHost, uuid.UUID(primary["id"]))
+        await ensure_no_maintenance(db, [host])  # raises if still blocked
+
+
+async def test_sweep_failed_revert_keeps_the_enter_operation_open(client, respx_mock):
+    """Schlägt der automatische Rückschalt-Versuch fehl, muss ein Mensch nachsehen:
+    die Aktion bleibt offen."""
+    roles, switch = _stateful_cluster(respx_mock)
+    primary, secondary = await _make_cluster(client)
+    op_id = await _enter_with_expired_window(client, primary)
+    switch.mock(side_effect=httpx.ConnectError("boom"))
+
+    async with SessionLocal() as db:
+        resolved = await carp_maintenance_window_service.sweep_expired(db)
+    assert resolved[0].status == "revert_failed"
+
+    async with SessionLocal() as db:
+        assert (await db.get(HostOperation, uuid.UUID(op_id))).status == "submitted"
+
+
 @pytest.mark.asyncio
 async def test_sweep_marks_revert_failed_on_toggle_error(client, respx_mock):
     respx_mock.get("https://fw-a.test/api/diagnostics/interface/getVipStatus").mock(

backend/tests/test_certificates.py

@@ -95,7 +95,7 @@ async def test_push_managed_certificate(client, respx_mock):
     resp = await client.post("/api/certificates/managed", json=_cert_payload(host["id"]))
     cert_id = resp.json()["id"]
 
-    respx_mock.post(url__regex=r".*/trust/cert/addAction$").mock(
+    respx_mock.post(url__regex=r".*/trust/cert/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-uuid-1"})
     )
     resp = await client.post(f"/api/certificates/managed/{cert_id}/push")
@@ -112,7 +112,7 @@ async def test_push_is_noop_when_nothing_changed(client, respx_mock):
     resp = await client.post("/api/certificates/managed", json=_cert_payload(host["id"]))
     cert_id = resp.json()["id"]
 
-    add_route = respx_mock.post(url__regex=r".*/trust/cert/addAction$").mock(
+    add_route = respx_mock.post(url__regex=r".*/trust/cert/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-uuid-1"})
     )
     resp1 = await client.post(f"/api/certificates/managed/{cert_id}/push")
@@ -148,14 +148,21 @@ async def test_delete_in_use_certificate_returns_stable_error_code(client, respx
     resp = await client.post("/api/certificates/managed", json=_cert_payload(host["id"]))
     cert_id = resp.json()["id"]
 
-    respx_mock.post(url__regex=r".*/trust/cert/addAction$").mock(
+    respx_mock.post(url__regex=r".*/trust/cert/add$").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "cert-uuid-1"})
     )
     await client.post(f"/api/certificates/managed/{cert_id}/push")
 
-    respx_mock.post(url__regex=r".*/trust/cert/delAction/.*").mock(
-        return_value=httpx.Response(500, json={"message": "OpenVPN - roadwarrior {openvpn.instance.abc}"})
+    respx_mock.post(url__regex=r".*/trust/cert/del/.*").mock(
+        # shape captured from a real OPNsense 26.7.5 (cert used by an OpenVPN instance)
+        return_value=httpx.Response(
+            500,
+            json={"errorMessage": "OpenVPN - roadwarrior {OpenVPN.Instances.Instance.abc}\n", "errorTitle": "Item in use by", "errorLevel": "error"},
+        )
     )
     resp = await client.delete(f"/api/certificates/managed/{cert_id}")
     assert resp.status_code == 502
-    assert resp.json()["detail"] == {"code": "UPSTREAM_REQUEST_FAILED", "params": {}}
+    detail = resp.json()["detail"]
+    assert detail["code"] == "UPSTREAM_REJECTED"
+    assert "Item in use by" in detail["params"]["reason"]
+    assert "roadwarrior" in detail["params"]["reason"]

backend/tests/test_client_url_shape.py

@@ -0,0 +1,14 @@
+"""OPNsense routes drop the `Action` suffix of the PHP method name
+(addAction() -> /add). A URL such as /trust/cert/addAction is a 404 on a real
+firewall, but a respx mock written with the same typo happily accepts it
+(live-found 2026-10-09), so guard the client source itself."""
+import re
+from pathlib import Path
+
+import app.services.opnsense_client as client
+
+
+def test_no_request_path_ends_in_action_suffix():
+    source = Path(client.__file__).read_text()
+    offenders = re.findall(r'"/[A-Za-z0-9_/{}$.]*?[a-z]Action(?:/[^"]*)?"', source)
+    assert offenders == [], offenders

backend/tests/test_hosts.py

@@ -467,6 +467,8 @@ async def test_cas_parses_real_shape(client, respx_mock):
                 "rows": [
                     {
                         "uuid": "ca-uuid-1",
+                        # OpenVPN cert/ca and Trust-Store caref reference this id, not the uuid
+                        "refid": "6ac8a49fa1589",
                         "descr": "Internal CA",
                         "commonname": "Internal Root CA",
                         "valid_from": str(now - 300 * 86400),
@@ -482,6 +484,7 @@ async def test_cas_parses_real_shape(client, respx_mock):
     cas = resp.json()
     assert len(cas) == 1
     assert cas[0]["uuid"] == "ca-uuid-1"
+    assert cas[0]["refid"] == "6ac8a49fa1589"
     assert cas[0]["common_name"] == "Internal Root CA"
     assert cas[0]["status"] == "valid"
 
@@ -572,3 +575,15 @@ async def test_firmware_info_broken_http_framing_gives_actionable_message(client
         await opnsense_client.get_firmware_info(host)
     assert "kern.ipc.tls.enable=0" in str(info.value)
     assert "malformed chunk footer" in str(info.value)
+
+
+@pytest.mark.asyncio
+async def test_host_address_can_be_changed_after_the_firewall_moved(client, respx_mock):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    host = (await client.post("/api/hosts", json={"name": "fw-moved", "base_url": "https://10.9.9.1", "api_key": "k", "api_secret": "s"})).json()
+    resp = await client.patch(f"/api/hosts/{host['id']}", json={"base_url": "https://10.9.9.2"})
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["base_url"] == "https://10.9.9.2" and resp.json()["id"] == host["id"]
+    for bad in ("ftp://x", "http://10.9.9.3", "https://user:[email protected]", "https://10.9.9.3/?a=b"):
+        assert (await client.patch(f"/api/hosts/{host['id']}", json={"base_url": bad})).status_code == 422, bad
+    assert next(h for h in (await client.get("/api/hosts")).json() if h["id"] == host["id"])["base_url"] == "https://10.9.9.2"

backend/tests/test_ipsec_deploy_safety.py

@@ -18,7 +18,16 @@ from tests.test_ipsec import _create_host, _tunnel_payload
 from tests.helpers import deploy_approved
 
 
-def _mock_full_success(respx_mock, base_url: str):
+def _mock_ipsec_enabled(respx_mock, base_url: str, enabled: bool = True):
+    # The service-wide switch is checked before every deploy (live 26.7.6:
+    # off by default, and reconfigure still answers ok while it is off).
+    respx_mock.get(f"{base_url}/api/ipsec/connections/is_enabled").mock(
+        return_value=httpx.Response(200, json={"enabled": enabled})
+    )
+
+
+def _mock_full_success(respx_mock, base_url: str, enabled: bool = True):
+    _mock_ipsec_enabled(respx_mock, base_url, enabled)
     respx_mock.post(f"{base_url}/api/ipsec/connections/addConnection").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "conn-1"})
     )
@@ -134,6 +143,7 @@ async def test_deploy_reconfigure_failure_uses_exact_specified_message(client, r
     respx_mock.post("https://fw1.test/api/ipsec/preSharedKeys/addItem").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "psk-1"})
     )
+    _mock_ipsec_enabled(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/ipsec/service/reconfigure").mock(
         side_effect=httpx.ConnectError("connection refused")
     )
@@ -203,3 +213,20 @@ async def test_undeploy_deletes_child_local_remote_connection_then_psk(client, r
     resp = await client.delete(f"/api/ipsec/tunnels/{tunnel_id}")
     assert resp.status_code == 204, resp.text
     assert del_child.called and del_local.called and del_remote.called and del_conn.called and del_psk.called
+
+
+@pytest.mark.asyncio
+async def test_deploy_switches_on_the_global_ipsec_service_when_disabled(client, respx_mock):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    host = await _create_host(client, "fw1", "https://fw1.test")
+    resp = await client.post("/api/ipsec/tunnels", json=_tunnel_payload([host["id"]]))
+    tunnel_id = resp.json()["id"]
+
+    _mock_full_success(respx_mock, "https://fw1.test", enabled=False)
+    toggle = respx_mock.post("https://fw1.test/api/ipsec/connections/toggle/1").mock(
+        return_value=httpx.Response(200, json={"status": "ok"})
+    )
+    resp = await deploy_approved(client, f"/api/ipsec/tunnels/{tunnel_id}/deploy")
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["deployments"][0]["status"] == "success"
+    assert toggle.call_count == 1

backend/tests/test_network.py

@@ -0,0 +1,178 @@
+"""Read-only network inventory. Response shapes copied from real OPNsense
+26.7.x test firewalls (CARP password replaced)."""
+import httpx
+import pytest
+
+BASE = "https://fw-net.test"
+
+INTERFACES_INFO = {"total": 3, "rowCount": 3, "current": 1, "rows": [
+    {"device": "vtnet0", "identifier": "wan", "description": "WAN", "status": "up", "is_physical": True,
+     "mtu": "1500", "macaddr": "bc:24:11:25:7e:b8", "media": "10Gbase-T <full-duplex>",
+     "ipv4": [{"ipaddr": "10.20.30.57/24"}], "ipv6": []},
+    {"device": "vtnet1_vlan10", "identifier": "lan", "description": "LAN", "status": "up", "is_physical": False,
+     "mtu": "1500", "ipv4": [{"ipaddr": "192.168.1.2/24"},
+                             {"ipaddr": "192.168.1.1/24", "vhid": "10", "status": "MASTER"}],
+     "vlan": {"tag": "10", "proto": "802.1q", "pcp": "0", "parent": "vtnet1"}},
+    {"device": "vtnet1", "identifier": "", "description": "Unassigned Interface", "status": "up",
+     "is_physical": True, "ipv4": []},
+]}
+ASSIGNMENTS = {"rows": [
+    {"uuid": "wan", "identifier": "wan", "pending_action": "", "type4": "staticv4", "%type4": "Static IPv4", "%type6": "DHCPv6"},
+    {"uuid": "lan", "identifier": "lan", "pending_action": "", "type4": "staticv4", "%type4": "Static IPv4", "%type6": "Identity association"},
+]}
+VLANS = {"rows": [{"uuid": "v1", "if": "vtnet1", "tag": "10", "pcp": "0", "descr": "", "vlanif": "vtnet1_vlan10 [LAN]"}]}
+VIPS = {"rows": [{"uuid": "vip1", "interface": "lan", "%interface": "LAN", "mode": "carp", "address": "192.168.1.1/24",
+                  "vhid": "10", "advbase": "1", "advskew": "0", "descr": "CARP LAN", "password": "SUPER-SECRET-CARP"}]}
+GATEWAYS = {"rows": [{"uuid": "g1", "name": "WAN_GW", "descr": "", "interface": "wan", "interface_descr": "WAN",
+                      "ipprotocol": "inet", "gateway": "10.20.30.1", "defaultgw": True, "disabled": False,
+                      "priority": "255", "status": "Online"}]}
+DNS_HOSTS = {"rows": [
+    {"uuid": "d1", "enabled": "1", "hostname": "nas", "domain": "lan.example", "rr": "A", "server": "192.168.1.5", "description": "NAS", "isAlias": False},
+    {"uuid": "d1-a", "enabled": "1", "hostname": "files", "domain": "lan.example", "rr": "A", "server": "192.168.1.5", "isAlias": True}]}
+DHCP_HOSTS = {"rows": [{"uuid": "h1", "host": "printer", "domain": "lan.example", "ip": "192.168.1.30", "hwaddr": "02:00:00:aa:bb:cc",
+                         "lease_time": "", "descr": "Printer"}]}
+KEA_SUBNETS = {"rows": [{"uuid": "s1", "subnet": "192.168.77.0/24", "pools": "192.168.77.100-192.168.77.150",
+                          "option_data.routers": "192.168.77.1", "option_data.domain_name_servers": "",
+                          "description": "lab", "ddns_domain_key_secret": "KEA-DDNS-SECRET"}]}
+KEA_RESERVATIONS = {"rows": [{"uuid": "k1", "subnet": "s1", "%subnet": "192.168.77.0/24", "ip_address": "192.168.77.120",
+                               "hw_address": "02:00:00:aa:bb:dd", "hostname": "kearsv", "description": "Reservation"}]}
+ROUTES = {"rows": [{"uuid": "r1", "network": "10.9.0.0/16", "gateway": "WAN_GW", "descr": "lab", "disabled": "0"}]}
+
+
+async def _host(client, respx_mock, base=BASE, name="fw-net"):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    resp = await client.post("/api/hosts", json={"name": name, "base_url": base, "api_key": "k", "api_secret": "s"})
+    return resp.json()["id"]
+
+
+def _mock(respx_mock, base=BASE, info=INTERFACES_INFO, **overrides):
+    routes = {
+        "/interfaces/overview/interfacesInfo": info,
+        "/interfaces/assignment/searchItem": ASSIGNMENTS,
+        "/interfaces/vlan_settings/searchItem": VLANS,
+        "/interfaces/vip_settings/searchItem": VIPS,
+        "/routing/settings/searchGateway": GATEWAYS,
+        "/routes/routes/searchroute": ROUTES,
+        "/unbound/settings/searchHostOverride": DNS_HOSTS,
+        "/dnsmasq/settings/searchHost": DHCP_HOSTS,
+        "/kea/dhcpv4/searchSubnet": KEA_SUBNETS,
+        "/kea/dhcpv4/searchReservation": KEA_RESERVATIONS,
+    }
+    for path, body in routes.items():
+        reply = overrides.get(path, httpx.Response(200, json=body))
+        respx_mock.get(f"{base}/api{path}").mock(return_value=reply)
+
+
+@pytest.mark.asyncio
+async def test_network_inventory_parses_real_shapes(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.57")
+    _mock(respx_mock, base="https://10.20.30.57")
+    resp = await client.get(f"/api/hosts/{host_id}/network")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    by_device = {i["device"]: i for i in data["interfaces"]}
+    assert by_device["vtnet0"]["identifier"] == "wan"
+    assert by_device["vtnet0"]["ipv4_type"] == "Static IPv4"
+    assert by_device["vtnet1"]["identifier"] is None
+    assert by_device["vtnet0"]["assigned"] is True and by_device["vtnet1"]["assigned"] is False
+    lan = by_device["vtnet1_vlan10"]
+    assert lan["vlan_tag"] == "10" and lan["vlan_parent"] == "vtnet1"
+    assert [a["carp_status"] for a in lan["addresses"]] == [None, "MASTER"]
+    assert data["vlans"][0]["device"] == "vtnet1_vlan10"
+    assert data["gateways"][0]["is_default"] is True
+    assert data["routes"][0]["network"] == "10.9.0.0/16"
+    assert data["unavailable"] == []
+    assert data["can_configure_interfaces"] is True
+
+
+@pytest.mark.asyncio
+async def test_network_marks_management_interface(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.57")
+    _mock(respx_mock, base="https://10.20.30.57")
+    data = (await client.get(f"/api/hosts/{host_id}/network")).json()
+    assert data["management_device"] == "vtnet0"
+    assert [i["device"] for i in data["interfaces"] if i["is_management"]] == ["vtnet0"]
+
+
+@pytest.mark.asyncio
+async def test_network_carp_address_is_not_management(client, respx_mock):
+    # Reached over the shared CARP address: that is not one interface's own IP, so no guess.
+    host_id = await _host(client, respx_mock, base="https://192.168.1.1", name="fw-carp")
+    _mock(respx_mock, base="https://192.168.1.1")
+    data = (await client.get(f"/api/hosts/{host_id}/network")).json()
+    assert data["management_device"] is None
+
+
+@pytest.mark.asyncio
+async def test_network_never_returns_carp_password(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.58", name="fw-pw")
+    _mock(respx_mock, base="https://10.20.30.58")
+    resp = await client.get(f"/api/hosts/{host_id}/network")
+    assert "SUPER-SECRET-CARP" not in resp.text
+    assert "password" not in resp.json()["vips"][0]
+
+
+@pytest.mark.asyncio
+async def test_network_missing_section_is_reported_not_hidden(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.59", name="fw-old")
+    _mock(respx_mock, base="https://10.20.30.59", **{
+        "/interfaces/assignment/searchItem": httpx.Response(404, json={"errorMessage": "Endpoint not found"}),
+    })
+    resp = await client.get(f"/api/hosts/{host_id}/network")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["unavailable"] == ["assignments"]
+    assert len(data["interfaces"]) == 3
+
+
+@pytest.mark.asyncio
+async def test_network_host_unreachable_returns_502(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.60", name="fw-down")
+    respx_mock.get(url__regex=r".*/interfaces/overview/interfacesInfo").mock(side_effect=httpx.ConnectError("refused"))
+    assert (await client.get(f"/api/hosts/{host_id}/network")).status_code == 502
+
+
+@pytest.mark.asyncio
+async def test_network_unknown_host_404(client):
+    resp = await client.get("/api/hosts/00000000-0000-0000-0000-000000000000/network")
+    assert resp.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_network_tolerates_numbers_where_strings_were_expected(client, respx_mock):
+    # Seen live on 26.7.x: a gateway's priority arrived as the integer 254.
+    host_id = await _host(client, respx_mock, base="https://10.20.30.61", name="fw-int")
+    gateways = {"rows": [{**GATEWAYS["rows"][0], "priority": 254}]}
+    _mock(respx_mock, base="https://10.20.30.61", **{
+        "/routing/settings/searchGateway": httpx.Response(200, json=gateways),
+    })
+    resp = await client.get(f"/api/hosts/{host_id}/network")
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["gateways"][0]["priority"] == "254"
+
+
+@pytest.mark.asyncio
+async def test_network_older_26_7_assignment_list_cannot_configure(client, respx_mock):
+    # OPNsense 26.7.1: the assignment list only has identifier/descr/if, no type4/ipaddr.
+    host_id = await _host(client, respx_mock, base="https://10.20.30.62", name="fw-2671")
+    thin = {"rows": [{"uuid": "wan", "identifier": "wan", "descr": "", "if": "vtnet0"}]}
+    _mock(respx_mock, base="https://10.20.30.62", **{
+        "/interfaces/assignment/searchItem": httpx.Response(200, json=thin),
+    })
+    data = (await client.get(f"/api/hosts/{host_id}/network")).json()
+    assert data["can_configure_interfaces"] is False
+    assert data["unavailable"] == []
+
+
+@pytest.mark.asyncio
+async def test_network_lists_dns_and_dhcp_objects_without_secrets(client, respx_mock):
+    host_id = await _host(client, respx_mock, base="https://10.20.30.63", name="fw-dns")
+    _mock(respx_mock, base="https://10.20.30.63")
+    resp = await client.get(f"/api/hosts/{host_id}/network")
+    assert "KEA-DDNS-SECRET" not in resp.text
+    data = resp.json()
+    assert [(d["hostname"], d["server"]) for d in data["dns_hosts"]] == [("nas", "192.168.1.5")]  # alias children are not rows of their own
+    assert data["dhcp_hosts"][0]["hwaddr"] == "02:00:00:aa:bb:cc"
+    assert (data["kea_subnets"][0]["subnet"], data["kea_subnets"][0]["routers"]) == ("192.168.77.0/24", "192.168.77.1")
+    assert data["kea_reservations"][0]["subnet"] == "192.168.77.0/24"
+    assert data["unavailable"] == []

backend/tests/test_network_changes.py

@@ -0,0 +1,540 @@
+"""Writes to VLANs / virtual IPs / gateways / routes, and the safety around them."""
+import json
+
+import httpx
+import pytest
+from sqlalchemy import select
+
+from app.database import SessionLocal
+from app.models.audit import AuditEvent
+from tests.test_network import GATEWAYS, INTERFACES_INFO, _host, _mock
+
+MGMT = "https://10.20.30.57"
+
+
+def _url(path, base=MGMT):
+    return f"{base}/api{path}"
+
+
+def _backup(respx_mock, base=MGMT, status=200):
+    return respx_mock.get(_url("/core/backup/download/this", base)).mock(
+        return_value=httpx.Response(status, content=b"<opnsense/>"))
+
+
+def _item(respx_mock, path, key, node, base=MGMT):
+    respx_mock.get(_url(path, base)).mock(return_value=httpx.Response(200, json={key: node}))
+
+
+async def _setup(client, respx_mock, name, base=MGMT, **overrides):
+    host_id = await _host(client, respx_mock, base=base, name=name)
+    _mock(respx_mock, base=base, **overrides)
+    return host_id
+
+
+def _body(call):
+    return json.loads(call.request.content.decode())
+
+
+async def _preview(client, host_id, **payload):
+    return await client.post(f"/api/hosts/{host_id}/network/changes/preview", json=payload)
+
+
+async def _execute(client, host_id, token, ack=False, **payload):
+    return await client.post(f"/api/hosts/{host_id}/network/changes",
+                             json={**payload, "preview_token": token, "acknowledge": ack})
+
+
+async def _audit(host_id):
+    async with SessionLocal() as db:
+        rows = await db.scalars(select(AuditEvent).where(AuditEvent.host_id == host_id, AuditEvent.kind == "network")
+                                .order_by(AuditEvent.created_at))
+        return list(rows.all())
+
+
+VLAN_ADD = {"kind": "vlan", "action": "add", "fields": {"if": "vtnet1", "tag": "20", "descr": "guests"}}
+
+
+@pytest.mark.asyncio
+async def test_preview_add_is_read_only_and_shows_diff(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c1")
+    resp = await _preview(client, host_id, **VLAN_ADD)
+    assert resp.status_code == 200, resp.text
+    plan = resp.json()
+    assert plan["can_execute"] is True and plan["requires_acknowledgement"] is False
+    assert {c["field"] for c in plan["changes"]} == {"if", "tag", "descr"}
+    assert len(plan["token"]) == 64
+    assert not [c for c in respx_mock.calls if c.request.method == "POST" and "/api/hosts" not in str(c.request.url)
+                and "vlan_settings" in str(c.request.url)]
+
+
+@pytest.mark.asyncio
+async def test_execute_add_backs_up_writes_applies_and_verifies(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c2")
+    backup = _backup(respx_mock)
+    add = respx_mock.post(_url("/interfaces/vlan_settings/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "saved", "uuid": "new-vlan"}))
+    reconf = respx_mock.post(_url("/interfaces/vlan_settings/reconfigure")).mock(
+        return_value=httpx.Response(200, json={"status": "ok"}))
+    _item(respx_mock, "/interfaces/vlan_settings/getItem/new-vlan", "vlan",
+          {"if": {"vtnet1": {"selected": 1}}, "tag": "20", "descr": "guests"})
+    token = (await _preview(client, host_id, **VLAN_ADD)).json()["token"]
+
+    resp = await _execute(client, host_id, token, **VLAN_ADD)
+    assert resp.status_code == 200, resp.text
+    result = resp.json()
+    assert result["uuid"] == "new-vlan" and result["verified"] is True and result["backup_id"].endswith(".xml")
+    assert backup.called and reconf.called
+    assert _body(add.calls.last) == {"vlan": {"if": "vtnet1", "tag": "20", "descr": "guests"}}
+    assert [e.status for e in await _audit(host_id)] == ["started", "applied"]
+
+
+@pytest.mark.asyncio
+async def test_stale_token_is_refused_and_nothing_is_written(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c3")
+    add = respx_mock.post(_url("/interfaces/vlan_settings/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "saved", "uuid": "x"}))
+    resp = await _execute(client, host_id, "0" * 64, **VLAN_ADD)
+    assert resp.status_code == 409
+    assert not add.called
+
+
+@pytest.mark.asyncio
+async def test_token_changes_when_the_fields_change(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c4")
+    one = (await _preview(client, host_id, **VLAN_ADD)).json()["token"]
+    other = dict(VLAN_ADD, fields={**VLAN_ADD["fields"], "tag": "21"})
+    two = (await _preview(client, host_id, **other)).json()["token"]
+    assert one != two
+    # a token for the first request cannot be used for the second
+    assert (await _execute(client, host_id, one, **other)).status_code == 409
+
+
+@pytest.mark.asyncio
+async def test_backup_failure_aborts_before_any_write(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c5")
+    _backup(respx_mock, status=500)
+    add = respx_mock.post(_url("/interfaces/vlan_settings/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "saved", "uuid": "x"}))
+    token = (await _preview(client, host_id, **VLAN_ADD)).json()["token"]
+    resp = await _execute(client, host_id, token, **VLAN_ADD)
+    assert resp.status_code == 502
+    assert resp.json()["detail"]["code"] == "NETWORK_BACKUP_FAILED"
+    assert not add.called
+    assert [e.status for e in await _audit(host_id)] == ["aborted"]
+
+
+@pytest.mark.asyncio
+async def test_firewall_rejection_is_reported_and_not_applied(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c6")
+    _backup(respx_mock)
+    respx_mock.post(_url("/interfaces/vlan_settings/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "failed", "validations": {"vlan.tag": "bad"}}))
+    reconf = respx_mock.post(_url("/interfaces/vlan_settings/reconfigure")).mock(
+        return_value=httpx.Response(200, json={"status": "ok"}))
+    token = (await _preview(client, host_id, **VLAN_ADD)).json()["token"]
+    resp = await _execute(client, host_id, token, **VLAN_ADD)
+    assert resp.status_code == 502 and resp.json()["detail"]["code"] == "UPSTREAM_REJECTED"
+    assert not reconf.called
+    assert (await _audit(host_id))[-1].status == "rejected"
+
+
+@pytest.mark.asyncio
+async def test_apply_failure_is_never_reported_as_success(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c7")
+    _backup(respx_mock)
+    respx_mock.post(_url("/interfaces/vlan_settings/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "saved", "uuid": "x"}))
+    respx_mock.post(_url("/interfaces/vlan_settings/reconfigure")).mock(side_effect=httpx.ReadTimeout("slow"))
+    token = (await _preview(client, host_id, **VLAN_ADD)).json()["token"]
+    resp = await _execute(client, host_id, token, **VLAN_ADD)
+    assert resp.status_code == 502 and resp.json()["detail"]["code"] == "NETWORK_APPLY_UNCERTAIN"
+    assert resp.json()["detail"]["params"]["backup_id"].endswith(".xml")
+    assert (await _audit(host_id))[-1].status == "apply_uncertain"
+
+
+@pytest.mark.asyncio
+async def test_unknown_field_is_rejected_not_forwarded(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c8")
+    resp = await _preview(client, host_id, kind="vlan", action="add", fields={"if": "vtnet1", "tag": "9", "evil": "x"})
+    assert resp.status_code == 422 and resp.json()["detail"]["code"] == "NETWORK_FIELD_INVALID"
+
+
+@pytest.mark.asyncio
+async def test_changing_the_management_vlan_needs_acknowledgement(client, respx_mock):
+    # fw reached on 192.168.1.2 = the LAN VLAN device
+    base = "https://192.168.1.2"
+    vlans = {"rows": [{"uuid": "v-mgmt", "if": "vtnet1", "tag": "10", "pcp": "0", "descr": "", "vlanif": "vtnet1_vlan10 [LAN]"}]}
+    host_id = await _setup(client, respx_mock, "fw-c9", base=base, **{
+        "/interfaces/vlan_settings/searchItem": httpx.Response(200, json=vlans)})
+    _item(respx_mock, "/interfaces/vlan_settings/getItem/v-mgmt", "vlan",
+          {"if": {"vtnet1": {"selected": 1}}, "tag": "10", "descr": "", "vlanif": "vtnet1_vlan10"}, base=base)
+    _backup(respx_mock, base)
+    respx_mock.post(_url("/interfaces/vlan_settings/setItem/v-mgmt", base)).mock(
+        return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(_url("/interfaces/vlan_settings/reconfigure", base)).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    change = {"kind": "vlan", "action": "set", "uuid": "v-mgmt", "fields": {"descr": "renamed"}}
+    plan = (await _preview(client, host_id, **change)).json()
+    assert plan["requires_acknowledgement"] is True
+    assert plan["risks"][0]["code"] == "management_interface"
+    refused = await _execute(client, host_id, plan["token"], **change)
+    assert refused.status_code == 409 and refused.json()["detail"]["code"] == "NETWORK_ACK_REQUIRED"
+    allowed = await _execute(client, host_id, plan["token"], ack=True, **change)
+    assert allowed.status_code == 200, allowed.text
+    assert (await _audit(host_id))[0].details["acknowledged"] is True
+
+
+@pytest.mark.asyncio
+async def test_vip_password_never_leaves_the_server(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c10")
+    _item(respx_mock, "/interfaces/vip_settings/getItem/vip1", "vip", {
+        "interface": {"lan": {"selected": 1}}, "mode": {"carp": {"selected": 1}}, "network": "192.168.1.1/24",
+        "vhid": "10", "password": "STORED-SECRET", "descr": "CARP LAN", "advskew": "0"})
+    _backup(respx_mock)
+    set_route = respx_mock.post(_url("/interfaces/vip_settings/setItem/vip1")).mock(
+        return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(_url("/interfaces/vip_settings/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    change = {"kind": "vip", "action": "set", "uuid": "vip1", "fields": {"password": "NEW-SECRET", "advskew": "100"}}
+    resp = await _preview(client, host_id, **change)
+    assert "STORED-SECRET" not in resp.text and "NEW-SECRET" not in resp.text
+    plan = resp.json()
+    assert {"field": "password", "before": None, "after": "(gesetzt)"} in plan["changes"]
+    assert [w["code"] for w in plan["warnings"]] == ["carp_change"]
+    done = await _execute(client, host_id, plan["token"], **change)
+    assert done.status_code == 200, done.text
+    assert "NEW-SECRET" not in done.text
+    assert _body(set_route.calls.last)["vip"]["password"] == "NEW-SECRET"  # but it does reach the firewall
+    for event in await _audit(host_id):
+        assert "NEW-SECRET" not in json.dumps(event.details) and "STORED-SECRET" not in json.dumps(event.details)
+
+
+@pytest.mark.asyncio
+async def test_default_gateway_and_default_route_need_acknowledgement(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c11")
+    _item(respx_mock, "/routing/settings/getGateway/g1", "gateway_item",
+          {"name": "WAN_GW", "interface": {"wan": {"selected": 1}}, "gateway": "10.20.30.1", "priority": "255"})
+    plan = (await _preview(client, host_id, kind="gateway", action="del", uuid="g1", fields={})).json()
+    assert {r["code"] for r in plan["risks"]} >= {"default_gateway", "management_gateway"}
+
+    route = (await _preview(client, host_id, kind="route", action="add",
+                            fields={"network": "0.0.0.0/0", "gateway": "WAN_GW"})).json()
+    assert [r["code"] for r in route["risks"]] == ["default_route"]
+    covers = (await _preview(client, host_id, kind="route", action="add",
+                             fields={"network": "10.20.0.0/16", "gateway": "WAN_GW"})).json()
+    assert [r["code"] for r in covers["risks"]] == ["route_covers_management"]
+    harmless = (await _preview(client, host_id, kind="route", action="add",
+                               fields={"network": "172.16.0.0/16", "gateway": "WAN_GW"})).json()
+    assert harmless["risks"] == [] and harmless["requires_acknowledgement"] is False
+
+
+@pytest.mark.asyncio
+async def test_delete_is_verified_by_absence(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c12")
+    _item(respx_mock, "/routes/routes/getroute/r1", "route", {"network": "10.9.0.0/16", "gateway": {"WAN_GW": {"selected": 1}}, "descr": "lab", "enabled": "1"})
+    _backup(respx_mock)
+    respx_mock.post(_url("/routes/routes/delroute/r1")).mock(return_value=httpx.Response(200, json={"result": "deleted"}))
+    respx_mock.post(_url("/routes/routes/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    # after the delete the route list no longer contains it
+    respx_mock.get(_url("/routes/routes/searchroute")).mock(return_value=httpx.Response(200, json={"rows": []}))
+    change = {"kind": "route", "action": "del", "uuid": "r1", "fields": {}}
+    plan = (await _preview(client, host_id, **change)).json()
+    assert plan["risks"] == []  # 10.9.0.0/16 does not touch the management address
+    done = await _execute(client, host_id, plan["token"], **change)
+    assert done.status_code == 200 and done.json()["verified"] is True
+
+
+@pytest.mark.asyncio
+async def test_missing_object_is_404(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c13")
+    respx_mock.get(_url("/interfaces/vlan_settings/getItem/ghost")).mock(return_value=httpx.Response(200, json={"vlan": {}}))
+    resp = await _preview(client, host_id, kind="vlan", action="del", uuid="ghost", fields={})
+    assert resp.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_unknown_management_path_is_treated_as_risky(client, respx_mock):
+    # The address OPNexus uses belongs to no interface (NAT, or a CARP address): be careful, not optimistic.
+    base = "https://10.20.30.99"
+    host_id = await _setup(client, respx_mock, "fw-c14", base=base)
+    _item(respx_mock, "/routes/routes/getroute/r2", "route", {"network": "172.16.0.0/16", "gateway": {"WAN_GW": {"selected": 1}}, "enabled": "1"}, base=base)
+    plan = (await _preview(client, host_id, kind="route", action="set", uuid="r2", fields={"descr": "x"}, )).json()
+    assert [r["code"] for r in plan["risks"]] == ["management_unknown"]
+    add = (await _preview(client, host_id, kind="route", action="add", fields={"network": "172.17.0.0/16", "gateway": "WAN_GW"})).json()
+    assert add["risks"] == []  # a new, harmless object cannot cut anything
+
+
+@pytest.mark.asyncio
+async def test_template_returns_the_firewalls_own_choices(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c15")
+    _item(respx_mock, "/routes/routes/getroute", "route", {
+        "network": "", "descr": "", "enabled": "1", "secretless": "x",
+        "gateway": {"Null4": {"value": "Null4", "selected": 0}, "WAN_GW": {"value": "WAN_GW - 10.20.30.1", "selected": 1}}})
+    resp = await client.get(f"/api/hosts/{host_id}/network/template/route")
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["gateway"]["value"] == "WAN_GW"
+    assert [o["value"] for o in body["gateway"]["options"]] == ["Null4", "WAN_GW"]
+    assert "secretless" not in body  # only fields that may be sent
+    assert (await client.get(f"/api/hosts/{host_id}/network/template/bogus")).status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_inventory_reads_route_enabled_flag(client, respx_mock):
+    # Real 26.7.x route rows say enabled "1"/"0", not disabled.
+    rows = {"rows": [{"uuid": "r1", "network": "10.9.0.0/16", "gateway": "WAN_GW", "descr": "on", "enabled": "1"},
+                     {"uuid": "r2", "network": "10.8.0.0/16", "gateway": "WAN_GW", "descr": "off", "enabled": "0"}]}
+    host_id = await _setup(client, respx_mock, "fw-c16", **{"/routes/routes/searchroute": httpx.Response(200, json=rows)})
+    routes = (await client.get(f"/api/hosts/{host_id}/network")).json()["routes"]
+    assert [(r["network"], r["disabled"]) for r in routes] == [("10.9.0.0/16", False), ("10.8.0.0/16", True)]
+
+
+@pytest.mark.asyncio
+async def test_delete_preview_lists_only_meaningful_fields(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c17")
+    _item(respx_mock, "/interfaces/vlan_settings/getItem/v9", "vlan",
+          {"if": {"vtnet1": {"selected": 1}}, "tag": "40", "descr": "x", "vlanif": "vlan01", "pcp": ""})
+    plan = (await _preview(client, host_id, kind="vlan", action="del", uuid="v9", fields={})).json()
+    assert {c["field"] for c in plan["changes"]} == {"if", "tag", "descr"}
+
+
+@pytest.mark.asyncio
+async def test_item_endpoint_returns_current_values_without_secrets(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-c18")
+    _item(respx_mock, "/interfaces/vip_settings/getItem/vip1", "vip", {
+        "interface": {"lan": {"selected": 1}}, "mode": {"carp": {"selected": 1}}, "network": "192.168.1.1/24",
+        "vhid": "10", "password": "STORED-SECRET", "address": "192.168.1.1/24", "descr": "CARP LAN"})
+    resp = await client.get(f"/api/hosts/{host_id}/network/item/vip/vip1")
+    assert resp.status_code == 200, resp.text
+    assert "STORED-SECRET" not in resp.text
+    assert resp.json() == {"interface": "lan", "mode": "carp", "network": "192.168.1.1/24", "vhid": "10", "descr": "CARP LAN"}
+    assert (await client.get(f"/api/hosts/{host_id}/network/item/vip/..%2Fx")).status_code == 404
+
+
+# ── interface assignment / IP configuration ──────────────────────────────
+
+def _pending(respx_mock, status="ok", base=MGMT):
+    respx_mock.get(_url("/interfaces/assignment/pending", base)).mock(return_value=httpx.Response(200, json={"status": status}))
+
+
+IF_ADD = {"kind": "interface", "action": "add", "fields": {"if": "vtnet1_vlan20", "descr": "GUEST", "enable": "1",
+                                                           "type4": "staticv4", "ipaddr": "10.20.0.1/24"}}
+
+
+@pytest.mark.asyncio
+async def test_interface_add_stages_applies_and_verifies(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-i1")
+    _pending(respx_mock)
+    _backup(respx_mock)
+    add = respx_mock.post(_url("/interfaces/assignment/addItem")).mock(
+        return_value=httpx.Response(200, json={"result": "saved", "uuid": "opt1"}))
+    reconf = respx_mock.post(_url("/interfaces/assignment/reconfigure")).mock(
+        return_value=httpx.Response(200, json={"status": "ok"}))
+    _item(respx_mock, "/interfaces/assignment/getItem/opt1", "interface", {
+        "if": {"vtnet1_vlan20": {"selected": 1}}, "descr": "GUEST", "enable": "1",
+        "type4": {"staticv4": {"selected": 1}}, "ipaddr": "10.20.0.1/24"})
+    plan = (await _preview(client, host_id, **IF_ADD)).json()
+    assert plan["can_execute"] is True and plan["risks"] == []
+    done = await _execute(client, host_id, plan["token"], **IF_ADD)
+    assert done.status_code == 200, done.text
+    assert done.json()["uuid"] == "opt1" and done.json()["verified"] is True
+    assert _body(add.calls.last)["interface"]["ipaddr"] == "10.20.0.1/24"
+    assert reconf.called
+
+
+@pytest.mark.asyncio
+async def test_interface_changes_are_blocked_on_firewalls_without_the_api(client, respx_mock):
+    thin = {"rows": [{"uuid": "wan", "identifier": "wan", "descr": "", "if": "vtnet0"}]}  # 26.7.1: no type4
+    host_id = await _setup(client, respx_mock, "fw-i2", **{"/interfaces/assignment/searchItem": httpx.Response(200, json=thin)})
+    plan = (await _preview(client, host_id, **IF_ADD)).json()
+    assert plan["can_execute"] is False
+    assert [b["code"] for b in plan["blocks"]] == ["interface_api_unavailable"]
+    resp = await _execute(client, host_id, plan["token"], **IF_ADD)
+    assert resp.status_code == 409 and resp.json()["detail"]["code"] == "NETWORK_CHANGE_BLOCKED"
+
+
+@pytest.mark.asyncio
+async def test_staged_changes_from_someone_else_block_a_new_change(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-i3")
+    _pending(respx_mock, status="pending")
+    plan = (await _preview(client, host_id, **IF_ADD)).json()
+    assert [b["code"] for b in plan["blocks"]] == ["interface_changes_pending"]
+    add = respx_mock.post(_url("/interfaces/assignment/addItem")).mock(return_value=httpx.Response(200, json={"result": "saved"}))
+    assert (await _execute(client, host_id, plan["token"], **IF_ADD)).status_code == 409
+    assert not add.called
+
+
+@pytest.mark.asyncio
+async def test_deleting_an_interface_lists_the_rules_that_will_vanish(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-i4")
+    _pending(respx_mock)
+    _item(respx_mock, "/interfaces/assignment/getItem/opt1", "interface", {
+        "if": {"vtnet1_vlan20": {"selected": 1}}, "descr": "GUEST", "enable": "1"})
+    respx_mock.get(_url("/firewall/filter/searchRule")).mock(return_value=httpx.Response(200, json={"rows": [
+        {"uuid": "a", "description": "guest out", "interface": "opt1", "is_automatic": False},
+        {"uuid": "b", "description": "multi", "interface": "lan,opt1", "is_automatic": False},
+        {"uuid": "c", "description": "other", "interface": "lan", "is_automatic": False},
+        {"uuid": "d", "description": "system", "interface": "opt1", "is_automatic": True}]}))
+    plan = (await _preview(client, host_id, kind="interface", action="del", uuid="opt1", fields={})).json()
+    risk = next(r for r in plan["risks"] if r["code"] == "interface_rules_removed")
+    assert risk["params"]["count"] == 2 and "guest out" in risk["params"]["names"] and "other" not in risk["params"]["names"]
+    assert plan["requires_acknowledgement"] is True
+
+
+@pytest.mark.asyncio
+async def test_changing_the_management_interface_needs_acknowledgement(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-i5")   # reached on 10.20.30.57 = wan
+    _pending(respx_mock)
+    _item(respx_mock, "/interfaces/assignment/getItem/wan", "interface", {
+        "if": {"vtnet0": {"selected": 1}}, "descr": "WAN", "enable": "1", "type4": {"staticv4": {"selected": 1}},
+        "ipaddr": "10.20.30.57/24"})
+    plan = (await _preview(client, host_id, kind="interface", action="set", uuid="wan", fields={"ipaddr": "10.20.30.77/24"})).json()
+    assert [r["code"] for r in plan["risks"]] == ["management_interface"]
+    assert plan["requires_acknowledgement"] is True
+
+
+@pytest.mark.asyncio
+async def test_locked_interface_cannot_be_deleted_and_says_why(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-i6")
+    _pending(respx_mock)
+    _item(respx_mock, "/interfaces/assignment/getItem/opt1", "interface",
+          {"if": {"vtnet1_vlan20": {"selected": 1}}, "descr": "GUEST", "enable": "1", "lock": "1"})
+    respx_mock.get(_url("/firewall/filter/searchRule")).mock(return_value=httpx.Response(200, json={"rows": []}))
+    plan = (await _preview(client, host_id, kind="interface", action="del", uuid="opt1", fields={})).json()
+    assert [b["code"] for b in plan["blocks"]] == ["interface_locked"] and plan["can_execute"] is False
+
+
+# ── DNS / DHCP objects ───────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_kea_subnet_options_are_sent_nested_and_read_back_flat(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-d1")
+    _backup(respx_mock)
+    add = respx_mock.post(_url("/kea/dhcpv4/addSubnet")).mock(return_value=httpx.Response(200, json={"result": "saved", "uuid": "sn1"}))
+    respx_mock.post(_url("/kea/service/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    _item(respx_mock, "/kea/dhcpv4/getSubnet/sn1", "subnet4", {
+        "subnet": "192.168.50.0/24", "pools": "192.168.50.100-192.168.50.200", "description": "lab",
+        "option_data": {"routers": {"192.168.50.1": {"value": "192.168.50.1", "selected": 1}, "": {"value": "", "selected": 0}},
+                        "domain_name": "lab.example"}})
+    change = {"kind": "kea_subnet", "action": "add", "fields": {
+        "subnet": "192.168.50.0/24", "pools": "192.168.50.100-192.168.50.200", "description": "lab",
+        "option_data.routers": "192.168.50.1", "option_data.domain_name": "lab.example"}}
+    plan = (await _preview(client, host_id, **change)).json()
+    assert plan["risks"] == []  # DHCP data cannot cut the connection, even with an unknown management path
+    done = await _execute(client, host_id, plan["token"], **change)
+    assert done.status_code == 200 and done.json()["verified"] is True, done.text
+    assert _body(add.calls.last) == {"subnet4": {
+        "subnet": "192.168.50.0/24", "pools": "192.168.50.100-192.168.50.200", "description": "lab",
+        "option_data": {"routers": "192.168.50.1", "domain_name": "lab.example"}}}
+
+
+@pytest.mark.asyncio
+async def test_dns_override_on_unknown_management_path_is_not_treated_as_risky(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-d2", base="https://10.20.30.98")
+    _item(respx_mock, "/unbound/settings/getHostOverride/h1", "host",
+          {"hostname": "nas", "domain": "lan.example", "server": "192.168.1.5", "rr": {"A": {"value": "A", "selected": 1}}},
+          base="https://10.20.30.98")
+    plan = (await _preview(client, host_id, kind="dns_host", action="set", uuid="h1", fields={"server": "192.168.1.6"})).json()
+    assert plan["risks"] == [] and plan["can_execute"] is True
+    assert plan["changes"] == [{"field": "server", "before": "192.168.1.5", "after": "192.168.1.6"}]
+
+
+@pytest.mark.asyncio
+async def test_template_turns_tokenizer_fields_into_comma_text(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-d3")
+    _item(respx_mock, "/dnsmasq/settings/getHost", "host", {
+        "host": "", "domain": "", "local": "0",
+        "ip": {"": {"value": "", "selected": 1}},
+        "hwaddr": {"aa:bb:cc:dd:ee:ff": {"value": "aa:bb:cc:dd:ee:ff", "selected": 1}, "11:22:33:44:55:66": {"value": "11:22:33:44:55:66", "selected": 1}}})
+    body = (await client.get(f"/api/hosts/{host_id}/network/template/dhcp_host")).json()
+    assert body["ip"]["value"] == "" and body["hwaddr"]["value"] == "aa:bb:cc:dd:ee:ff,11:22:33:44:55:66"
+
+
+@pytest.mark.asyncio
+async def test_unlisted_secret_fields_never_reach_the_audit_log(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-d4")
+    _backup(respx_mock)
+    _item(respx_mock, "/kea/dhcpv4/getSubnet/sn9", "subnet4", {
+        "subnet": "192.168.9.0/24", "description": "old", "ddns_domain_key_secret": "KEA-DDNS-SECRET"})
+    respx_mock.post(_url("/kea/dhcpv4/setSubnet/sn9")).mock(return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(_url("/kea/service/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    change = {"kind": "kea_subnet", "action": "set", "uuid": "sn9", "fields": {"description": "new"}}
+    plan = (await _preview(client, host_id, **change)).json()
+    assert (await _execute(client, host_id, plan["token"], **change)).status_code == 200
+    assert "KEA-DDNS-SECRET" not in json.dumps([e.details for e in await _audit(host_id)])
+
+
+@pytest.mark.asyncio
+async def test_vip_edit_always_repeats_the_address(client, respx_mock):
+    # OPNsense blanks a VIP's address when an update leaves out "network" (seen live on 26.7.6).
+    host_id = await _setup(client, respx_mock, "fw-v1")
+    _item(respx_mock, "/interfaces/vip_settings/getItem/vip1", "vip", {
+        "interface": {"lan": {"selected": 1}}, "mode": {"carp": {"selected": 1}}, "network": "192.168.1.50/24",
+        "vhid": "11", "advskew": "0", "descr": "x"})
+    _backup(respx_mock)
+    put = respx_mock.post(_url("/interfaces/vip_settings/setItem/vip1")).mock(return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(_url("/interfaces/vip_settings/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    change = {"kind": "vip", "action": "set", "uuid": "vip1", "fields": {"advskew": "20"}}
+    plan = (await _preview(client, host_id, **change)).json()
+    done = await _execute(client, host_id, plan["token"], **change)
+    assert done.status_code == 200, done.text
+    assert _body(put.calls.last)["vip"] == {"advskew": "20", "network": "192.168.1.50/24"}
+
+
+@pytest.mark.asyncio
+async def test_verification_catches_a_field_that_changed_without_being_asked(client, respx_mock):
+    # The firewall dropped an untouched field while saving: that must not be reported as a clean success.
+    host_id = await _setup(client, respx_mock, "fw-v2")
+    state = iter([
+        {"descr": "old", "network": "172.16.0.0/16", "gateway": {"WAN_GW": {"selected": 1}}, "enabled": "1"},   # preview (before)
+        {"descr": "old", "network": "172.16.0.0/16", "gateway": {"WAN_GW": {"selected": 1}}, "enabled": "1"},   # execute re-preview
+        {"descr": "new", "network": "", "gateway": {"WAN_GW": {"selected": 1}}, "enabled": "1"},                # read-back: network wiped
+    ])
+    respx_mock.get(_url("/routes/routes/getroute/r5")).mock(side_effect=lambda req: httpx.Response(200, json={"route": next(state)}))
+    _backup(respx_mock)
+    respx_mock.post(_url("/routes/routes/setroute/r5")).mock(return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(_url("/routes/routes/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    change = {"kind": "route", "action": "set", "uuid": "r5", "fields": {"descr": "new"}}
+    plan = (await _preview(client, host_id, **change)).json()
+    done = (await _execute(client, host_id, plan["token"], **change)).json()
+    assert done["verified"] is False and done["mismatches"] == ["network"]
+
+
+# ── generic object kinds ─────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_objects_list_returns_only_the_display_columns(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-o1")
+    respx_mock.get(_url("/syslog/settings/searchDestinations")).mock(return_value=httpx.Response(200, json={"rows": [
+        {"uuid": "d1", "enabled": "1", "transport": "udp4", "hostname": "192.0.2.10", "port": "514", "program": "", "level": "info",
+         "facility": "daemon", "certificate": "SECRET-CERT-REF", "description": "central"}]}))
+    body = (await client.get(f"/api/hosts/{host_id}/network/objects/syslog_destination")).json()
+    assert body["available"] is True and body["rows"][0]["hostname"] == "192.0.2.10"
+    assert "certificate" not in body["rows"][0] and "facility" not in body["rows"][0]
+    assert (await client.get(f"/api/hosts/{host_id}/network/objects/vlan")).status_code == 404  # typed kinds have their own lists
+
+
+@pytest.mark.asyncio
+async def test_objects_list_reports_a_missing_api_instead_of_failing(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-o2")
+    respx_mock.get(_url("/interfaces/gre_settings/searchItem")).mock(return_value=httpx.Response(404, json={"errorMessage": "Endpoint not found"}))
+    body = (await client.get(f"/api/hosts/{host_id}/network/objects/gre")).json()
+    assert body == {"available": False, "columns": body["columns"], "rows": []}
+
+
+@pytest.mark.asyncio
+async def test_tunables_always_need_acknowledgement_and_defaults_cannot_be_edited(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-o3")
+    add = (await _preview(client, host_id, kind="tunable", action="add", fields={"tunable": "vfs.read_max", "value": "128"})).json()
+    assert [r["code"] for r in add["risks"]] == ["tunable_change"] and add["requires_acknowledgement"] is True
+    _item(respx_mock, "/core/tunables/getItem/0add3c58db981d0d24d5d4ab322e3695", "sysctl",
+          {"tunable": "net.inet.tcp.drop_synfin", "value": "1", "descr": "built in"})
+    default = (await _preview(client, host_id, kind="tunable", action="set", uuid="0add3c58db981d0d24d5d4ab322e3695", fields={"value": "0"})).json()
+    assert [b["code"] for b in default["blocks"]] == ["tunable_default_row"] and default["can_execute"] is False
+
+
+@pytest.mark.asyncio
+async def test_lagg_or_bridge_containing_the_management_device_needs_acknowledgement(client, respx_mock):
+    host_id = await _setup(client, respx_mock, "fw-o4")   # reached on vtnet0
+    mine = (await _preview(client, host_id, kind="lagg", action="add", fields={"members": "vtnet0,vtnet2", "proto": "failover"})).json()
+    assert [r["code"] for r in mine["risks"]] == ["management_member"]
+    other = (await _preview(client, host_id, kind="lagg", action="add", fields={"members": "vtnet2,vtnet3", "proto": "failover"})).json()
+    assert other["risks"] == []

backend/tests/test_network_drift.py

@@ -0,0 +1,94 @@
+"""Network configuration differences between the nodes of an HA cluster."""
+import httpx
+import pytest
+
+from app.database import SessionLocal
+from app.schemas.network import HostNetwork
+from app.services import network_drift_service, notification_checks
+from tests.test_network import DHCP_HOSTS, DNS_HOSTS, GATEWAYS, INTERFACES_INFO, KEA_RESERVATIONS, KEA_SUBNETS, ROUTES, VIPS, VLANS, ASSIGNMENTS
+
+ENDPOINTS = {
+    "/interfaces/overview/interfacesInfo": INTERFACES_INFO, "/interfaces/assignment/searchItem": ASSIGNMENTS,
+    "/interfaces/vlan_settings/searchItem": VLANS, "/interfaces/vip_settings/searchItem": VIPS,
+    "/routing/settings/searchGateway": GATEWAYS, "/routes/routes/searchroute": ROUTES,
+    "/unbound/settings/searchHostOverride": DNS_HOSTS, "/dnsmasq/settings/searchHost": DHCP_HOSTS,
+    "/kea/dhcpv4/searchSubnet": KEA_SUBNETS, "/kea/dhcpv4/searchReservation": KEA_RESERVATIONS,
+}
+
+
+async def _host(client, name, base, cluster="ha"):
+    r = await client.post("/api/hosts", json={"name": name, "base_url": base, "api_key": "k", "api_secret": "s",
+                                              "verify_tls": False, "cluster_name": cluster})
+    assert r.status_code == 201, r.text
+
+
+def _serve(respx_mock, base, **replace):
+    for path, body in ENDPOINTS.items():
+        respx_mock.get(f"{base}/api{path}").mock(return_value=httpx.Response(200, json=replace.get(path, body)))
+
+
+def _net(**replace) -> HostNetwork:
+    data = {
+        "host_id": "x", "host_name": "x", "interfaces": [], "vlans": [], "vips": [], "gateways": [], "routes": [],
+        "management_device": None, "can_configure_interfaces": True, "unavailable": [],
+    }
+    data.update(replace)
+    return HostNetwork(**data)
+
+
+def test_identical_configuration_has_no_differences_even_with_per_node_values():
+    vip_a = {"uuid": "1", "interface": "lan", "interface_label": "LAN", "mode": "carp", "address": "192.168.1.1/24",
+             "vhid": "10", "advbase": "1", "advskew": "0", "description": "x"}
+    vip_b = {**vip_a, "uuid": "2", "advskew": "100"}   # advskew legitimately differs between master and backup
+    a, b = _net(vips=[vip_a]), _net(vips=[vip_b])
+    assert network_drift_service.compare({"a": a, "b": b}) == []
+
+
+def test_missing_and_different_objects_are_reported_with_who_has_what():
+    vlan = {"uuid": "1", "parent": "vtnet1", "tag": "10", "pcp": "0", "description": "LAN", "device": "vtnet1_vlan10"}
+    gw_a = {"uuid": "g", "name": "WAN_GW", "description": "", "interface": "wan", "interface_label": "WAN", "ip_protocol": "inet",
+            "address": "10.0.0.1", "is_default": True, "disabled": False, "priority": "255", "status": "Online"}
+    a = _net(vlans=[vlan, {**vlan, "uuid": "2", "tag": "20"}], gateways=[gw_a])
+    b = _net(vlans=[vlan], gateways=[{**gw_a, "address": "10.0.0.9"}])
+    rows = {(r["category"], r["key"]): r for r in network_drift_service.compare({"a": a, "b": b})}
+    assert rows[("vlans", "20@vtnet1")]["status"] == "missing" and rows[("vlans", "20@vtnet1")]["missing_from"] == ["b"]
+    assert rows[("gateways", "WAN_GW")]["status"] == "different"
+    assert rows[("gateways", "WAN_GW")]["signatures"]["a"] != rows[("gateways", "WAN_GW")]["signatures"]["b"]
+    assert ("vlans", "10@vtnet1") not in rows
+
+
+def test_a_category_one_node_cannot_deliver_is_not_reported_as_a_difference():
+    vlan = {"uuid": "1", "parent": "vtnet1", "tag": "10", "pcp": "0", "description": "", "device": "d"}
+    a, b = _net(vlans=[vlan]), _net(vlans=[], unavailable=["vlans"])
+    assert network_drift_service.compare({"a": a, "b": b}) == []
+
+
+@pytest.mark.asyncio
+async def test_endpoint_and_alert_report_a_route_missing_on_one_node(client, respx_mock):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    await _host(client, "fw-da", "https://10.20.30.91")
+    await _host(client, "fw-db", "https://10.20.30.92")
+    _serve(respx_mock, "https://10.20.30.91")
+    _serve(respx_mock, "https://10.20.30.92", **{"/routes/routes/searchroute": {"rows": []}})
+    body = (await client.get("/api/network/drift")).json()
+    cluster = next(c for c in body["clusters"] if c["name"] == "ha")
+    assert cluster["unreachable"] == []
+    diff = [d for d in cluster["differences"] if d["category"] == "routes"]
+    assert [(d["key"], d["status"], d["missing_from"]) for d in diff] == [("10.9.0.0/16", "missing", ["fw-db"])]
+
+    async with SessionLocal() as db:
+        problems = await notification_checks.check_network_drift(db)
+    mine = [v for k, v in problems.items() if k.startswith("ha:routes:")]
+    assert mine and mine[0]["missing_from"] == ["fw-db"] and "Route" in mine[0]["object"]
+
+
+@pytest.mark.asyncio
+async def test_an_unreachable_node_keeps_open_alerts_instead_of_resolving_them(client, respx_mock):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    await _host(client, "fw-dc", "https://10.20.30.93", cluster="ha2")
+    await _host(client, "fw-dd", "https://10.20.30.94", cluster="ha2")
+    _serve(respx_mock, "https://10.20.30.93")
+    respx_mock.get(url__regex=r"https://10\.20\.30\.94/.*").mock(side_effect=httpx.ConnectError("down"))
+    async with SessionLocal() as db:
+        problems = await notification_checks.check_network_drift(db)
+    assert "ha2:" in problems.preserve_prefixes

backend/tests/test_notifications.py

@@ -177,6 +177,41 @@ async def test_check_rule_drift_no_drift_when_identical(client, respx_mock):
     assert problems == {}
 
 
+@pytest.mark.asyncio
+async def test_drift_stays_open_while_a_cluster_member_is_unreachable(client, respx_mock):
+    """Live 26.7.5: rebooting one firewall made every open drift problem
+    resolve (only one host reachable => nothing to compare) and re-open
+    afterwards, sending a resolved+opened pair per problem."""
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    await _create_host(client, "fw-a", "https://fw-a.test", cluster_name="ha")
+    await _create_host(client, "fw-b", "https://fw-b.test", cluster_name="ha")
+    respx_mock.get("https://fw-a.test/api/firewall/filter/searchRule").mock(
+        return_value=httpx.Response(200, json={"rows": [_live_rule_row("r1", "Allow SSH"), _live_rule_row("r2", "Only A")]})
+    )
+    b = respx_mock.get("https://fw-b.test/api/firewall/filter/searchRule").mock(
+        return_value=httpx.Response(200, json={"rows": [_live_rule_row("r1", "Allow SSH")]})
+    )
+
+    async with SessionLocal() as db:
+        current = await notification_checks.check_rule_drift(db)
+        opened, resolved = await notification_dedup.diff_and_update(db, "rule_drift", current)
+        await db.commit()
+        assert len(opened) == 1 and not resolved
+
+        b.mock(side_effect=httpx.ConnectError("down"))  # fw-b reboots
+        current = await notification_checks.check_rule_drift(db)
+        assert dict(current) == {}
+        opened, resolved = await notification_dedup.diff_and_update(db, "rule_drift", current)
+        await db.commit()
+        assert not opened and not resolved  # still open, nothing sent
+
+        b.mock(return_value=httpx.Response(200, json={"rows": [_live_rule_row("r1", "Allow SSH")]}))
+        current = await notification_checks.check_rule_drift(db)
+        opened, resolved = await notification_dedup.diff_and_update(db, "rule_drift", current)
+        await db.commit()
+        assert not opened and not resolved  # same problem, no duplicate "opened"
+
+
 # ── check_revert_failed / check_maintenance_unknown ─────────────────────
 
 @pytest.mark.asyncio

backend/tests/test_openvpn_deploy_safety.py

@@ -17,17 +17,29 @@ from tests.test_openvpn import _create_host, _instance_payload
 from tests.helpers import deploy_approved
 
 
+def _mock_vpnid_search(respx_mock, base_url: str, rows=None):
+    respx_mock.get(f"{base_url}/api/openvpn/instances/search").mock(
+        return_value=httpx.Response(200, json={"rows": rows or []})
+    )
+
+
 def _mock_full_success(respx_mock, base_url: str, with_statickey: bool = False):
     if with_statickey:
         respx_mock.post(f"{base_url}/api/openvpn/instances/addStaticKey").mock(
             return_value=httpx.Response(200, json={"result": "saved", "uuid": "statickey-1"})
         )
-    respx_mock.post(f"{base_url}/api/openvpn/instances/add").mock(
+    # The firewall does not assign vpnid itself (live 26.7.5: "A value is
+    # required."), so the deploy asks for the existing ones first.
+    respx_mock.get(f"{base_url}/api/openvpn/instances/search").mock(
+        return_value=httpx.Response(200, json={"rows": [{"uuid": "x", "vpnid": "3"}, {"uuid": "y", "vpnid": "1"}]})
+    )
+    add_route = respx_mock.post(f"{base_url}/api/openvpn/instances/add").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "instance-1"})
     )
     respx_mock.post(f"{base_url}/api/openvpn/service/reconfigure").mock(
         return_value=httpx.Response(200, json={"result": "ok"})
     )
+    return add_route
 
 
 @pytest.mark.asyncio
@@ -37,13 +49,14 @@ async def test_deploy_success_persists_instance_uuid(client, respx_mock):
     resp = await client.post("/api/openvpn/instances", json=_instance_payload([host["id"]]))
     instance_id = resp.json()["id"]
 
-    _mock_full_success(respx_mock, "https://fw1.test")
+    add_route = _mock_full_success(respx_mock, "https://fw1.test")
 
     resp = await deploy_approved(client, f"/api/openvpn/instances/{instance_id}/deploy")
     assert resp.status_code == 200, resp.text
     dep = resp.json()["deployments"][0]
     assert dep["status"] == "success"
     assert dep["message"] is None
+    assert json.loads(add_route.calls.last.request.content)["instance"]["vpnid"] == "4"
 
     async with SessionLocal() as db:
         row = (await db.execute(select(OpenVpnInstanceDeployment))).scalar_one()
@@ -85,6 +98,7 @@ async def test_deploy_config_write_failure_surfaces_as_error_without_rollback(cl
     resp = await client.post("/api/openvpn/instances", json=_instance_payload([host["id"]]))
     instance_id = resp.json()["id"]
 
+    _mock_vpnid_search(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/openvpn/instances/add").mock(
         side_effect=httpx.ConnectError("connection refused")
     )
@@ -115,6 +129,7 @@ async def test_deploy_reconfigure_failure_uses_exact_specified_message(client, r
     resp = await client.post("/api/openvpn/instances", json=_instance_payload([host["id"]]))
     instance_id = resp.json()["id"]
 
+    _mock_vpnid_search(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/openvpn/instances/add").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "instance-1"})
     )
@@ -150,6 +165,7 @@ async def test_reconfigure_checks_result_key_explicitly(client, respx_mock):
     resp = await client.post("/api/openvpn/instances", json=_instance_payload([host["id"]]))
     instance_id = resp.json()["id"]
 
+    _mock_vpnid_search(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/openvpn/instances/add").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "instance-1"})
     )
@@ -174,6 +190,7 @@ async def test_redeploy_unchanged_skips_opnsense_entirely(client, respx_mock):
     _mock_full_success(respx_mock, "https://fw1.test")
     await deploy_approved(client, f"/api/openvpn/instances/{instance_id}/deploy")
 
+    _mock_vpnid_search(respx_mock, "https://fw1.test")
     add_route = respx_mock.post("https://fw1.test/api/openvpn/instances/add")
 
     resp = await deploy_approved(client, f"/api/openvpn/instances/{instance_id}/deploy")
@@ -241,6 +258,7 @@ async def test_multi_host_deploy_sends_each_host_its_own_cert_and_ca(client, res
     instance_id = resp.json()["id"]
 
     _mock_full_success(respx_mock, "https://fw1.test")
+    _mock_vpnid_search(respx_mock, "https://fw2.test")
     respx_mock.post("https://fw2.test/api/openvpn/instances/add").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "instance-2"})
     )
@@ -271,6 +289,7 @@ async def test_host_missing_cert_selection_fails_closed_without_any_call(client,
     )
     instance_id = resp.json()["id"]
 
+    _mock_vpnid_search(respx_mock, "https://fw1.test")
     add_route = respx_mock.post("https://fw1.test/api/openvpn/instances/add").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "instance-1"})
     )

backend/tests/test_rule_adopt.py

@@ -0,0 +1,120 @@
+"""Taking over rules that were created by hand on a firewall."""
+import json
+
+import httpx
+import pytest
+
+BASE = "https://fw-adopt.test"
+
+
+def _row(uuid, **over):
+    row = {
+        "uuid": uuid, "description": "Manual SSH", "enabled": "1", "action": "pass", "quick": "1",
+        "interface": "lan", "%interface": "LAN", "interfacenot": "0", "direction": "in", "ipprotocol": "inet",
+        "protocol": "TCP", "source_net": "10.0.0.0/8", "source_not": "0", "source_port": "",
+        "destination_net": "any", "destination_not": "0", "destination_port": "22", "log": "1",
+        "received-on": "", "gateway": "WAN_GW", "is_automatic": False,
+    }
+    row.update(over)
+    return row
+
+
+async def _host(client, respx_mock):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    r = await client.post("/api/hosts", json={"name": "fw-adopt", "base_url": BASE, "api_key": "k", "api_secret": "s"})
+    return r.json()["id"]
+
+
+def _live(respx_mock, rows):
+    return respx_mock.get(f"{BASE}/api/firewall/filter/searchRule").mock(
+        return_value=httpx.Response(200, json={"rows": rows, "total": len(rows)})
+    )
+
+
+@pytest.mark.asyncio
+async def test_unmanaged_lists_adoptable_and_refused_with_reasons(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _live(respx_mock, [
+        _row("u-ok"),
+        _row("u-neg", description="Not source", source_not="1"),
+        _row("u-multi", description="Two ifaces", interface="lan,opt1"),
+        _row("u-float", description="Late", quick="0"),
+        _row("u-auto", description="anti-lockout rule", is_automatic=True),
+    ])
+    resp = await client.get(f"/api/rules/unmanaged?host_id={host_id}")
+    assert resp.status_code == 200, resp.text
+    by_uuid = {r["uuid"]: r for r in resp.json()}
+    assert "u-auto" not in by_uuid  # system rules are never offered
+    assert by_uuid["u-ok"]["adoptable"] is True and by_uuid["u-ok"]["log"] is True
+    assert by_uuid["u-neg"]["reasons"] == ["negated_source"]
+    assert by_uuid["u-multi"]["reasons"] == ["interface_not_single"]
+    assert by_uuid["u-float"]["reasons"] == ["not_quick"]
+
+
+@pytest.mark.asyncio
+async def test_adopt_records_rule_without_writing_to_the_firewall(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _live(respx_mock, [_row("u-ok")])
+    resp = await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "u-ok"})
+    assert resp.status_code == 201, resp.text
+    rule = resp.json()
+    assert (rule["description"], rule["interface"], rule["source_net"], rule["destination_port"]) == (
+        "Manual SSH", "lan", "10.0.0.0/8", "22")
+    assert rule["log"] is True and rule["enabled"] is True
+    assert rule["target_host_ids"] == [host_id]
+    assert [d["status"] for d in rule["deployments"]] == ["success"]
+    assert rule["workflow_state"] == "synced"
+    assert all(call.request.method == "GET" for call in respx_mock.calls if "/filter/" in str(call.request.url))
+    # no longer offered afterwards
+    again = await client.get(f"/api/rules/unmanaged?host_id={host_id}")
+    assert again.json() == []
+
+
+@pytest.mark.asyncio
+async def test_adopt_refuses_unrepresentable_rule(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _live(respx_mock, [_row("u-neg", source_not="1")])
+    resp = await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "u-neg"})
+    assert resp.status_code == 409
+    assert resp.json()["detail"]["code"] == "RULE_NOT_ADOPTABLE"
+    assert "negated_source" in resp.json()["detail"]["params"]["reasons"]
+    assert (await client.get("/api/rules")).json() == [] or all(r["description"] != "Manual SSH" for r in (await client.get("/api/rules")).json())
+
+
+@pytest.mark.asyncio
+async def test_adopt_unknown_uuid_is_404_and_double_adopt_is_refused(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _live(respx_mock, [_row("u-ok")])
+    assert (await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "nope"})).status_code == 404
+    assert (await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "u-ok"})).status_code == 201
+    second = await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "u-ok"})
+    assert second.status_code == 409
+    assert "already_managed" in second.json()["detail"]["params"]["reasons"]
+
+
+@pytest.mark.asyncio
+async def test_edit_after_adopt_updates_same_remote_rule_and_keeps_log(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _live(respx_mock, [_row("u-ok")])
+    rule = (await client.post("/api/rules/adopt", json={"host_id": host_id, "rule_uuid": "u-ok"})).json()
+
+    edit = {
+        "description": "Manual SSH (edited)", "interface": "lan", "direction": "in", "ipprotocol": "inet",
+        "protocol": "TCP", "action": "pass", "source_net": "10.0.0.0/8", "source_port": None,
+        "destination_net": "any", "destination_port": "22", "enabled": True, "log": True,
+        "target_host_ids": [host_id], "target_group_ids": [], "expected_updated_at": rule["updated_at"],
+    }
+    assert (await client.put(f"/api/rules/{rule['id']}", json=edit)).status_code == 200
+
+    set_route = respx_mock.post(f"{BASE}/api/firewall/filter/setRule/u-ok").mock(
+        return_value=httpx.Response(200, json={"result": "saved"}))
+    respx_mock.post(f"{BASE}/api/firewall/filter/apply").mock(return_value=httpx.Response(200, json={"status": "ok"}))
+    from tests.helpers import deploy_approved
+    resp = await deploy_approved(client, f"/api/rules/{rule['id']}/deploy")
+    assert resp.status_code == 200, resp.text
+    assert set_route.called
+    body = set_route.calls.last.request.content.decode()
+    sent = json.loads(body)["rule"]
+    assert sent["description"] == "Manual SSH (edited)"
+    assert sent["log"] == "1"  # not silently reset by the push
+    assert "gateway" not in sent  # fields OPNexus does not model are never sent, so they stay as they are

backend/tests/test_security_review.py

@@ -535,6 +535,17 @@ async def test_password_hashing_runs_off_the_event_loop():
 
 # ── SEC-08: upstream errors never carry secrets ───────────────────────
 
+def test_redaction_keeps_validation_messages_readable():
+    body = (
+        '{"result": "failed", "validations": {"instance.cert": "Please select a valid certificate from the list.",'
+        ' "instance.auth": "Authentication method required"}, "api_key": "k-MARKER"}'
+    )
+    out = redact_text(body)
+    assert "Please select a valid certificate" in out
+    assert "Authentication method required" in out
+    assert "k-MARKER" not in out  # secrets outside "validations" are still masked
+
+
 def test_redaction_scrubs_json_pem_and_known_secrets():
     pem = "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBg\n-----END PRIVATE KEY-----"
     body = json.dumps({
@@ -859,3 +870,30 @@ async def test_process_death_after_intent_leaves_sweepable_or_flagged_row(client
     async with SessionLocal() as db:
         row = (await db.scalars(select(RuleDeployment))).one()
         assert row.status == "revert_failed" and row.opnsense_rule_uuid is None  # visible, blocks retries, notifies
+
+
+# ── audit events built from unvalidated request paths ────────────────────
+
+@pytest.mark.asyncio
+async def test_junk_path_segments_give_422_not_500(client):
+    """Fuzzing found 500s/dropped connections: the audit event copied the raw
+    path segment (300 chars, NUL byte) into VARCHAR(36)/Postgres text."""
+    for path in (
+        "/api/hosts/" + "x" * 300,
+        "/api/hosts/%00/services/ntpd/restart",
+        "/api/rules/not-a-uuid/deploy",
+    ):
+        method = "PATCH" if path.count("/") == 3 else "POST"
+        resp = await client.request(method, path, json={})
+        assert resp.status_code in (404, 422), (path[:40], resp.status_code, resp.text[:100])
+
+
+@pytest.mark.asyncio
+async def test_nul_byte_in_a_text_field_is_a_422_not_a_500(client):
+    for path, body in (
+        ("/api/groups", {"name": "a\u0000b", "description": "x", "host_ids": []}),
+        ("/api/rules", {"description": "a\u0000b", "interface": "lan", "target_host_ids": []}),
+    ):
+        resp = await client.post(path, json=body)
+        assert resp.status_code == 422, (path, resp.status_code, resp.text[:120])
+        assert resp.json()["detail"]["code"] == "INVALID_CHARACTERS"

backend/tests/test_services.py

@@ -8,6 +8,17 @@ def _mock_vip(respx_mock):
     respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
 
 
+def _mock_service_list(respx_mock):
+    respx_mock.get("https://fw1.test/api/core/service/search").respond(
+        200,
+        json={"rows": [
+            {"id": "unbound", "name": "unbound", "locked": 0, "running": 1},
+            {"id": "ntpd", "name": "ntpd", "locked": 0, "running": 1},
+            {"id": "pf", "name": "pf", "locked": 1, "running": 1},
+        ]},
+    )
+
+
 @pytest.mark.asyncio
 async def test_list_services(client, respx_mock):
     _mock_vip(respx_mock)
@@ -24,6 +35,7 @@ async def test_list_services(client, respx_mock):
 async def test_restart_service_success(client, respx_mock):
     _mock_vip(respx_mock)
     h = await _create_host(client, "fw1", "https://fw1.test")
+    _mock_service_list(respx_mock)
     restart = respx_mock.post("https://fw1.test/api/core/service/restart/unbound").respond(200, json={"result": "ok"})
     r = await client.post(f"/api/hosts/{h['id']}/services/unbound/restart")
     assert r.status_code == 200, r.text
@@ -35,6 +47,7 @@ async def test_restart_service_success(client, respx_mock):
 async def test_start_and_stop_service(client, respx_mock):
     _mock_vip(respx_mock)
     h = await _create_host(client, "fw1", "https://fw1.test")
+    _mock_service_list(respx_mock)
     start = respx_mock.post("https://fw1.test/api/core/service/start/ntpd").respond(200, json={"result": "ok"})
     stop = respx_mock.post("https://fw1.test/api/core/service/stop/ntpd").respond(200, json={"result": "ok"})
     r1 = await client.post(f"/api/hosts/{h['id']}/services/ntpd/start")
@@ -47,6 +60,7 @@ async def test_start_and_stop_service(client, respx_mock):
 async def test_restart_service_failure_result_is_rejected(client, respx_mock):
     _mock_vip(respx_mock)
     h = await _create_host(client, "fw1", "https://fw1.test")
+    _mock_service_list(respx_mock)
     respx_mock.post("https://fw1.test/api/core/service/restart/unbound").respond(200, json={"result": "failed"})
     r = await client.post(f"/api/hosts/{h['id']}/services/unbound/restart")
     assert r.status_code == 502, r.text
@@ -66,3 +80,27 @@ async def test_read_only_user_can_list_but_not_restart(client, respx_mock):
         assert blocked.status_code == 403
     finally:
         await viewer.aclose()
+
+
+@pytest.mark.asyncio
+async def test_unknown_service_is_rejected_without_calling_the_firewall(client, respx_mock):
+    _mock_vip(respx_mock)
+    h = await _create_host(client, "fw1", "https://fw1.test")
+    _mock_service_list(respx_mock)
+    start = respx_mock.post(url__regex=r".*/api/core/service/start/.*").respond(200, json={"result": "ok"})
+    r = await client.post(f"/api/hosts/{h['id']}/services/doesnotexist/start")
+    assert r.status_code == 404, r.text
+    assert r.json()["detail"]["code"] == "SERVICE_NOT_FOUND"
+    assert start.call_count == 0
+
+
+@pytest.mark.asyncio
+async def test_locked_service_cannot_be_controlled_via_api(client, respx_mock):
+    _mock_vip(respx_mock)
+    h = await _create_host(client, "fw1", "https://fw1.test")
+    _mock_service_list(respx_mock)
+    stop = respx_mock.post(url__regex=r".*/api/core/service/stop/.*").respond(200, json={"result": "ok"})
+    r = await client.post(f"/api/hosts/{h['id']}/services/pf/stop")
+    assert r.status_code == 409, r.text
+    assert r.json()["detail"]["code"] == "SERVICE_LOCKED"
+    assert stop.call_count == 0

backend/tests/test_snapshots.py

@@ -0,0 +1,69 @@
+"""ZFS snapshots: list, create, delete (never the active one)."""
+import httpx
+import pytest
+
+BASE = "https://10.20.30.80"
+
+
+async def _host(client, respx_mock, name="fw-snap"):
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    return (await client.post("/api/hosts", json={"name": name, "base_url": BASE, "api_key": "k", "api_secret": "s"})).json()["id"]
+
+
+def _snaps(respx_mock, rows):
+    respx_mock.get(f"{BASE}/api/core/snapshots/isSupported").mock(return_value=httpx.Response(200, json={"supported": True}))
+    return respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": rows}))
+
+
+ROW = {"uuid": "s1", "name": "default", "active": "NR", "mountpoint": "/", "size": "1.2G", "created_str": "2026-10-06 13:59"}
+
+
+@pytest.mark.asyncio
+async def test_list_snapshots(client, respx_mock):
+    host_id = await _host(client, respx_mock)
+    _snaps(respx_mock, [ROW])
+    body = (await client.get(f"/api/hosts/{host_id}/snapshots")).json()
+    assert body["supported"] is True and body["rows"][0]["name"] == "default" and body["rows"][0]["active"] == "NR"
+
+
+@pytest.mark.asyncio
+async def test_unsupported_firewall_is_reported(client, respx_mock):
+    host_id = await _host(client, respx_mock, "fw-nozfs")
+    respx_mock.get(f"{BASE}/api/core/snapshots/isSupported").mock(return_value=httpx.Response(200, json={"supported": False}))
+    assert (await client.get(f"/api/hosts/{host_id}/snapshots")).json() == {"supported": False, "rows": []}
+
+
+@pytest.mark.asyncio
+async def test_create_is_confirmed_by_listing_again(client, respx_mock):
+    host_id = await _host(client, respx_mock, "fw-snap2")
+    new = {"uuid": "s2", "name": "before_change", "active": "-", "mountpoint": "-", "size": "0", "created_str": "now"}
+    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": [ROW, new]}))
+    post = respx_mock.post(f"{BASE}/api/core/snapshots/add").mock(return_value=httpx.Response(200, json="OK"))
+    resp = await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "before_change", "note": "x"})
+    assert resp.status_code == 201, resp.text
+    assert resp.json()["uuid"] == "s2" and post.called
+
+
+@pytest.mark.asyncio
+async def test_create_rejects_bad_names_and_reports_a_snapshot_that_never_appeared(client, respx_mock):
+    host_id = await _host(client, respx_mock, "fw-snap3")
+    assert (await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "bad name!"})).status_code == 422
+    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": [ROW]}))
+    respx_mock.post(f"{BASE}/api/core/snapshots/add").mock(return_value=httpx.Response(200, json="OK"))
+    assert (await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "ghost"})).status_code == 502
+
+
+@pytest.mark.asyncio
+async def test_active_snapshot_cannot_be_deleted_others_can(client, respx_mock):
+    host_id = await _host(client, respx_mock, "fw-snap4")
+    old = {"uuid": "s3", "name": "old", "active": "-", "mountpoint": "-", "size": "1M", "created_str": "x"}
+    state = {"rows": [ROW, old]}
+    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(side_effect=lambda r: httpx.Response(200, json=state))
+    def drop(request):
+        state["rows"] = [ROW]
+        return httpx.Response(200, json={"status": "ok"})
+    delete = respx_mock.post(f"{BASE}/api/core/snapshots/del/s3").mock(side_effect=drop)
+    blocked = await client.delete(f"/api/hosts/{host_id}/snapshots/s1")
+    assert blocked.status_code == 409 and blocked.json()["detail"]["params"]["reasons"] == "snapshot_active"
+    assert (await client.delete(f"/api/hosts/{host_id}/snapshots/s3")).status_code == 204 and delete.called
+    assert (await client.delete(f"/api/hosts/{host_id}/snapshots/nope")).status_code == 404

backend/tests/test_wireguard_deploy_safety.py

@@ -6,6 +6,8 @@ denormalized `servers` field on the Peer payload) and to WireGuard's OWN
 reconfigure response shape ({"result": "ok"}, matching OpenVPN's shape,
 NOT IPsec's {"status": "ok"}), which this suite checks explicitly rather
 than assuming symmetry with either sibling feature."""
+import json
+
 import httpx
 import pytest
 from sqlalchemy import select
@@ -16,7 +18,15 @@ from tests.test_wireguard import _create_host, _tunnel_payload
 from tests.helpers import deploy_approved
 
 
-def _mock_full_success(respx_mock, base_url: str):
+def _mock_general(respx_mock, base_url: str, enabled: str = "1"):
+    # The service-wide switch (General.enabled) is checked before every deploy.
+    respx_mock.get(f"{base_url}/api/wireguard/general/get").mock(
+        return_value=httpx.Response(200, json={"general": {"enabled": enabled}})
+    )
+
+
+def _mock_full_success(respx_mock, base_url: str, general_enabled: str = "1"):
+    _mock_general(respx_mock, base_url, general_enabled)
     respx_mock.post(f"{base_url}/api/wireguard/server/addServer").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "server-1"})
     )
@@ -68,6 +78,7 @@ async def test_peer_payload_carries_injected_server_uuid(client, respx_mock):
     add_peer = respx_mock.post("https://fw1.test/api/wireguard/client/addClient").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "peer-1"})
     )
+    _mock_general(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/wireguard/service/reconfigure").mock(
         return_value=httpx.Response(200, json={"result": "ok"})
     )
@@ -134,6 +145,7 @@ async def test_deploy_reconfigure_failure_uses_exact_specified_message(client, r
     respx_mock.post("https://fw1.test/api/wireguard/client/addClient").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "peer-1"})
     )
+    _mock_general(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/wireguard/service/reconfigure").mock(
         side_effect=httpx.ConnectError("connection refused")
     )
@@ -173,6 +185,7 @@ async def test_reconfigure_checks_result_key_explicitly(client, respx_mock):
     respx_mock.post("https://fw1.test/api/wireguard/client/addClient").mock(
         return_value=httpx.Response(200, json={"result": "saved", "uuid": "peer-1"})
     )
+    _mock_general(respx_mock, "https://fw1.test")
     respx_mock.post("https://fw1.test/api/wireguard/service/reconfigure").mock(
         return_value=httpx.Response(200, json={"result": "failed"})
     )
@@ -282,3 +295,22 @@ async def test_secrets_never_persisted_and_rotation_is_not_a_no_op(client, respx
     assert add_server_route.call_count == 1, "unchanged from the first deploy — the rotation must go through setServer, not addServer"
     assert set_server_route.call_count == 1, "the rotated key must actually be re-pushed, not silently no-op'd"
     assert rotated_key.encode() in set_server_route.calls.last.request.content
+
+
+@pytest.mark.asyncio
+async def test_deploy_switches_on_the_global_wireguard_service_when_disabled(client, respx_mock):
+    """Live 26.7.5: with General.enabled=0 the config is written but no wg
+    interface exists, so the deploy must enable the switch first."""
+    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
+    host = await _create_host(client, "fw1", "https://fw1.test")
+    resp = await client.post("/api/wireguard/tunnels", json=_tunnel_payload([host["id"]]))
+    tunnel_id = resp.json()["id"]
+
+    _mock_full_success(respx_mock, "https://fw1.test", general_enabled="0")
+    set_route = respx_mock.post("https://fw1.test/api/wireguard/general/set").mock(
+        return_value=httpx.Response(200, json={"result": "saved"})
+    )
+    resp = await deploy_approved(client, f"/api/wireguard/tunnels/{tunnel_id}/deploy")
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["deployments"][0]["status"] == "success"
+    assert json.loads(set_route.calls.last.request.content) == {"general": {"enabled": "1"}}

docs/HANDBUCH.md

@@ -3023,6 +3023,159 @@ headless), inklusive Auth-Flow und Deploy-Sperrschutz:
 - Keine Konsolen-Fehler außer erwarteten 401/502 nach Logout bzw. gegen
   nicht erreichbare Test-Hosts.
 
+## Netzwerk, DNS und DHCP (2026-10-09)
+
+Neuer Bereich **Netzwerk** (`/network`). Je Firewall: Inventar und Änderungen für
+Schnittstellen, VLANs, virtuelle IPs, Gateways, statische Routen, DNS-Einträge
+(Unbound) und DHCP (dnsmasq-Hosts, Kea-Subnetze und -Reservierungen). Diese Objekte
+sind firewall-spezifisch (eigene IPs, eigenes VLAN-Layout), deshalb gibt es hier
+keine zentrale Kopie und keinen Multi-Host-Push: Die Firewall ist die Quelle der
+Wahrheit, jede Änderung geht direkt dorthin, aber nur über Vorschau und Ausführung.
+
+**Ablauf einer Änderung** (`services/network_change_service.py`):
+
+1. *Vorschau* (`POST /api/hosts/{id}/network/changes/preview`): liest den Live-Stand,
+   berechnet Diff, Risiken, Warnungen und Sperren, liefert einen Token über genau
+   diesen Stand.
+2. *Ausführen* (`POST /api/hosts/{id}/network/changes`): liest den Stand erneut und
+   verweigert bei abweichendem Token. Risikoreiche Änderungen brauchen
+   `acknowledge` (die UI verlangt zusätzlich die Eingabe des Firewall-Namens). Dann:
+   Konfig-Backup speichern (schlägt es fehl, wird nichts geändert), schreiben,
+   anwenden (`reconfigure`), zurücklesen und mit dem Gewünschten vergleichen. Jeder
+   Schritt landet im Audit-Log (`kind=network`: `started`, `applied`, `unverified`,
+   `apply_uncertain`, `rejected`, `aborted`).
+3. Nur Felder aus einer festen Liste je Objektart werden akzeptiert (`FIELDS`),
+   alles andere ergibt 422. Auswahllisten im Formular kommen von der Firewall
+   selbst (`GET …/network/template/{kind}`): OPNsense bietet z. B. für eine Route
+   nur die Gateways an, die es für gültig hält.
+
+**Schutz vor dem Kappen der eigenen Verbindung:** OPNexus ermittelt aus der
+Schnittstellenliste der Firewall, über welche Schnittstelle sie unter der
+hinterlegten Adresse erreichbar ist (`management_device`). Bestätigungspflichtig
+sind: Änderung oder Löschen dieser Schnittstelle, ihres VLANs oder ihres Gateways,
+Standard-Gateway ändern/löschen, eine Standardroute, eine Route, die die
+Firewall-Adresse abdeckt, und jede Änderung bestehender Objekte, wenn sich der
+Verbindungsweg nicht bestimmen lässt (NAT, CARP-Adresse). **Es gibt keinen
+automatischen Rollback** (anders als bei Regeln): OPNexus kann eine Änderung nicht
+zurücknehmen, die seine eigene Verbindung trennt. Der Rückweg ist das Backup vor
+der Änderung. DNS- und DHCP-Daten können die Verbindung nicht kappen und lösen
+diesen Schutz nicht aus.
+
+**Schnittstellen-Zuweisung** (`/interfaces/assignment/*`): zweistufig. `set`/`add`/`del`
+merken die Änderung nur vor (Datei auf der Firewall), erst `reconfigure` wendet sie
+an. Deshalb blockiert OPNexus eine neue Änderung, solange dort schon etwas
+vorgemerkt ist (`interface_changes_pending`), sonst würde das Anwenden fremde
+Änderungen mitnehmen. Beim Löschen entfernt OPNsense selbst alle Regeln und NAT-
+Einträge, die die Schnittstelle nutzen; die Vorschau listet sie. Gesperrte
+Schnittstellen (`lock`) lassen sich nicht löschen, das sagt die Vorschau vorab.
+Beschreibungen dürfen nur Buchstaben, Ziffern und Unterstriche enthalten.
+**Die API kann die IP-Konfiguration erst ab OPNsense 26.7.6**; auf 26.7.1 liefert
+die Zuweisungsliste nur Name und Gerät. OPNexus erkennt das an den Daten
+(`can_configure_interfaces`) und sperrt die Änderung mit Begründung.
+
+**Geheimnisse:** `vip_settings` liefert das CARP-Passwort im Klartext, Kea-Subnetze
+den DDNS-Schlüssel. Beides wird nie zurückgegeben, gespeichert oder auditiert: Das
+Inventar wählt Felder namentlich aus, der „Vorher“-Zustand wird auf die erlaubten
+Felder begrenzt, ein neues CARP-Passwort geht nur beim Ausführen an die Firewall.
+
+**Von der Firewall übernehmen** (`/rules` → „Von Firewall übernehmen“,
+`services/rule_adopt_service.py`): Regeln, die von Hand in OPNsense angelegt wurden,
+werden als verwaltete Regel mit der vorhandenen UUID erfasst. Die Übernahme liest
+die Regel frisch von der Firewall und schreibt nichts dorthin; erst die erste
+Änderung läuft durch den normalen Ablauf (Vorschau, Push, Bestätigung, Auto-Revert).
+Nicht übernommen werden Regeln, die das Modell verfälschen würde: invertierte
+Schnittstelle/Quelle/Ziel, mehrere oder keine Schnittstelle, „Empfangen auf“, keine
+Quick-Regel, Richtung weder ein noch aus, IPv4+IPv6 in einer Regel, fehlende
+Beschreibung, Systemregeln. Die Gründe zeigt die Oberfläche. Regeln haben jetzt ein
+Protokollieren-Flag (`log`, Migration 0003), weil jeder Push bisher fest `log=0`
+schrieb. Felder, die OPNexus nicht kennt (Gateway, Zustandsoptionen, Zeitpläne, …),
+bleiben unverändert, denn `setRule` überschreibt nur mitgesendete Felder (live
+bestätigt).
+
+**Verifikation 2026-10-09:** Endpunkte gegen die Core-Quellen geprüft und live auf
+drei Test-Firewalls (test-fw-1/-2 mit 26.7.6 als HA-Paar, test-fw-3 mit 26.7.1_1):
+je anlegen, ändern, löschen mit Backup, Apply und Rücklesen für VLAN, virtuelle IP,
+Gateway, Schnittstellen-Zuweisung inkl. IP, Unbound-Eintrag, dnsmasq-Host,
+Kea-Subnetz mit verschachtelten Optionen und Kea-Reservierung; Übernahme einer
+Handregel mit Gateway und `log=1`, danach Bearbeiten und Ausrollen ohne Verlust.
+Der Guard verweigerte das Löschen des Standard-Gateways und die Änderung der
+WAN-Schnittstelle ohne Bestätigung. Browser (1440 px und 375 px, keine
+Konsolenfehler, kein Overflow): Anlegen und Löschen von VLAN, Schnittstelle und
+DNS-Eintrag über die Oberfläche. Der Live-Test fand drei Fehler, die Mocks nicht
+zeigten (Gateway-`priority` als Zahl, Routen-Feld `enabled` statt `disabled`,
+Beschreibungsmuster der Schnittstelle), der Browser-Test einen weiteren (Dialog
+verschwand nach dem Neuladen). 534 Backend-Tests grün.
+
+**Weitere Verifikation (zweiter Durchlauf):** Der Bestätigungs-Pfad wurde live
+ausgeführt: Beschreibung der WAN-Schnittstelle mit Bestätigung geändert, und die
+WAN-IP von test-fw-2 auf eine freie Adresse im selben Netz gesetzt, womit OPNexus
+den Weg zur Firewall verliert (Ergebnis „angewendet, nicht prüfbar“, Audit
+`unverified`, Backup vorhanden). Wiederherstellung: neue Adresse unter Hosts ›
+Bearbeiten eintragen, WAN-IP über die Engine zurücksetzen, Adresse zurücksetzen.
+Außerdem: Routen-Lebenszyklus (aktivieren/deaktivieren), CARP-VIP auf dem HA-Paar
+(Backup zuerst, dann Master; Advskew ändern), Übernahme von Regeln mit Alias-Quelle,
+IPv6 und Block/Log, Ablehnung einer Regel mit invertierter Quelle, Auto-Revert einer
+unbestätigten Änderung an einer übernommenen Regel (Status `reverted`, ursprüngliche
+Beschreibung und `log=1` zurück), Übernahme auf beiden Knoten des HA-Paars,
+Kea-Reservierung samt Subnetz, Unbound-Eintrag mit echter DNS-Abfrage (NXDOMAIN →
+Antwort → NXDOMAIN). Browser: Anlegen, Bearbeiten und Löschen für VIP, Gateway, Route,
+dnsmasq-Host, Kea-Subnetz und -Reservierung, Übernahme per Dialog, Nur-Lesen-Rolle
+(alle Aktions-Buttons gesperrt), Englisch und Dark Mode ohne deutsche Reste,
+axe-core-Prüfung der sieben Netzwerkseiten. Die Migration 0003 lief auf einer Kopie
+der Prod-Datenbank (ohne Log-Tabelle): 0002 → 0003, bestehende Regeln `log=false`.
+Lesend gegen die Prod-Firewalls (26.7.5): Inventar und Erkennung der
+Verwaltungs-Schnittstelle (`vlan0110`) stimmen. **Nicht getestet:** die tatsächliche
+Vergabe von DHCP-Leases (Kea ist auf den Test-Firewalls deaktiviert).
+
+**Bekannte Grenzen:** Übernommene Regeln werden je Firewall einzeln übernommen. Wer
+eine übernommene Regel zusätzlich auf einen weiteren Host als Ziel setzt, legt dort
+eine zweite, doppelte Regel an (die Vorschau zeigt „create“). Keine Multi-Host-Vorlagen
+für Netzwerkobjekte, kein automatisches Rolling-Apply auf CARP-Paaren (nur das
+Übertragen auf den Partner per Klick), keine VXLAN-/GIF-Verwaltung, keine Kea-DDNS-Felder.
+
+### Erweiterung 1.13.0: Geräte, Host-System, Abgleich im Cluster
+
+Alles über dieselbe Engine (Vorschau, Backup, Anwenden, Zurücklesen, Audit, Guard):
+
+- **Netzwerk › Geräte:** LAGG, Bridge, Loopback und GRE. Ein LAGG oder eine Bridge, die
+  die Verwaltungs-Schnittstelle als Mitglied enthält, braucht die Bestätigung
+  (`management_member`). Beim Anlegen einer Bridge sind die Mitglieder Schnittstellen-
+  Kennungen (opt1, opt2), bei einem LAGG Gerätenamen.
+- **Gateways › Gateway-Gruppen**, **DNS › Weiterleitungen** (Unbound-Forwards) und
+  **DHCP › Bereiche** (dnsmasq).
+- **Host-System** (neue Gruppe): **Tunables** (jede Änderung braucht die Bestätigung; die
+  eingebauten Vorgaben lassen sich nicht bearbeiten, nur per „Überschreiben“ mit einem
+  eigenen Eintrag übersteuern), **Cron**, **Syslog** (entfernte Log-Ziele) und
+  **Snapshots** (ZFS: anlegen und löschen; das aktive Boot-Environment lässt sich nicht
+  löschen, das Aktivieren mit Neustart gibt es bewusst nicht). Snapshots haben eine
+  eigene, flache API und laufen deshalb über `services/snapshot_service.py`, nicht über
+  die Engine.
+- **Netzwerk › Abgleich:** vergleicht die Knoten jedes Clusters (Schnittstellen,
+  VLANs, VIPs, Gateways, Routen, DNS, DHCP). Adressen, CARP-Advskew/-Passwort und das
+  aktive Standard-Gateway sind pro Knoten verschieden und werden nicht verglichen; eine
+  Kategorie, die ein Knoten nicht liefern kann, wird übersprungen statt als Abweichung
+  gemeldet. Dazu ein neuer Alarm „Netzwerk-Abweichung im Cluster“
+  (`network_drift`, Einstellungen › Benachrichtigungen, Migration 0004), der sich nach
+  der Korrektur selbst auflöst und bei einem nicht erreichbaren Knoten offene Meldungen
+  stehen lässt.
+- **Auf den Partner übertragen:** Nach dem Anlegen eines Objekts auf einem Cluster-Knoten
+  bietet der Ergebnis-Schritt „Auf <Partner> übertragen“ an (Dialog mit denselben
+  Werten, mit eigener Vorschau, eigenem Backup und eigenem Guard). Empfohlene
+  Reihenfolge: zuerst der Backup-Knoten, dann der Master.
+- **Kopfzeile:** Bei acht Gruppen zeigt die Hauptnavigation die Namen ab 1150 px Breite,
+  darunter nur Icons mit Tooltip, damit Suche und Abmelden in einer Zeile bleiben.
+
+**Verifikation 1.13.0 (live auf test-fw-1/-2/-3):** je anlegen, ändern, in der Liste
+sehen und löschen mit Backup, Apply und Rücklesen für Tunable, Cron-Job, Syslog-Ziel,
+Gateway-Gruppe, Loopback, GRE, DNS-Forward und dnsmasq-Bereich auf test-fw-3, Bridge
+auf test-fw-1 (mit zwei dafür zugewiesenen, unbenutzten VLANs) und LAGG auf test-fw-3;
+Snapshots anlegen/löschen auf test-fw-1 und -3 (der aktive wird abgelehnt). Der Abgleich
+und sein Alarm wurden mit einem nur auf einem Knoten vorhandenen VLAN geprüft
+(Meldung geöffnet, nach dem Löschen aufgelöst). Browser: Übertragen auf den Partner,
+Abgleich vor und nach dem Angleichen, Überschreiben und Löschen eines Tunables,
+Snapshot anlegen/löschen, alle neuen Seiten in Deutsch und Englisch (Dark Mode),
+axe-core über die ganze App ohne Verstöße, Kopfzeile in einer Zeile ab 768 px.
+
 ## Definition of Done — Stand
 
 - [x] `docker compose up -d --build` startet DB, Backend, Frontend

frontend/app/globals.css

@@ -5,6 +5,12 @@
 /* Visible keyboard focus everywhere. Mouse clicks do not trigger :focus-visible, so this
    only shows for keyboard users. Inputs keep their own ring via the focus: utilities. */
 @layer base {
+  /* A scroll container must also be the containing block of absolutely
+     positioned content inside it. Otherwise the table header's `sr-only` span
+     (position:absolute, static position in the right-most column) escapes the
+     clip, widens the whole document and makes phones zoom the page out
+     (found live on /hosts and /users at 375px). */
+  .overflow-x-auto { position: relative; }
   :focus-visible {
     outline: 2px solid rgb(var(--focus-ring));
     outline-offset: 2px;

frontend/app/hosts/page.tsx

@@ -313,6 +313,7 @@ export default function HostsPage() {
 function EditHostModal({ host, hierarchyGroups, onClose, onSaved }: { host: Host; hierarchyGroups: PolicyHierarchyGroup[]; onClose: () => void; onSaved: () => void }) {
   const { t, errorMessage } = useLanguage();
   const [name, setName] = useState(host.name);
+  const [baseUrl, setBaseUrl] = useState(host.base_url);
   const [clusterName, setClusterName] = useState(host.cluster_name ?? "");
   const [hierarchyGroupId, setHierarchyGroupId] = useState(host.policy_hierarchy_group_id ?? "");
   const [pin, setPin] = useState<TlsPinValue>({ pem: null, insecure: !host.verify_tls, clear: false });
@@ -326,6 +327,7 @@ function EditHostModal({ host, hierarchyGroups, onClose, onSaved }: { host: Host
     setError(null);
     try {
       const payload: HostUpdate = { name, verify_tls: !pin.insecure, enabled };
+      if (baseUrl.trim() !== host.base_url) payload.base_url = baseUrl.trim();
       if (pin.pem) payload.tls_ca_pem = pin.pem;
       if (pin.clear) payload.clear_tls_pin = true;
       if (clusterName.trim()) {
@@ -353,6 +355,9 @@ function EditHostModal({ host, hierarchyGroups, onClose, onSaved }: { host: Host
         <FieldGroup label="Name">
           <Input required value={name} onChange={(e) => setName(e.target.value)} />
         </FieldGroup>
+        <FieldGroup label={t("hosts.baseUrl")} hint={t("hosts.baseUrlEditHint")}>
+          <Input required value={baseUrl} onChange={(e) => setBaseUrl(e.target.value)} placeholder="https://192.168.1.1" />
+        </FieldGroup>
         <FieldGroup label={t("hosts.clusterOptional")}>
           <Input
             value={clusterName}

frontend/app/hostsystem/[tab]/page.tsx

@@ -0,0 +1,228 @@
+"use client";
+
+import { useLanguage } from "@/components/LanguageProvider";
+import { NetworkChangeModal } from "@/components/NetworkChangeModal";
+import { NetworkObjectSection, ObjectChange } from "@/components/NetworkObjectSection";
+import { Button } from "@/components/ui/Button";
+import { Card } from "@/components/ui/Card";
+import { EmptyState } from "@/components/ui/EmptyState";
+import { FieldGroup, Input } from "@/components/ui/Field";
+import { Modal } from "@/components/ui/Modal";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { useToast } from "@/components/ui/Toast";
+import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
+import { api, Host, HostSnapshot, NetworkKind } from "@/lib/api";
+import { useReadOnly } from "@/lib/useReadOnly";
+import { HardDrive, Plus, Trash2 } from "lucide-react";
+import { useParams } from "next/navigation";
+import { useEffect, useState } from "react";
+
+const HOST_KEY = "opnexus-network-host"; // shared with the network pages: one firewall stays selected
+const KIND_BY_TAB: Record<string, NetworkKind> = { tunables: "tunable", cron: "cron_job", syslog: "syslog_destination" };
+
+/** Settings that live on the firewall itself: tunables, cron jobs, remote syslog targets and ZFS snapshots. */
+export default function HostSystemPage() {
+  const { t, errorMessage } = useLanguage();
+  const { tab } = useParams<{ tab: string }>();
+  const section = ["tunables", "cron", "syslog", "snapshots"].includes(tab) ? tab : "tunables";
+  const readOnly = useReadOnly();
+  const [hosts, setHosts] = useState<Host[] | null>(null);
+  const [hostId, setHostId] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [change, setChange] = useState<ObjectChange | null>(null);
+  const [reloadKey, setReloadKey] = useState(0);
+
+  useEffect(() => {
+    api
+      .listHosts()
+      .then((list) => {
+        setHosts(list);
+        let remembered = "";
+        try { remembered = sessionStorage.getItem(HOST_KEY) ?? ""; } catch { /* storage may be blocked */ }
+        setHostId(list.find((h) => h.id === remembered)?.id ?? list[0]?.id ?? "");
+      })
+      .catch((e) => setError(errorMessage(e, "network.loadFailed")));
+  }, [errorMessage]);
+
+  if (hosts && hosts.length === 0) {
+    return (
+      <div>
+        <h1 className="mb-6 text-2xl font-semibold text-slate-900">{t(`nav.items.hostsystem-${section}`)}</h1>
+        <EmptyState icon={HardDrive} title={t("drift.noHosts")} />
+      </div>
+    );
+  }
+  const host = hosts?.find((h) => h.id === hostId);
+  const kind = KIND_BY_TAB[section];
+
+  return (
+    <div>
+      <div className="mb-6 flex flex-wrap items-center justify-between gap-3">
+        <h1 className="text-2xl font-semibold text-slate-900">{t(`nav.items.hostsystem-${section}`)}</h1>
+        {hosts && (
+          <label className="flex items-center gap-2 text-sm text-slate-600">
+            {t("network.host")}
+            <select
+              value={hostId}
+              onChange={(e) => {
+                setHostId(e.target.value);
+                try { sessionStorage.setItem(HOST_KEY, e.target.value); } catch { /* ignore */ }
+              }}
+              className="rounded-lg border border-slate-300 bg-white px-3 py-1.5 text-sm"
+            >
+              {hosts.map((h) => (
+                <option key={h.id} value={h.id}>{h.name}</option>
+              ))}
+            </select>
+          </label>
+        )}
+      </div>
+      <p className="mb-4 text-sm text-slate-600">{t(`hostsystem.intro.${section}`)}</p>
+      {error && <p className="mb-4 text-sm text-red-600">{error}</p>}
+      {!hostId && !error && <Skeleton className="h-48 w-full" />}
+      {hostId && (
+        <Card className="overflow-x-auto">
+          {kind ? (
+            <NetworkObjectSection
+              hostId={hostId}
+              kind={kind}
+              title={t(`nav.items.hostsystem-${section}`)}
+              reloadKey={reloadKey}
+              readOnly={readOnly}
+              onChange={setChange}
+            />
+          ) : (
+            <Snapshots hostId={hostId} readOnly={readOnly} />
+          )}
+        </Card>
+      )}
+      {change && host && (
+        <NetworkChangeModal
+          key={`${hostId}:${change.kind}:${change.action}:${change.uuid ?? ""}`}
+          hostId={hostId}
+          hostName={host.name}
+          kind={change.kind}
+          action={change.action}
+          uuid={change.uuid}
+          preset={change.preset}
+          onClose={() => setChange(null)}
+          onDone={() => setReloadKey((k) => k + 1)}
+        />
+      )}
+    </div>
+  );
+}
+
+function Snapshots({ hostId, readOnly }: { hostId: string; readOnly: boolean }) {
+  const { t, errorMessage } = useLanguage();
+  const toast = useToast();
+  const [data, setData] = useState<{ supported: boolean; rows: HostSnapshot[] } | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [showCreate, setShowCreate] = useState(false);
+  const [name, setName] = useState("");
+  const [note, setNote] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [formError, setFormError] = useState<string | null>(null);
+
+  function load() {
+    setData(null);
+    api.listSnapshots(hostId).then(setData).catch((e) => setError(errorMessage(e, "network.loadFailed")));
+  }
+  useEffect(load, [hostId]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  async function create(e: React.FormEvent) {
+    e.preventDefault();
+    setBusy(true);
+    setFormError(null);
+    try {
+      await api.createSnapshot(hostId, name.trim(), note.trim());
+      toast.show(t("hostsystem.snapshots.created", { name: name.trim() }), "success");
+      setShowCreate(false);
+      setName("");
+      setNote("");
+      load();
+    } catch (err) {
+      setFormError(errorMessage(err, "hostsystem.snapshots.createFailed"));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function remove(row: HostSnapshot) {
+    if (!confirm(t("hostsystem.snapshots.deleteConfirm", { name: row.name }))) return;
+    try {
+      await api.deleteSnapshot(hostId, row.uuid);
+      toast.show(t("hostsystem.snapshots.deleted", { name: row.name }), "success");
+      load();
+    } catch (err) {
+      toast.show(errorMessage(err, "hostsystem.snapshots.deleteFailed"), "danger");
+    }
+  }
+
+  return (
+    <div>
+      <div className="flex items-center justify-between border-b border-slate-200 px-5 py-3">
+        <h2 className="text-sm font-semibold text-slate-700">{t("nav.items.hostsystem-snapshots")}</h2>
+        <Button variant="outline" disabled={readOnly || data?.supported === false} onClick={() => setShowCreate(true)}>
+          <Plus size={16} />
+          {t("hostsystem.snapshots.create")}
+        </Button>
+      </div>
+      {error && <p className="px-5 py-3 text-sm text-red-600">{error}</p>}
+      {!data && !error && <p className="px-5 py-4 text-sm text-slate-500">{t("common.loading")}</p>}
+      {data && !data.supported && <p className="px-5 py-4 text-sm text-slate-500">{t("hostsystem.snapshots.unsupported")}</p>}
+      {data && data.supported && (
+        <Table>
+          <THead>
+            <TRow>
+              <TH>{t("hostsystem.snapshots.name")}</TH>
+              <TH>{t("hostsystem.snapshots.state")}</TH>
+              <TH>{t("hostsystem.snapshots.size")}</TH>
+              <TH>{t("hostsystem.snapshots.createdAt")}</TH>
+              <TH><span className="sr-only">{t("common.actions")}</span></TH>
+            </TRow>
+          </THead>
+          <TBody>
+            {data.rows.map((row) => (
+              <TRow key={row.uuid}>
+                <TD className="font-mono text-xs">{row.name}</TD>
+                <TD>{row.active.includes("N") ? t("hostsystem.snapshots.activeNow") : row.active.includes("R") ? t("hostsystem.snapshots.activeNext") : "–"}</TD>
+                <TD>{row.size || "–"}</TD>
+                <TD>{row.created || "–"}</TD>
+                <TD>
+                  <fieldset disabled={readOnly} className="contents">
+                    <div className="flex justify-end">
+                      {(row.active === "-" || row.active === "") && (
+                        <Button variant="dangerSubtle" aria-label={t("network.rowDelete")} onClick={() => remove(row)}>
+                          <Trash2 size={14} />
+                        </Button>
+                      )}
+                    </div>
+                  </fieldset>
+                </TD>
+              </TRow>
+            ))}
+          </TBody>
+        </Table>
+      )}
+      {showCreate && (
+        <Modal title={t("hostsystem.snapshots.create")} onClose={() => setShowCreate(false)}>
+          <form onSubmit={create} className="space-y-4">
+            <p className="text-sm text-slate-600">{t("hostsystem.snapshots.createHint")}</p>
+            <FieldGroup label={t("hostsystem.snapshots.name")} hint={t("hostsystem.snapshots.nameHint")}>
+              <Input required value={name} onChange={(e) => setName(e.target.value)} pattern="[A-Za-z0-9][A-Za-z0-9._\-]{0,63}" autoComplete="off" />
+            </FieldGroup>
+            <FieldGroup label={t("hostsystem.snapshots.note")}>
+              <Input value={note} onChange={(e) => setNote(e.target.value)} maxLength={200} />
+            </FieldGroup>
+            {formError && <p role="alert" className="text-sm text-red-600">{formError}</p>}
+            <div className="flex justify-end gap-2">
+              <Button type="button" variant="ghost" onClick={() => setShowCreate(false)}>{t("common.cancel")}</Button>
+              <Button type="submit" disabled={busy} loading={busy}>{t("hostsystem.snapshots.create")}</Button>
+            </div>
+          </form>
+        </Modal>
+      )}
+    </div>
+  );
+}

frontend/app/ipsec/page.tsx

@@ -157,7 +157,7 @@ function IpsecContent() {
             <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
               <div>
                 <div className="flex flex-wrap items-center gap-2">
-                  <h3 className="font-medium text-slate-900">{tunnel.description}</h3>
+                  <h2 className="font-medium text-slate-900">{tunnel.description}</h2>
                   <WorkflowBadge state={tunnel.workflow_state} />
                   {!tunnel.pre_shared_key_set && (
                     <Badge tone="warning">

frontend/app/network/[tab]/page.tsx

@@ -0,0 +1,571 @@
+"use client";
+
+import { useLanguage } from "@/components/LanguageProvider";
+import { Badge, BadgeTone } from "@/components/ui/Badge";
+import { Card } from "@/components/ui/Card";
+import { EmptyState } from "@/components/ui/EmptyState";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
+import { NetworkChangeModal } from "@/components/NetworkChangeModal";
+import { NetworkCompare } from "@/components/NetworkCompare";
+import { NetworkObjectSection } from "@/components/NetworkObjectSection";
+import { Button } from "@/components/ui/Button";
+import { api, Host, HostNetwork, NetworkAction, NetworkKind } from "@/lib/api";
+import { useReadOnly } from "@/lib/useReadOnly";
+import { AlertTriangle, Cable, Pencil, Plus, Trash2 } from "lucide-react";
+import { useParams } from "next/navigation";
+import { useEffect, useRef, useState } from "react";
+
+type Section = "interfaces" | "vlans" | "vips" | "gateways" | "routes" | "dns" | "dhcp" | "devices" | "compare";
+// hostId/hostName are set when the dialog targets another node than the one on screen (transfer to a cluster partner).
+type Change = { kind: NetworkKind; action: NetworkAction; uuid?: string; preset?: Record<string, string>; hostId?: string; hostName?: string };
+type OpenChange = (change: Change) => void;
+
+const HOST_KEY = "opnexus-network-host";
+
+// Extra generic object lists shown below the main table of a page (and the whole "devices" page).
+const EXTRA_SECTIONS: Partial<Record<Section, { kind: NetworkKind; titleKey: string }[]>> = {
+  gateways: [{ kind: "gateway_group", titleKey: "network.kinds.gateway_group" }],
+  dns: [{ kind: "dns_forward", titleKey: "network.kinds.dns_forward" }],
+  dhcp: [{ kind: "dhcp_range", titleKey: "network.kinds.dhcp_range" }],
+  devices: [
+    { kind: "lagg", titleKey: "network.kinds.lagg" },
+    { kind: "bridge", titleKey: "network.kinds.bridge" },
+    { kind: "loopback", titleKey: "network.kinds.loopback" },
+    { kind: "gre", titleKey: "network.kinds.gre" },
+  ],
+};
+
+const SECTION_KIND: Partial<Record<Section, NetworkKind>> = { interfaces: "interface", vlans: "vlan", vips: "vip", gateways: "gateway", routes: "route", dns: "dns_host" };
+
+function statusTone(status: string): BadgeTone {
+  const s = status.toLowerCase();
+  if (s === "up" || s === "online") return "success";
+  if (s === "down" || s === "offline") return "danger";
+  return "neutral";
+}
+
+export default function NetworkPage() {
+  const { t, errorMessage } = useLanguage();
+  const [hosts, setHosts] = useState<Host[] | null>(null);
+  const [hostId, setHostId] = useState<string>("");
+  const [network, setNetwork] = useState<HostNetwork | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  // The sub-navigation in the header picks the section; the path is the single source of truth.
+  const { tab } = useParams<{ tab: string }>();
+  const section: Section = (["interfaces", "vlans", "vips", "gateways", "routes", "dns", "dhcp", "devices", "compare"].includes(tab) ? tab : "interfaces") as Section;
+  const [change, setChange] = useState<Change | null>(null);
+  const readOnly = useReadOnly();
+  const [reloadKey, setReloadKey] = useState(0);
+  const shownHost = useRef("");
+
+  useEffect(() => {
+    api
+      .listHosts()
+      .then((list) => {
+        setHosts(list);
+        // The chosen firewall survives switching between the sub-pages.
+        let remembered = "";
+        try { remembered = sessionStorage.getItem(HOST_KEY) ?? ""; } catch { /* storage may be blocked */ }
+        setHostId(list.find((h) => h.id === remembered)?.id ?? list[0]?.id ?? "");
+      })
+      .catch((e) => setError(errorMessage(e, "network.loadFailed")));
+  }, [errorMessage]);
+
+  useEffect(() => {
+    if (!hostId || section === "compare") return;
+    let cancelled = false;
+    setError(null);
+    // Switching host clears the view; a reload after a change keeps it so an open dialog is not torn down.
+    if (shownHost.current !== hostId) {
+      setNetwork(null);
+      shownHost.current = hostId;
+    }
+    api
+      .getHostNetwork(hostId)
+      .then((data) => !cancelled && setNetwork(data))
+      .catch((e) => !cancelled && setError(errorMessage(e, "network.loadFailed")))
+    return () => {
+      cancelled = true;
+    };
+  }, [hostId, errorMessage, reloadKey, section]);
+
+  if (section === "compare") {
+    return (
+      <div>
+        <h1 className="mb-6 text-2xl font-semibold text-slate-900">{t("nav.items.network-compare")}</h1>
+        <NetworkCompare />
+      </div>
+    );
+  }
+
+  const modalHostId = change?.hostId ?? hostId;
+  const modalHost = hosts?.find((h) => h.id === modalHostId);
+  const current = hosts?.find((h) => h.id === modalHostId);
+  const peers = current?.cluster_name
+    ? (hosts ?? []).filter((h) => h.cluster_name === current.cluster_name && h.id !== current.id).map((h) => ({ id: h.id, name: h.name }))
+    : [];
+
+  if (hosts && hosts.length === 0) {
+    return (
+      <div>
+        <h1 className="mb-6 text-2xl font-semibold text-slate-900">{t(`nav.items.network-${section}`)}</h1>
+        <EmptyState icon={Cable} title={t("drift.noHosts")} />
+      </div>
+    );
+  }
+
+  return (
+    <div>
+      <div className="mb-6 flex flex-wrap items-center justify-between gap-3">
+        <h1 className="text-2xl font-semibold text-slate-900">{t(`nav.items.network-${section}`)}</h1>
+        {hosts && (
+          <label className="flex items-center gap-2 text-sm text-slate-600">
+            {t("network.host")}
+            <select
+              value={hostId}
+              onChange={(e) => {
+                setHostId(e.target.value);
+                try { sessionStorage.setItem(HOST_KEY, e.target.value); } catch { /* ignore */ }
+              }}
+              className="rounded-lg border border-slate-300 bg-white px-3 py-1.5 text-sm"
+            >
+              {hosts.map((h) => (
+                <option key={h.id} value={h.id}>
+                  {h.name}
+                </option>
+              ))}
+            </select>
+          </label>
+        )}
+      </div>
+
+      {error && <p className="mb-4 text-sm text-red-600">{error}</p>}
+      {!network && !error && <Skeleton className="h-64 w-full" />}
+
+      {network && (
+        <>
+          <Notices network={network} />
+          {SECTION_KIND[section] && (section !== "interfaces" || network.can_configure_interfaces) && (
+            <fieldset disabled={readOnly} className="contents">
+              <div className="mb-3 flex justify-end">
+                <Button variant="outline" onClick={() => setChange({ kind: SECTION_KIND[section]!, action: "add" })}>
+                  <Plus size={16} />
+                  {t("network.rowAdd")}
+                </Button>
+              </div>
+            </fieldset>
+          )}
+          <Card className="overflow-x-auto">
+            <fieldset disabled={readOnly} className="contents">
+              {section === "interfaces" && <InterfacesTable network={network} onChange={setChange} />}
+              {section === "vlans" && <VlansTable network={network} onChange={setChange} />}
+              {section === "vips" && <VipsTable network={network} onChange={setChange} />}
+              {section === "gateways" && <GatewaysTable network={network} onChange={setChange} />}
+              {section === "routes" && <RoutesTable network={network} onChange={setChange} />}
+              {section === "dns" && <DnsTable network={network} onChange={setChange} />}
+              {section === "dhcp" && <DhcpSections network={network} onChange={setChange} />}
+            </fieldset>
+            {(EXTRA_SECTIONS[section] ?? []).map((extra) => (
+              <NetworkObjectSection
+                key={extra.kind}
+                hostId={hostId}
+                kind={extra.kind}
+                title={t(extra.titleKey)}
+                reloadKey={reloadKey}
+                readOnly={readOnly}
+                onChange={setChange}
+              />
+            ))}
+          </Card>
+        </>
+      )}
+      {change && (
+        <NetworkChangeModal
+          key={`${modalHostId}:${change.kind}:${change.action}:${change.uuid ?? ""}`}
+          hostId={modalHostId}
+          hostName={modalHost?.name ?? ""}
+          peers={peers}
+          onTransfer={(peer, fields) =>
+            setChange({ kind: change.kind, action: "add", preset: fields, hostId: peer.id, hostName: peer.name })
+          }
+          kind={change.kind}
+          action={change.action}
+          uuid={change.uuid}
+          preset={change.preset}
+          onClose={() => setChange(null)}
+          onDone={() => setReloadKey((k) => k + 1)}
+        />
+      )}
+    </div>
+  );
+}
+
+function Notices({ network }: { network: HostNetwork }) {
+  const { t } = useLanguage();
+  return (
+    <div className="mb-4 space-y-2">
+      {network.management_device ? (
+        <p className="flex items-start gap-2 text-sm text-slate-600">
+          <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-amber-600" aria-hidden />
+          <span>{t("network.managementNote", { device: network.management_device })}</span>
+        </p>
+      ) : (
+        <p className="text-sm text-slate-500">{t("network.managementUnknown")}</p>
+      )}
+      {network.unavailable.length > 0 && (
+        <p className="text-sm text-amber-700">
+          {t("network.unavailable", { sections: network.unavailable.map((s) => t(`network.sections.${s}`)).join(", ") })}
+        </p>
+      )}
+      {!network.can_configure_interfaces && (
+        <p className="text-sm text-slate-500">{t("network.cannotConfigure")}</p>
+      )}
+    </div>
+  );
+}
+
+function RowActions({ kind, uuid, onChange }: { kind: NetworkKind; uuid: string; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  return (
+    <div className="flex justify-end gap-1">
+      <Button variant="ghost" aria-label={t("network.rowEdit")} onClick={() => onChange({ kind, action: "set", uuid })}>
+        <Pencil size={14} />
+      </Button>
+      <Button variant="dangerSubtle" aria-label={t("network.rowDelete")} onClick={() => onChange({ kind, action: "del", uuid })}>
+        <Trash2 size={14} />
+      </Button>
+    </div>
+  );
+}
+
+function Empty({ text }: { text: string }) {
+  return <p className="px-5 py-6 text-sm text-slate-500">{text}</p>;
+}
+
+function InterfacesTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.interfaces.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.col.device")}</TH>
+          <TH>{t("network.col.name")}</TH>
+          <TH>{t("network.col.status")}</TH>
+          <TH>{t("network.col.addresses")}</TH>
+          <TH>{t("network.col.type")}</TH>
+          <TH>{t("network.col.vlan")}</TH>
+          {network.can_configure_interfaces && <TH><span className="sr-only">{t("common.actions")}</span></TH>}
+        </TRow>
+      </THead>
+      <TBody>
+        {network.interfaces.map((i) => (
+          <TRow key={i.device}>
+            <TD className="font-mono">
+              {i.device}
+              {i.is_management && (
+                <Badge tone="warning" className="ml-2">
+                  {t("network.management")}
+                </Badge>
+              )}
+            </TD>
+            <TD>
+              {i.identifier ? `${i.description || i.identifier} (${i.identifier})` : <span className="text-slate-400">{t("network.unassigned")}</span>}
+            </TD>
+            <TD>
+              <Badge tone={statusTone(i.status)}>{i.status}</Badge>
+            </TD>
+            <TD className="font-mono text-xs">
+              {i.addresses.length === 0 ? "–" : i.addresses.map((a) => (
+                <div key={a.address + (a.vhid ?? "")}>
+                  {a.address}
+                  {a.vhid && (
+                    <span className="ml-2 text-slate-500">
+                      CARP vhid {a.vhid}{a.carp_status ? ` · ${a.carp_status}` : ""}
+                    </span>
+                  )}
+                </div>
+              ))}
+            </TD>
+            <TD>{[i.ipv4_type, i.ipv6_type].filter(Boolean).join(" / ") || "–"}</TD>
+            <TD>{i.vlan_tag ? `${i.vlan_tag} (${i.vlan_parent ?? "?"})` : "–"}</TD>
+            {network.can_configure_interfaces && (
+              <TD>{i.assigned && i.identifier ? <RowActions kind="interface" uuid={i.identifier} onChange={onChange} /> : null}</TD>
+            )}
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function VlansTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.vlans.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.col.device")}</TH>
+          <TH>{t("network.col.parent")}</TH>
+          <TH>{t("network.col.tag")}</TH>
+          <TH>{t("network.col.pcp")}</TH>
+          <TH>{t("common.description")}</TH>
+          <TH><span className="sr-only">{t("common.actions")}</span></TH>
+        </TRow>
+      </THead>
+      <TBody>
+        {network.vlans.map((v) => (
+          <TRow key={v.uuid}>
+            <TD className="font-mono">{v.device ?? "–"}</TD>
+            <TD className="font-mono">{v.parent}</TD>
+            <TD>{v.tag}</TD>
+            <TD>{v.pcp ?? "–"}</TD>
+            <TD>{v.description || "–"}</TD>
+            <TD><RowActions kind="vlan" uuid={v.uuid} onChange={onChange} /></TD>
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function VipsTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.vips.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.col.address")}</TH>
+          <TH>{t("network.col.interface")}</TH>
+          <TH>{t("network.col.mode")}</TH>
+          <TH>VHID</TH>
+          <TH>{t("network.col.advskew")}</TH>
+          <TH>{t("common.description")}</TH>
+          <TH><span className="sr-only">{t("common.actions")}</span></TH>
+        </TRow>
+      </THead>
+      <TBody>
+        {network.vips.map((v) => (
+          <TRow key={v.uuid}>
+            <TD className="font-mono">{v.address}</TD>
+            <TD>{v.interface_label}</TD>
+            <TD>{v.mode.toUpperCase()}</TD>
+            <TD>{v.vhid ?? "–"}</TD>
+            <TD>{v.advskew ?? "–"}</TD>
+            <TD>{v.description || "–"}</TD>
+            <TD><RowActions kind="vip" uuid={v.uuid} onChange={onChange} /></TD>
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function GatewaysTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.gateways.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.col.name")}</TH>
+          <TH>{t("network.col.interface")}</TH>
+          <TH>{t("network.col.address")}</TH>
+          <TH>{t("network.col.priority")}</TH>
+          <TH>{t("network.col.status")}</TH>
+          <TH><span className="sr-only">{t("common.actions")}</span></TH>
+        </TRow>
+      </THead>
+      <TBody>
+        {network.gateways.map((g) => (
+          <TRow key={g.uuid}>
+            <TD>
+              {g.name}
+              {g.is_default && (
+                <Badge tone="info" className="ml-2">
+                  {t("network.default")}
+                </Badge>
+              )}
+              {g.disabled && (
+                <Badge tone="neutral" className="ml-2">
+                  {t("common.statusDisabled")}
+                </Badge>
+              )}
+            </TD>
+            <TD>{g.interface_label}</TD>
+            <TD className="font-mono">{g.address || "–"}</TD>
+            <TD>{g.priority ?? "–"}</TD>
+            <TD>
+              <Badge tone={statusTone(g.status)}>{g.status || "–"}</Badge>
+            </TD>
+            <TD><RowActions kind="gateway" uuid={g.uuid} onChange={onChange} /></TD>
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function RoutesTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.routes.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.col.network")}</TH>
+          <TH>{t("network.col.gateway")}</TH>
+          <TH>{t("common.description")}</TH>
+          <TH>{t("network.col.status")}</TH>
+          <TH><span className="sr-only">{t("common.actions")}</span></TH>
+        </TRow>
+      </THead>
+      <TBody>
+        {network.routes.map((r) => (
+          <TRow key={r.uuid}>
+            <TD className="font-mono">{r.network}</TD>
+            <TD>{r.gateway}</TD>
+            <TD>{r.description || "–"}</TD>
+            <TD>
+              <Badge tone={r.disabled ? "neutral" : "success"}>{r.disabled ? t("common.statusDisabled") : t("network.active")}</Badge>
+            </TD>
+            <TD><RowActions kind="route" uuid={r.uuid} onChange={onChange} /></TD>
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function DnsTable({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  if (network.dns_hosts.length === 0) return <Empty text={t("network.empty")} />;
+  return (
+    <Table>
+      <THead>
+        <TRow>
+          <TH>{t("network.field.hostname")}</TH>
+          <TH>{t("network.field.domain")}</TH>
+          <TH>{t("network.field.rr")}</TH>
+          <TH>{t("network.field.server")}</TH>
+          <TH>{t("common.description")}</TH>
+          <TH><span className="sr-only">{t("common.actions")}</span></TH>
+        </TRow>
+      </THead>
+      <TBody>
+        {network.dns_hosts.map((d) => (
+          <TRow key={d.uuid}>
+            <TD>
+              {d.hostname}
+              {!d.enabled && <Badge tone="neutral" className="ml-2">{t("common.statusDisabled")}</Badge>}
+            </TD>
+            <TD>{d.domain}</TD>
+            <TD>{d.record_type}</TD>
+            <TD className="font-mono">{d.server || "–"}</TD>
+            <TD>{d.description || "–"}</TD>
+            <TD><RowActions kind="dns_host" uuid={d.uuid} onChange={onChange} /></TD>
+          </TRow>
+        ))}
+      </TBody>
+    </Table>
+  );
+}
+
+function SubHeader({ title, kind, onChange }: { title: string; kind: NetworkKind; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  return (
+    <div className="flex items-center justify-between border-b border-slate-200 px-5 py-3">
+      <h2 className="text-sm font-semibold text-slate-700">{title}</h2>
+      <Button variant="outline" onClick={() => onChange({ kind, action: "add" })}>
+        <Plus size={16} />
+        {t("network.rowAdd")}
+      </Button>
+    </div>
+  );
+}
+
+function DhcpSections({ network, onChange }: { network: HostNetwork; onChange: OpenChange }) {
+  const { t } = useLanguage();
+  return (
+    <div>
+      <SubHeader title={t("network.dhcp.dnsmasq")} kind="dhcp_host" onChange={onChange} />
+      {network.dhcp_hosts.length === 0 ? <Empty text={t("network.empty")} /> : (
+        <Table>
+          <THead>
+            <TRow>
+              <TH>{t("network.field.host")}</TH>
+              <TH>{t("network.field.ip")}</TH>
+              <TH>{t("network.field.hwaddr")}</TH>
+              <TH>{t("common.description")}</TH>
+              <TH><span className="sr-only">{t("common.actions")}</span></TH>
+            </TRow>
+          </THead>
+          <TBody>
+            {network.dhcp_hosts.map((h) => (
+              <TRow key={h.uuid}>
+                <TD>{h.host}{h.domain ? `.${h.domain}` : ""}</TD>
+                <TD className="font-mono">{h.ip || "–"}</TD>
+                <TD className="font-mono text-xs">{h.hwaddr || "–"}</TD>
+                <TD>{h.description || "–"}</TD>
+                <TD><RowActions kind="dhcp_host" uuid={h.uuid} onChange={onChange} /></TD>
+              </TRow>
+            ))}
+          </TBody>
+        </Table>
+      )}
+      <SubHeader title={t("network.dhcp.keaSubnets")} kind="kea_subnet" onChange={onChange} />
+      {network.kea_subnets.length === 0 ? <Empty text={t("network.empty")} /> : (
+        <Table>
+          <THead>
+            <TRow>
+              <TH>{t("network.field.subnet")}</TH>
+              <TH>{t("network.field.pools")}</TH>
+              <TH>{t("network.field.option_data.routers")}</TH>
+              <TH>{t("common.description")}</TH>
+              <TH><span className="sr-only">{t("common.actions")}</span></TH>
+            </TRow>
+          </THead>
+          <TBody>
+            {network.kea_subnets.map((s) => (
+              <TRow key={s.uuid}>
+                <TD className="font-mono">{s.subnet}</TD>
+                <TD className="font-mono text-xs">{s.pools || "–"}</TD>
+                <TD className="font-mono">{s.routers || "–"}</TD>
+                <TD>{s.description || "–"}</TD>
+                <TD><RowActions kind="kea_subnet" uuid={s.uuid} onChange={onChange} /></TD>
+              </TRow>
+            ))}
+          </TBody>
+        </Table>
+      )}
+      <SubHeader title={t("network.dhcp.keaReservations")} kind="kea_reservation" onChange={onChange} />
+      {network.kea_reservations.length === 0 ? <Empty text={t("network.empty")} /> : (
+        <Table>
+          <THead>
+            <TRow>
+              <TH>{t("network.field.ip_address")}</TH>
+              <TH>{t("network.field.hw_address")}</TH>
+              <TH>{t("network.field.hostname")}</TH>
+              <TH>{t("network.field.subnet")}</TH>
+              <TH><span className="sr-only">{t("common.actions")}</span></TH>
+            </TRow>
+          </THead>
+          <TBody>
+            {network.kea_reservations.map((r) => (
+              <TRow key={r.uuid}>
+                <TD className="font-mono">{r.ip_address}</TD>
+                <TD className="font-mono text-xs">{r.hw_address || "–"}</TD>
+                <TD>{r.hostname || "–"}</TD>
+                <TD className="font-mono">{r.subnet}</TD>
+                <TD><RowActions kind="kea_reservation" uuid={r.uuid} onChange={onChange} /></TD>
+              </TRow>
+            ))}
+          </TBody>
+        </Table>
+      )}
+    </div>
+  );
+}

frontend/app/network/page.tsx

@@ -0,0 +1,5 @@
+import { redirect } from "next/navigation";
+
+export default function NetworkIndex() {
+  redirect("/network/interfaces");
+}

frontend/app/openvpn/page.tsx

@@ -197,7 +197,7 @@ function OpenVpnContent() {
             <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
               <div>
                 <div className="flex flex-wrap items-center gap-2">
-                  <h3 className="font-medium text-slate-900">{instance.description}</h3>
+                  <h2 className="font-medium text-slate-900">{instance.description}</h2>
                   <WorkflowBadge state={instance.workflow_state} />
                   {instance.tls_key_enabled && !instance.tls_key_material_set && (
                     <Badge tone="warning">
@@ -367,7 +367,7 @@ function OpenVpnContent() {
                             ) : (
                               <Select required value={form.cert_refs[hostId] ?? ""} onChange={(e) => setCertRef(hostId, e.target.value)}>
                                 <option value="" disabled>{t("ovpn.pleaseChoose")}</option>
-                                {store.certs.map((c) => <option key={c.uuid} value={c.uuid}>{c.descr}{c.common_name ? ` (${c.common_name})` : ""}</option>)}
+                                {store.certs.map((c) => <option key={c.uuid} value={c.refid}>{c.descr}{c.common_name ? ` (${c.common_name})` : ""}</option>)}
                               </Select>
                             )}
                           </FieldGroup>
@@ -377,7 +377,7 @@ function OpenVpnContent() {
                             ) : (
                               <Select required value={form.ca_refs[hostId] ?? ""} onChange={(e) => setCaRef(hostId, e.target.value)}>
                                 <option value="" disabled>{t("ovpn.pleaseChoose")}</option>
-                                {store.cas.map((c) => <option key={c.uuid} value={c.uuid}>{c.descr}{c.common_name ? ` (${c.common_name})` : ""}</option>)}
+                                {store.cas.map((c) => <option key={c.uuid} value={c.refid}>{c.descr}{c.common_name ? ` (${c.common_name})` : ""}</option>)}
                               </Select>
                             )}
                           </FieldGroup>

frontend/app/rules/page.tsx

@@ -14,6 +14,7 @@ import { Modal } from "@/components/ui/Modal";
 import { Tabs } from "@/components/ui/Tabs";
 import { useToast } from "@/components/ui/Toast";
 import { LiveRulesDrift } from "@/components/LiveRulesDrift";
+import { AdoptRulesModal } from "@/components/AdoptRulesModal";
 import { useReadOnly } from "@/lib/useReadOnly";
 import {
   api,
@@ -32,6 +33,7 @@ import {
   AlertTriangle,
   CheckCircle2,
   Clock,
+  Download,
   Plus,
   Pencil,
   History,
@@ -105,6 +107,7 @@ const emptyForm: RuleCreate = {
   destination_net: "any",
   destination_port: null,
   enabled: true,
+  log: false,
   target_host_ids: [],
   target_group_ids: [],
 };
@@ -128,6 +131,7 @@ function RulesContent() {
   const [hosts, setHosts] = useState<Host[]>([]);
   const [error, setError] = useState<string | null>(null);
   const [showModal, setShowModal] = useState(false);
+  const [showAdopt, setShowAdopt] = useState(false);
   const [form, setForm] = useState<RuleCreate>(emptyForm);
   const [saving, setSaving] = useState(false);
   const [formError, setFormError] = useState<string | null>(null);
@@ -395,10 +399,16 @@ function RulesContent() {
       <div className="mb-6 flex flex-wrap items-center justify-between gap-3">
         <h1 className="text-2xl font-semibold text-slate-900 flex items-center gap-2">{selectedGroup ? t("rules.groupTitle", { name: selectedGroup.name }) : t("rules.title")}<InfoTip text={t("rules.subtitle")} size={18} /></h1>
         {activeTab === "managed" && (
-          <Button onClick={() => openEditor(null)} disabled={readOnly}>
-            <Plus size={16} />
-            {t("rules.new")}
-          </Button>
+          <div className="flex flex-wrap gap-2">
+            <Button variant="outline" onClick={() => setShowAdopt(true)} disabled={readOnly}>
+              <Download size={16} />
+              {t("rules.adopt.button")}
+            </Button>
+            <Button onClick={() => openEditor(null)} disabled={readOnly}>
+              <Plus size={16} />
+              {t("rules.new")}
+            </Button>
+          </div>
         )}
       </div>
 
@@ -504,6 +514,7 @@ function RulesContent() {
       )}
 
       <fieldset disabled={readOnly} className="contents">
+      {showAdopt && <AdoptRulesModal hosts={hosts} onClose={() => setShowAdopt(false)} onAdopted={load} />}
       {review && <RuleReview rule={review.rule} mode={review.mode} onClose={() => setReview(null)} onDeployed={() => { setReview(null); load(); }} onChanged={load} onRestore={snapshot => openEditor(review.rule, false, snapshot)} />}
       {showModal && (
         <Modal title={editing ? t("rules.editDraft") : t("rules.new")} onClose={() => setShowModal(false)}>
@@ -629,7 +640,10 @@ function RulesContent() {
 
             <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
               <FieldGroup label={t("nat.ipVersion")}><Select value={form.ipprotocol} onChange={e => setForm({ ...form, ipprotocol: e.target.value })}><option value="inet">IPv4</option><option value="inet6">IPv6</option></Select></FieldGroup>
-              <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={form.enabled} onChange={e => setForm({ ...form, enabled: e.target.checked })} />{t("rules.active")}</label>
+              <div className="space-y-2">
+                <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={form.enabled} onChange={e => setForm({ ...form, enabled: e.target.checked })} />{t("rules.active")}</label>
+                <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={!!form.log} onChange={e => setForm({ ...form, log: e.target.checked })} />{t("rules.logPackets")}</label>
+              </div>
             </div>
             <FieldGroup label={t("rules.deviceGroups")}>
               <div className="space-y-2 rounded-lg border border-slate-200 p-3">

frontend/app/settings/page.tsx

@@ -42,6 +42,7 @@ function NotificationsSection() {
   const [maintenanceUnknown, setMaintenanceUnknown] = useState(true);
   const [carpHealth, setCarpHealth] = useState(true);
   const [natDrift, setNatDrift] = useState(true);
+  const [networkDrift, setNetworkDrift] = useState(true);
   const [carpAutoRevertFailed, setCarpAutoRevertFailed] = useState(true);
   const [pollInterval, setPollInterval] = useState(300);
 
@@ -63,6 +64,7 @@ function NotificationsSection() {
     setMaintenanceUnknown(data.maintenance_unknown_enabled);
     setCarpHealth(data.carp_health_enabled);
     setNatDrift(data.nat_drift_enabled);
+    setNetworkDrift(data.network_drift_enabled);
     setCarpAutoRevertFailed(data.carp_auto_revert_failed_enabled);
     setPollInterval(data.poll_interval_seconds);
     setWebhookSecret("");
@@ -102,6 +104,7 @@ function NotificationsSection() {
         maintenance_unknown_enabled: maintenanceUnknown,
         carp_health_enabled: carpHealth,
         nat_drift_enabled: natDrift,
+        network_drift_enabled: networkDrift,
         carp_auto_revert_failed_enabled: carpAutoRevertFailed,
         poll_interval_seconds: pollInterval,
       });
@@ -232,6 +235,7 @@ function NotificationsSection() {
             [t("settings.notify.event.maintenanceUnknown"), maintenanceUnknown, setMaintenanceUnknown],
             [t("settings.notify.event.carpHealth"), carpHealth, setCarpHealth],
             [t("settings.notify.event.natDrift"), natDrift, setNatDrift],
+            [t("settings.notify.event.networkDrift"), networkDrift, setNetworkDrift],
             [t("settings.notify.event.carpAutoRevertFailed"), carpAutoRevertFailed, setCarpAutoRevertFailed],
           ].map(([label, value, setter]) => (
             <label key={label as string} className="flex items-center gap-2 text-sm">

frontend/app/updates/page.tsx

@@ -309,7 +309,7 @@ export default function UpdatesPage() {
     setPageError(null);
     try {
       const progress = await api.hostUpdateProgress(host.id);
-      setLog({ host, text: progress.log || progress.status });
+      setLog({ host, text: progress.log || t("updates.logEmpty") });
     } catch (error) {
       setPageError(errorMessage(error, "updates.logFailed"));
     } finally {

frontend/app/wireguard/page.tsx

@@ -160,7 +160,7 @@ function WireguardContent() {
             <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
               <div>
                 <div className="flex flex-wrap items-center gap-2">
-                  <h3 className="font-medium text-slate-900">{tunnel.server_name} → {tunnel.peer_name}</h3>
+                  <h2 className="font-medium text-slate-900">{tunnel.server_name} → {tunnel.peer_name}</h2>
                   <WorkflowBadge state={tunnel.workflow_state} />
                   {!tunnel.server_private_key_set && (
                     <Badge tone="warning">

frontend/components/AdoptRulesModal.tsx

@@ -0,0 +1,128 @@
+"use client";
+
+import { Badge } from "@/components/ui/Badge";
+import { Button } from "@/components/ui/Button";
+import { Modal } from "@/components/ui/Modal";
+import { useToast } from "@/components/ui/Toast";
+import { useLanguage } from "@/components/LanguageProvider";
+import { api, Host, UnmanagedRule } from "@/lib/api";
+import { useEffect, useState } from "react";
+
+interface Props {
+  hosts: Host[];
+  onClose: () => void;
+  onAdopted: () => void;
+}
+
+function summary(rule: UnmanagedRule): string {
+  const port = (value: string) => (value ? `:${value}` : "");
+  return `${rule.protocol} ${rule.source_net}${port(rule.source_port)} → ${rule.destination_net}${port(rule.destination_port)}`;
+}
+
+/**
+ * Lists the rules that exist on a firewall but are not managed by OPNexus yet and
+ * lets the operator take them over. Taking over only records the rule — nothing is
+ * written to the firewall until the rule is changed and pushed the normal way.
+ */
+export function AdoptRulesModal({ hosts, onClose, onAdopted }: Props) {
+  const { t, errorMessage } = useLanguage();
+  const toast = useToast();
+  const enabledHosts = hosts.filter((h) => h.enabled);
+  // Derived rather than initialised once: the host list may still be loading when the dialog opens.
+  const [chosenHostId, setHostId] = useState("");
+  const hostId = chosenHostId || enabledHosts[0]?.id || "";
+  const [rules, setRules] = useState<UnmanagedRule[] | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState<string | null>(null);
+
+  function load(id: string) {
+    setRules(null);
+    setError(null);
+    api
+      .listUnmanagedRules(id)
+      .then(setRules)
+      .catch((e) => {
+        setRules([]);
+        setError(errorMessage(e, "rules.adopt.loadFailed"));
+      });
+  }
+
+  useEffect(() => {
+    if (hostId) load(hostId);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [hostId]);
+
+  async function adopt(rule: UnmanagedRule) {
+    setBusy(rule.uuid);
+    try {
+      await api.adoptRule(hostId, rule.uuid);
+      toast.show(t("rules.adopt.adopted", { name: rule.description }), "success");
+      onAdopted();
+      load(hostId);
+    } catch (e) {
+      toast.show(errorMessage(e, "rules.adopt.failed"), "danger");
+    } finally {
+      setBusy(null);
+    }
+  }
+
+  return (
+    <Modal title={t("rules.adopt.title")} onClose={onClose}>
+      <div className="max-h-[70vh] space-y-4 overflow-y-auto pr-1">
+        <p className="text-sm text-slate-600">{t("rules.adopt.intro")}</p>
+        <label className="flex items-center gap-2 text-sm text-slate-600">
+          {t("rules.adopt.host")}
+          <select
+            value={hostId}
+            onChange={(e) => setHostId(e.target.value)}
+            className="rounded-lg border border-slate-300 bg-white px-3 py-1.5 text-sm"
+          >
+            {enabledHosts.map((h) => (
+              <option key={h.id} value={h.id}>
+                {h.name}
+              </option>
+            ))}
+          </select>
+        </label>
+        {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
+        {rules === null && <p className="text-sm text-slate-500">{t("common.loading")}</p>}
+        {rules !== null && rules.length === 0 && !error && (
+          <p className="text-sm text-slate-500">{t("rules.adopt.none")}</p>
+        )}
+        <ul className="space-y-2">
+          {(rules ?? []).map((rule) => (
+            <li key={rule.uuid} className="rounded-lg border border-slate-200 p-3">
+              <div className="flex flex-wrap items-center justify-between gap-2">
+                <div className="min-w-0">
+                  <p className="truncate font-medium text-slate-900">{rule.description}</p>
+                  <p className="text-xs text-slate-500">
+                    {rule.interface_label} · {rule.direction} · {rule.action} · {summary(rule)}
+                    {!rule.enabled ? ` · ${t("common.statusDisabled")}` : ""}
+                    {rule.log ? ` · ${t("rules.logPackets")}` : ""}
+                  </p>
+                </div>
+                {rule.adoptable ? (
+                  <Button variant="outline" onClick={() => adopt(rule)} disabled={busy !== null} loading={busy === rule.uuid}>
+                    {t("rules.adopt.action")}
+                  </Button>
+                ) : (
+                  <Badge tone="neutral">{t("rules.adopt.notPossible")}</Badge>
+                )}
+              </div>
+              {!rule.adoptable && (
+                <p className="mt-2 text-xs text-slate-500">
+                  {rule.reasons.map((code) => t(`rules.adopt.reasons.${code}`)).join(" · ")}
+                </p>
+              )}
+            </li>
+          ))}
+        </ul>
+        <div className="flex justify-end">
+          <Button type="button" variant="ghost" onClick={onClose}>
+            {t("common.close")}
+          </Button>
+        </div>
+      </div>
+    </Modal>
+  );
+}

frontend/components/AuthGate.tsx

@@ -10,7 +10,7 @@ import { APP_CODENAME, APP_VERSION } from "@/lib/version";
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { ReactNode, useEffect, useState } from "react";
-import { navGroups } from "@/components/Nav";
+import { navGroups, navLabelKey } from "@/components/Nav";
 
 /**
  * Single-role auth guard — there's exactly one protected "area" (everything
@@ -41,7 +41,7 @@ export function AuthGate({ children }: { children: ReactNode }) {
   // the title (and its change) to know a navigation happened and where they are. A rendered
   // <title> is hoisted into <head> by React 19 and wins over the static metadata one.
   const item = navGroups.flatMap((g) => g.items).find((i) => pathname?.startsWith(i.href));
-  const pageName = item ? t(`nav.items.${item.href.slice(1)}`) : pathname === "/login" ? t("login.signIn") : pathname?.startsWith("/about") ? t("settings.about") : null;
+  const pageName = item ? t(navLabelKey(item.href)) : pathname === "/login" ? t("login.signIn") : pathname?.startsWith("/about") ? t("settings.about") : null;
   const title = <title>{pageName ? pageName.includes("OPNexus") ? pageName : `${pageName} · OPNexus` : "OPNexus"}</title>;
 
   if (pathname === "/login") return <>{title}{children}</>;

frontend/components/CommandPalette.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { navGroups } from "@/components/Nav";
+import { navGroups, navLabelKey } from "@/components/Nav";
 import { useLanguage } from "@/components/LanguageProvider";
 import { api, Host, SearchHit } from "@/lib/api";
 import { OPEN_COMMAND_PALETTE_EVENT } from "@/lib/events";
@@ -88,7 +88,7 @@ export function CommandPalette() {
     () =>
       navGroups.flatMap((group) =>
         group.items.map((item) => {
-          const label = t(`nav.items.${item.href.slice(1)}`);
+          const label = t(navLabelKey(item.href));
           const groupLabel = t(`nav.groups.${group.key}`);
           return {
             key: `nav:${item.href}`,

frontend/components/ManagedCertificateForm.tsx

@@ -3,9 +3,9 @@
 import { Button } from "@/components/ui/Button";
 import { FieldGroup, Input, Select } from "@/components/ui/Field";
 import { Modal } from "@/components/ui/Modal";
-import { api, CertAction, CertDigest, CertKeyType, Host, ManagedCertificate, ManagedCertificateCreate } from "@/lib/api";
+import { api, CertAction, CertDigest, CertKeyType, Host, HostCa, ManagedCertificate, ManagedCertificateCreate } from "@/lib/api";
 import { useLanguage } from "@/components/LanguageProvider";
-import { FormEvent, useState } from "react";
+import { FormEvent, useEffect, useState } from "react";
 
 const certActions: CertAction[] = ["import", "internal", "external", "sign_csr", "import_csr", "reissue", "manual"];
 
@@ -47,6 +47,17 @@ export function ManagedCertificateForm({ hosts, editing, onClose, onSaved }: {
   );
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // The firewall expects the CA's refid in caref (not its row UUID), so the
+  // CAs of the selected host are offered as a list; if that lookup fails the
+  // field stays a free text input.
+  const [cas, setCas] = useState<HostCa[] | null>(null);
+  useEffect(() => {
+    let cancelled = false;
+    setCas(null);
+    if (!form.host_id) return;
+    api.getHostCas(form.host_id).then((list) => { if (!cancelled) setCas(list); }).catch(() => { if (!cancelled) setCas(null); });
+    return () => { cancelled = true; };
+  }, [form.host_id]);
 
   async function submit(e: FormEvent) {
     e.preventDefault();
@@ -135,12 +146,23 @@ export function ManagedCertificateForm({ hosts, editing, onClose, onSaved }: {
 
         {(form.action === "internal" || form.action === "sign_csr") && (
           <FieldGroup label={form.action === "sign_csr" ? t("certForm.carefRequired") : t("certForm.carefOptional")}>
-            <Input
-              value={form.caref ?? ""}
-              onChange={(e) => setForm({ ...form, caref: e.target.value || null })}
-              required={form.action === "sign_csr"}
-              placeholder={t("certForm.carefPlaceholder")}
-            />
+            {cas && cas.length > 0 ? (
+              <Select
+                value={form.caref ?? ""}
+                onChange={(e) => setForm({ ...form, caref: e.target.value || null })}
+                required={form.action === "sign_csr"}
+              >
+                <option value="">{form.action === "sign_csr" ? t("certForm.carefChoose") : t("certForm.carefSelfSigned")}</option>
+                {cas.map((c) => <option key={c.uuid} value={c.refid}>{c.descr}{c.common_name ? ` (${c.common_name})` : ""}</option>)}
+              </Select>
+            ) : (
+              <Input
+                value={form.caref ?? ""}
+                onChange={(e) => setForm({ ...form, caref: e.target.value || null })}
+                required={form.action === "sign_csr"}
+                placeholder={t("certForm.carefPlaceholder")}
+              />
+            )}
           </FieldGroup>
         )}
 

frontend/components/Nav.tsx

@@ -6,15 +6,25 @@ import clsx from "clsx";
 import {
   Cable,
   FolderTree,
+  Globe,
   GitBranch,
+  HardDrive,
+  Clock,
+  Camera,
+  Sliders,
+  GitCompare,
+  Boxes,
   KeyRound,
   LayoutDashboard,
   Layers,
   LogOut,
   Network,
   RefreshCw,
+  Route,
+  Router,
   ScrollText,
   Search,
+  Server,
   Settings,
   Shield,
   ShieldCheck,
@@ -59,6 +69,33 @@ export const navGroups: NavGroup[] = [
       { href: "/nat", label: "NAT", icon: Network, keywords: ["Port Forward", "Portweiterleitung", "1:1 NAT", "Outbound NAT", "Masquerade"] },
     ],
   },
+  {
+    key: "network",
+    label: "Netzwerk",
+    icon: Cable,
+    items: [
+      { href: "/network/interfaces", label: "Schnittstellen", icon: Cable, keywords: ["Interfaces", "IP-Adressen", "WAN", "LAN", "Zuweisung"] },
+      { href: "/network/vlans", label: "VLANs", icon: Layers, keywords: ["VLAN-Tag", "802.1q"] },
+      { href: "/network/vips", label: "Virtuelle IPs", icon: Tags, keywords: ["CARP-VIP", "IP-Alias", "VHID"] },
+      { href: "/network/gateways", label: "Gateways", icon: Router, keywords: ["Standard-Gateway", "Uplink"] },
+      { href: "/network/routes", label: "Routen", icon: Route, keywords: ["Routing", "Statische Routen"] },
+      { href: "/network/dns", label: "DNS", icon: Globe, keywords: ["Unbound", "Host-Override", "Hostnamen"] },
+      { href: "/network/dhcp", label: "DHCP", icon: Server, keywords: ["Kea", "dnsmasq", "Reservierung", "Statische Zuweisung", "Subnetz", "Bereich", "Range"] },
+      { href: "/network/devices", label: "Geräte", icon: Boxes, keywords: ["LAGG", "Link Aggregation", "Bridge", "Brücke", "Loopback", "GRE", "Tunnel"] },
+      { href: "/network/compare", label: "Abgleich", icon: GitCompare, keywords: ["Vergleich", "Cluster", "HA", "Abweichung", "Drift", "Unterschiede"] },
+    ],
+  },
+  {
+    key: "hostsystem",
+    label: "Host-System",
+    icon: HardDrive,
+    items: [
+      { href: "/hostsystem/tunables", label: "Tunables", icon: Sliders, keywords: ["sysctl", "Kernel", "kTLS", "Systemparameter"] },
+      { href: "/hostsystem/cron", label: "Cron", icon: Clock, keywords: ["Zeitplan", "Aufgaben", "Jobs", "geplante Aufgaben"] },
+      { href: "/hostsystem/syslog", label: "Syslog", icon: ScrollText, keywords: ["Remote-Logging", "Log-Ziel", "Logserver"] },
+      { href: "/hostsystem/snapshots", label: "Snapshots", icon: Camera, keywords: ["ZFS", "Boot-Umgebung", "Sicherung vor Änderung"] },
+    ],
+  },
   {
     key: "vpn",
     label: "VPN",
@@ -127,6 +164,11 @@ export const navGroups: NavGroup[] = [
   },
 ];
 
+/** i18n key for a nav item: "/network/vlans" -> nav.items.network-vlans (a slash would read as a nested path). */
+export function navLabelKey(href: string): string {
+  return `nav.items.${href.slice(1).replace(/\//g, "-")}`;
+}
+
 export function Nav() {
   const { t } = useLanguage();
   const pathname = usePathname();
@@ -146,11 +188,11 @@ export function Nav() {
 
   return (
     <header className="border-b border-slate-200 bg-white">
-      <div className="mx-auto flex max-w-6xl flex-wrap items-center gap-x-4 gap-y-2 px-3 py-3 sm:px-6">
+      <div className="mx-auto flex max-w-6xl flex-wrap items-center gap-x-3 gap-y-2 px-3 py-3 sm:px-6">
         <Link href="/about" title={t("nav.aboutTitle")} className="shrink-0">
           <Logo className="h-6 w-auto sm:h-7" />
         </Link>
-        <nav aria-label={t("nav.mainNavigation")} className="order-3 flex w-full min-w-0 gap-0.5 overflow-x-auto sm:order-none sm:w-auto sm:gap-1">
+        <nav aria-label={t("nav.mainNavigation")} className="order-3 flex w-full min-w-0 gap-0.5 overflow-x-auto sm:order-none sm:w-auto">
           {navGroups.map(({ key, icon: Icon, items }) => {
             const active = activeGroup?.key === key;
             return (
@@ -161,12 +203,12 @@ export function Nav() {
                 aria-label={t(`nav.groups.${key}`)}
                 aria-current={active ? "true" : undefined}
                 className={clsx(
-                  "flex shrink-0 items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm font-medium transition-colors sm:px-3",
+                  "flex shrink-0 items-center gap-1.5 rounded-lg px-2 py-1.5 text-sm font-medium transition-colors",
                   active ? "bg-brand-50 text-brand-600" : "text-slate-600 hover:bg-slate-100"
                 )}
               >
                 <Icon size={16} aria-hidden="true" />
-                <span className="hidden sm:inline">{t(`nav.groups.${key}`)}</span>
+                <span className="hidden min-[1150px]:inline">{t(`nav.groups.${key}`)}</span>
               </Link>
             );
           })}
@@ -194,10 +236,10 @@ export function Nav() {
         <button
           onClick={handleLogout}
           title={t("nav.logout")}
-          className="flex shrink-0 items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm font-medium text-slate-500 transition-colors hover:bg-slate-100 hover:text-slate-700 sm:px-3"
+          aria-label={t("nav.logout")}
+          className="flex shrink-0 items-center rounded-lg px-2.5 py-1.5 text-sm font-medium text-slate-500 transition-colors hover:bg-slate-100 hover:text-slate-700"
         >
           <LogOut size={16} aria-hidden="true" />
-          <span className="hidden sm:inline">{t("nav.logout")}</span>
         </button>
       </div>
       {activeGroup && activeGroup.items.length > 1 && (
@@ -209,8 +251,8 @@ export function Nav() {
                 <Link
                   key={href}
                   href={href}
-                  title={t(`nav.items.${href.slice(1)}`)}
-                  aria-label={t(`nav.items.${href.slice(1)}`)}
+                  title={t(navLabelKey(href))}
+                  aria-label={t(navLabelKey(href))}
                   aria-current={active ? "page" : undefined}
                   className={clsx(
                     "flex shrink-0 items-center gap-1.5 rounded-md px-2.5 py-1 text-sm transition-colors",
@@ -218,7 +260,7 @@ export function Nav() {
                   )}
                 >
                   <Icon size={14} aria-hidden="true" />
-                  <span className="hidden sm:inline">{t(`nav.items.${href.slice(1)}`)}</span>
+                  <span className="hidden sm:inline">{t(navLabelKey(href))}</span>
                 </Link>
               );
             })}

frontend/components/NetworkChangeModal.tsx

@@ -0,0 +1,477 @@
+"use client";
+
+import { useLanguage } from "@/components/LanguageProvider";
+import { Badge } from "@/components/ui/Badge";
+import { Button } from "@/components/ui/Button";
+import { FieldGroup, Input, Select } from "@/components/ui/Field";
+import { Modal } from "@/components/ui/Modal";
+import { useToast } from "@/components/ui/Toast";
+import {
+  api,
+  NetworkAction,
+  NetworkChangePreview,
+  NetworkChangeResult,
+  NetworkKind,
+  NetworkTemplate,
+} from "@/lib/api";
+import { AlertTriangle } from "lucide-react";
+import { useEffect, useState } from "react";
+
+type FieldType = "text" | "select" | "check" | "password";
+interface FieldDef {
+  name: string;
+  type: FieldType;
+  // Only shown for these values of another field (e.g. CARP-only settings).
+  when?: { field: string; value: string | string[] };
+  // i18n key of a short note shown next to the label
+  hint?: string;
+  // The firewall only accepts values matching this; checked here so the error comes before the apply step.
+  pattern?: RegExp;
+}
+
+const FIELDS: Record<NetworkKind, FieldDef[]> = {
+  vlan: [
+    { name: "if", type: "select" },
+    { name: "tag", type: "text" },
+    { name: "pcp", type: "select" },
+    { name: "descr", type: "text" },
+  ],
+  vip: [
+    { name: "interface", type: "select" },
+    { name: "mode", type: "select" },
+    { name: "network", type: "text" },
+    { name: "vhid", type: "text", when: { field: "mode", value: "carp" } },
+    { name: "advbase", type: "text", when: { field: "mode", value: "carp" } },
+    { name: "advskew", type: "text", when: { field: "mode", value: "carp" } },
+    { name: "password", type: "password", when: { field: "mode", value: "carp" } },
+    { name: "descr", type: "text" },
+  ],
+  gateway: [
+    { name: "name", type: "text" },
+    { name: "interface", type: "select" },
+    { name: "ipprotocol", type: "select" },
+    { name: "gateway", type: "text" },
+    { name: "defaultgw", type: "check" },
+    { name: "monitor_disable", type: "check" },
+    { name: "priority", type: "text" },
+    { name: "disabled", type: "check" },
+    { name: "descr", type: "text" },
+  ],
+  interface: [
+    { name: "if", type: "select" },
+    { name: "descr", type: "text", hint: "network.hint.interfaceDescr", pattern: /^[A-Za-z0-9_]{1,255}$/ },
+    { name: "enable", type: "check" },
+    { name: "type4", type: "select" },
+    { name: "ipaddr", type: "text", when: { field: "type4", value: "staticv4" } },
+    { name: "gateway", type: "select", when: { field: "type4", value: "staticv4" } },
+    { name: "type6", type: "select" },
+    { name: "ipaddrv6", type: "text", when: { field: "type6", value: "staticv6" } },
+    { name: "gatewayv6", type: "select", when: { field: "type6", value: "staticv6" } },
+    { name: "mtu", type: "text" },
+    { name: "blockpriv", type: "check" },
+    { name: "blockbogons", type: "check" },
+    { name: "lock", type: "check" },
+  ],
+  dns_host: [
+    { name: "enabled", type: "check" },
+    { name: "hostname", type: "text" },
+    { name: "domain", type: "text" },
+    { name: "rr", type: "select" },
+    { name: "server", type: "text", when: { field: "rr", value: ["A", "AAAA"] } },
+    { name: "mx", type: "text", when: { field: "rr", value: "MX" } },
+    { name: "mxprio", type: "text", when: { field: "rr", value: "MX" } },
+    { name: "addptr", type: "check" },
+    { name: "description", type: "text" },
+  ],
+  dhcp_host: [
+    { name: "host", type: "text" },
+    { name: "domain", type: "text" },
+    { name: "ip", type: "text" },
+    { name: "hwaddr", type: "text" },
+    { name: "client_id", type: "text" },
+    { name: "lease_time", type: "text" },
+    { name: "local", type: "check" },
+    { name: "ignore", type: "check" },
+    { name: "descr", type: "text" },
+  ],
+  kea_subnet: [
+    { name: "subnet", type: "text" },
+    { name: "pools", type: "text" },
+    { name: "option_data.routers", type: "text" },
+    { name: "option_data.domain_name_servers", type: "text" },
+    { name: "option_data.domain_name", type: "text" },
+    { name: "option_data.ntp_servers", type: "text" },
+    { name: "valid_lifetime", type: "text" },
+    { name: "next_server", type: "text" },
+    { name: "description", type: "text" },
+  ],
+  kea_reservation: [
+    { name: "subnet", type: "select" },
+    { name: "ip_address", type: "text" },
+    { name: "hw_address", type: "text" },
+    { name: "client_id", type: "text" },
+    { name: "hostname", type: "text" },
+    { name: "next_server", type: "text" },
+    { name: "description", type: "text" },
+  ],
+  tunable: [
+    { name: "tunable", type: "text" },
+    { name: "value", type: "text" },
+    { name: "descr", type: "text" },
+  ],
+  cron_job: [
+    { name: "enabled", type: "check" },
+    { name: "minutes", type: "text" },
+    { name: "hours", type: "text" },
+    { name: "days", type: "text" },
+    { name: "months", type: "text" },
+    { name: "weekdays", type: "text" },
+    { name: "who", type: "text" },
+    { name: "command", type: "select" },
+    { name: "parameters", type: "text" },
+    { name: "description", type: "text" },
+  ],
+  syslog_destination: [
+    { name: "enabled", type: "check" },
+    { name: "transport", type: "select" },
+    { name: "hostname", type: "text" },
+    { name: "port", type: "text" },
+    { name: "program", type: "text" },
+    { name: "level", type: "text" },
+    { name: "facility", type: "text" },
+    { name: "rfc5424", type: "check" },
+    { name: "description", type: "text" },
+  ],
+  gateway_group: [
+    { name: "name", type: "text" },
+    { name: "item", type: "text" },
+    { name: "item2", type: "text" },
+    { name: "item3", type: "text" },
+    { name: "item4", type: "text" },
+    { name: "item5", type: "text" },
+    { name: "trigger", type: "select" },
+    { name: "poolopts", type: "select" },
+    { name: "descr", type: "text" },
+  ],
+  lagg: [
+    { name: "members", type: "text" },
+    { name: "proto", type: "select" },
+    { name: "primary_member", type: "text" },
+    { name: "lagghash", type: "select" },
+    { name: "mtu", type: "text" },
+    { name: "descr", type: "text" },
+  ],
+  bridge: [
+    { name: "members", type: "text" },
+    { name: "proto", type: "select" },
+    { name: "enablestp", type: "check" },
+    { name: "linklocal", type: "check" },
+    { name: "descr", type: "text" },
+  ],
+  loopback: [
+    { name: "deviceId", type: "text" },
+    { name: "description", type: "text" },
+  ],
+  gre: [
+    { name: "local-addr", type: "text" },
+    { name: "remote-addr", type: "text" },
+    { name: "tunnel-local-addr", type: "text" },
+    { name: "tunnel-remote-addr", type: "text" },
+    { name: "tunnel-remote-net", type: "text" },
+    { name: "descr", type: "text" },
+  ],
+  dns_forward: [
+    { name: "enabled", type: "check" },
+    { name: "type", type: "select" },
+    { name: "domain", type: "text" },
+    { name: "server", type: "text" },
+    { name: "port", type: "text" },
+    { name: "forward_tcp_upstream", type: "check" },
+    { name: "forward_first", type: "check" },
+    { name: "description", type: "text" },
+  ],
+  dhcp_range: [
+    { name: "interface", type: "select" },
+    { name: "start_addr", type: "text" },
+    { name: "end_addr", type: "text" },
+    { name: "subnet_mask", type: "text" },
+    { name: "lease_time", type: "text" },
+    { name: "domain_type", type: "select" },
+    { name: "domain", type: "text" },
+    { name: "description", type: "text" },
+  ],
+  route: [
+    { name: "network", type: "text" },
+    { name: "gateway", type: "select" },
+    { name: "enabled", type: "check" },
+    { name: "descr", type: "text" },
+  ],
+};
+
+interface Props {
+  hostId: string;
+  hostName: string;
+  kind: NetworkKind;
+  action: NetworkAction;
+  uuid?: string;
+  /** Values to start a new object with (e.g. the device being assigned). */
+  preset?: Record<string, string>;
+  /** Other nodes of the same cluster; after an add the same object can be created there too. */
+  peers?: { id: string; name: string }[];
+  onTransfer?: (peer: { id: string; name: string }, fields: Record<string, string>) => void;
+  onClose: () => void;
+  onDone: () => void;
+}
+
+type Step = "form" | "review" | "done";
+
+function isVisible(f: FieldDef, values: Record<string, string>): boolean {
+  if (!f.when) return true;
+  const wanted = Array.isArray(f.when.value) ? f.when.value : [f.when.value];
+  return wanted.includes(values[f.when.field] ?? "");
+}
+
+export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, preset, peers, onTransfer, onClose, onDone }: Props) {
+  const { t, errorMessage } = useLanguage();
+  const toast = useToast();
+  const [step, setStep] = useState<Step>(action === "del" ? "review" : "form");
+  const [template, setTemplate] = useState<NetworkTemplate | null>(null);
+  const [values, setValues] = useState<Record<string, string>>({});
+  // What the firewall holds right now (edit only) — the baseline for "what did the user change".
+  const [initial, setInitial] = useState<Record<string, string>>({});
+  const [plan, setPlan] = useState<NetworkChangePreview | null>(null);
+  const [result, setResult] = useState<NetworkChangeResult | null>(null);
+  const [acknowledged, setAcknowledged] = useState(false);
+  const [typedHost, setTypedHost] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [sent, setSent] = useState<Record<string, string>>({});
+  const [error, setError] = useState<string | null>(null);
+
+  // The form starts from what the firewall itself offers for a new object (defaults + valid choices).
+  useEffect(() => {
+    if (action === "del") return;
+    Promise.all([
+      api.getNetworkTemplate(hostId, kind),
+      action === "set" && uuid ? api.getNetworkItem(hostId, kind, uuid) : Promise.resolve({} as Record<string, string>),
+    ])
+      .then(([tpl, current]) => {
+        setTemplate(tpl);
+        const base = Object.fromEntries(Object.entries(tpl).map(([k, v]) => [k, v.value]));
+        setInitial(current);
+        setValues({ ...base, ...(preset ?? {}), ...current });
+      })
+      .catch((e) => setError(errorMessage(e, "network.change.loadFailed")));
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [hostId, kind, action]);
+
+  useEffect(() => {
+    if (action === "del") void loadPreview({});
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  /** For an edit only the fields that really changed are sent. */
+  function changedFields(): Record<string, string> {
+    const visible = FIELDS[kind].filter((f) => isVisible(f, values));
+    const out: Record<string, string> = {};
+    for (const f of visible) {
+      const current = values[f.name] ?? "";
+      if (action === "set" && f.type !== "password" && current === (initial[f.name] ?? "")) continue;
+      if (f.type === "password" && !current) continue;
+      if (action === "add" && current === "" && f.type !== "check") continue;
+      out[f.name] = current;
+    }
+    return out;
+  }
+
+  async function loadPreview(fields: Record<string, string>) {
+    setBusy(true);
+    setError(null);
+    try {
+      setPlan(await api.previewNetworkChange(hostId, { kind, action, uuid, fields }));
+      setStep("review");
+    } catch (e) {
+      setError(errorMessage(e, "network.change.previewFailed"));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function apply() {
+    if (!plan) return;
+    setBusy(true);
+    setError(null);
+    try {
+      const fields = action === "del" ? {} : changedFields();
+      setSent(fields);
+      const res = await api.executeNetworkChange(hostId, { kind, action, uuid, fields }, plan.token, acknowledged);
+      setResult(res);
+      setStep("done");
+      toast.show(t("network.change.applied"), "success");
+      onDone();
+    } catch (e) {
+      setError(errorMessage(e, "network.change.applyFailed"));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  // First visible field whose value the firewall would refuse (only fields the user typed into).
+  const invalidField = FIELDS[kind].find(
+    (f) => f.pattern && isVisible(f, values) && (values[f.name] ?? "") !== "" && !f.pattern.test(values[f.name]),
+  );
+  const needsTypedHost = !!plan?.requires_acknowledgement;
+  const canApply = !!plan && plan.can_execute && !busy && (!needsTypedHost || (acknowledged && typedHost === hostName));
+
+  return (
+    <Modal title={t(`network.change.title.${action}`, { kind: t(`network.kinds.${kind}`) })} onClose={onClose}>
+      <div className="max-h-[70vh] space-y-4 overflow-y-auto pr-1">
+        {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
+
+        {step === "form" && (
+          <form
+            className="space-y-4"
+            onSubmit={(e) => {
+              e.preventDefault();
+              void loadPreview(changedFields());
+            }}
+          >
+            {!template && !error && <p className="text-sm text-slate-500">{t("common.loading")}</p>}
+            {template &&
+              FIELDS[kind]
+                .filter((f) => template[f.name] !== undefined && isVisible(f, values))
+                .map((f) => (
+                  <FieldGroup key={f.name} label={t(`network.field.${f.name}`)} hint={f.hint ? t(f.hint) : undefined}>
+                    {f.type === "select" ? (
+                      <Select value={values[f.name] ?? ""} onChange={(e) => setValues({ ...values, [f.name]: e.target.value })}>
+                        {(template[f.name].options ?? []).map((o) => (
+                          <option key={o.value} value={o.value}>{o.label || o.value}</option>
+                        ))}
+                      </Select>
+                    ) : f.type === "check" ? (
+                      <label className="flex items-center gap-2 text-sm">
+                        <input
+                          type="checkbox"
+                          checked={values[f.name] === "1"}
+                          onChange={(e) => setValues({ ...values, [f.name]: e.target.checked ? "1" : "0" })}
+                        />
+                        {t(`network.field.${f.name}Hint`)}
+                      </label>
+                    ) : (
+                      <Input
+                        type={f.type === "password" ? "password" : "text"}
+                        autoComplete="off"
+                        value={values[f.name] ?? ""}
+                        placeholder={f.type === "password" && action === "set" ? t("network.change.keepUnchanged") : undefined}
+                        onChange={(e) => setValues({ ...values, [f.name]: e.target.value })}
+                      />
+                    )}
+                  </FieldGroup>
+                ))}
+            {invalidField && <p role="alert" className="text-sm text-red-600">{t(invalidField.hint ?? "network.change.invalidValue")}</p>}
+            <div className="flex justify-end gap-2">
+              <Button type="button" variant="ghost" onClick={onClose}>{t("common.cancel")}</Button>
+              <Button type="submit" disabled={!template || busy || !!invalidField} loading={busy}>{t("network.change.toPreview")}</Button>
+            </div>
+          </form>
+        )}
+
+        {step === "review" && plan && (
+          <div className="space-y-4">
+            {plan.blocks.map((b) => (
+              <p key={b.code} className="rounded-lg border border-red-300 bg-red-50 p-3 text-sm text-red-800">
+                {t(`network.blocks.${b.code}`, b.params)}
+              </p>
+            ))}
+            {plan.risks.length > 0 && (
+              <div className="rounded-lg border border-amber-300 bg-amber-50 p-3 text-sm text-amber-900">
+                <p className="mb-1 flex items-center gap-2 font-medium">
+                  <AlertTriangle size={16} aria-hidden /> {t("network.change.riskTitle")}
+                </p>
+                <ul className="list-disc space-y-1 pl-5">
+                  {plan.risks.map((r) => <li key={r.code}>{t(`network.risks.${r.code}`, r.params)}</li>)}
+                </ul>
+              </div>
+            )}
+            {plan.warnings.length > 0 && (
+              <ul className="list-disc space-y-1 pl-5 text-sm text-slate-600">
+                {plan.warnings.map((w) => <li key={w.code}>{t(`network.warnings.${w.code}`, w.params)}</li>)}
+              </ul>
+            )}
+            {plan.changes.length === 0 ? (
+              <p className="text-sm text-slate-500">{t("network.change.noChanges")}</p>
+            ) : (
+              <table className="w-full text-left text-sm">
+                <thead className="text-xs uppercase text-slate-500">
+                  <tr>
+                    <th className="py-1 pr-3">{t("network.change.col.field")}</th>
+                    <th className="py-1 pr-3">{t("network.change.col.before")}</th>
+                    <th className="py-1">{t("network.change.col.after")}</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {plan.changes.map((c) => (
+                    <tr key={c.field} className="border-t border-slate-100">
+                      <td className="py-1 pr-3">{t(`network.field.${c.field}`)}</td>
+                      <td className="py-1 pr-3 font-mono text-xs text-slate-500">{c.before ?? "–"}</td>
+                      <td className="py-1 font-mono text-xs">{c.after ?? "–"}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            )}
+            <p className="text-xs text-slate-500">{t("network.change.backupNote")}</p>
+            {needsTypedHost && (
+              <div className="space-y-2 rounded-lg border border-slate-200 p-3">
+                <label className="flex items-start gap-2 text-sm">
+                  <input type="checkbox" className="mt-1" checked={acknowledged} onChange={(e) => setAcknowledged(e.target.checked)} />
+                  <span>{t("network.change.ack", { host: hostName })}</span>
+                </label>
+                <FieldGroup label={t("network.change.typeHost", { host: hostName })}>
+                  <Input value={typedHost} onChange={(e) => setTypedHost(e.target.value)} autoComplete="off" />
+                </FieldGroup>
+              </div>
+            )}
+            <div className="flex justify-end gap-2">
+              {action !== "del" && <Button type="button" variant="ghost" onClick={() => setStep("form")}>{t("network.change.back")}</Button>}
+              <Button type="button" variant="ghost" onClick={onClose}>{t("common.cancel")}</Button>
+              <Button type="button" onClick={apply} disabled={!canApply} loading={busy}>{t("network.change.apply")}</Button>
+            </div>
+          </div>
+        )}
+
+        {step === "done" && result && (
+          <div className="space-y-3">
+            <p className="flex items-center gap-2 text-sm">
+              <Badge tone={result.verified ? "success" : "warning"}>
+                {result.verified ? t("network.change.verified") : t("network.change.notVerified")}
+              </Badge>
+            </p>
+            {!result.verified && (
+              <p className="text-sm text-amber-700">
+                {result.mismatches.includes("unreadable")
+                  ? t("network.change.unreachable", { host: hostName })
+                  : t("network.change.mismatch", { fields: result.mismatches.join(", ") })}
+              </p>
+            )}
+            <p className="text-xs text-slate-500">{t("network.change.backupId", { id: result.backup_id })}</p>
+            {action === "add" && peers && peers.length > 0 && onTransfer && (
+              <div className="space-y-2 rounded-lg border border-slate-200 p-3">
+                <p className="text-sm text-slate-600">{t("network.change.transferHint")}</p>
+                <div className="flex flex-wrap gap-2">
+                  {peers.map((peer) => (
+                    <Button key={peer.id} type="button" variant="outline" onClick={() => onTransfer(peer, sent)}>
+                      {t("network.change.transfer", { host: peer.name })}
+                    </Button>
+                  ))}
+                </div>
+              </div>
+            )}
+            <div className="flex justify-end">
+              <Button type="button" onClick={onClose}>{t("common.close")}</Button>
+            </div>
+          </div>
+        )}
+      </div>
+    </Modal>
+  );
+}

frontend/components/NetworkCompare.tsx

@@ -0,0 +1,97 @@
+"use client";
+
+import { useLanguage } from "@/components/LanguageProvider";
+import { Badge } from "@/components/ui/Badge";
+import { Card } from "@/components/ui/Card";
+import { EmptyState } from "@/components/ui/EmptyState";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
+import { api, ClusterNetworkDrift } from "@/lib/api";
+import { CheckCircle2, Layers } from "lucide-react";
+import Link from "next/link";
+import { useEffect, useState } from "react";
+
+const CATEGORY_TAB: Record<string, string> = {
+  interfaces: "interfaces", vlans: "vlans", vips: "vips", gateways: "gateways", routes: "routes",
+  dns_hosts: "dns", dhcp_hosts: "dhcp", kea_subnets: "dhcp", kea_reservations: "dhcp",
+};
+
+/** Network configuration differences between the nodes of every HA cluster. */
+export function NetworkCompare() {
+  const { t, errorMessage } = useLanguage();
+  const [clusters, setClusters] = useState<ClusterNetworkDrift[] | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    api
+      .getNetworkDrift()
+      .then((d) => setClusters(d.clusters))
+      .catch((e) => setError(errorMessage(e, "network.compare.loadFailed")));
+  }, [errorMessage]);
+
+  if (error) return <p className="text-sm text-red-600">{error}</p>;
+  if (!clusters) return <Skeleton className="h-48 w-full" />;
+  if (clusters.length === 0) return <EmptyState icon={Layers} title={t("network.compare.noClusters")} />;
+
+  return (
+    <div className="space-y-6">
+      <p className="text-sm text-slate-600">{t("network.compare.intro")}</p>
+      {clusters.map((c) => (
+        <Card key={c.name}>
+          <div className="flex flex-wrap items-center justify-between gap-2 border-b border-slate-200 px-5 py-3">
+            <h2 className="text-sm font-semibold text-slate-700">
+              {c.name} <span className="font-normal text-slate-500">({c.hosts.join(", ")})</span>
+            </h2>
+            {c.unreachable.length > 0 ? (
+              <Badge tone="warning">{t("network.compare.unreachable", { hosts: c.unreachable.join(", ") })}</Badge>
+            ) : c.differences.length === 0 ? (
+              <Badge tone="success">
+                <CheckCircle2 size={12} aria-hidden /> {t("network.compare.same")}
+              </Badge>
+            ) : (
+              <Badge tone="danger">{t("network.compare.count", { count: c.differences.length })}</Badge>
+            )}
+          </div>
+          {c.differences.length > 0 && (
+            <div className="overflow-x-auto">
+              <Table>
+                <THead>
+                  <TRow>
+                    <TH>{t("network.compare.category")}</TH>
+                    <TH>{t("network.compare.object")}</TH>
+                    <TH>{t("network.compare.state")}</TH>
+                    {c.compared.map((h) => (
+                      <TH key={h}>{h}</TH>
+                    ))}
+                  </TRow>
+                </THead>
+                <TBody>
+                  {c.differences.map((d) => (
+                    <TRow key={`${d.category}:${d.key}`}>
+                      <TD>
+                        <Link className="text-brand-600 hover:underline" href={`/network/${CATEGORY_TAB[d.category] ?? "interfaces"}`}>
+                          {t(`network.compare.categories.${d.category}`)}
+                        </Link>
+                      </TD>
+                      <TD className="font-mono text-xs">{d.key}</TD>
+                      <TD>
+                        <Badge tone={d.status === "missing" ? "danger" : "warning"}>
+                          {d.status === "missing" ? t("network.compare.missing") : t("network.compare.different")}
+                        </Badge>
+                      </TD>
+                      {c.compared.map((h) => (
+                        <TD key={h} className="font-mono text-xs">
+                          {d.signatures[h] === undefined ? <span className="text-red-600">{t("network.compare.absent")}</span> : d.signatures[h] || "✓"}
+                        </TD>
+                      ))}
+                    </TRow>
+                  ))}
+                </TBody>
+              </Table>
+            </div>
+          )}
+        </Card>
+      ))}
+    </div>
+  );
+}

frontend/components/NetworkObjectSection.tsx

@@ -0,0 +1,121 @@
+"use client";
+
+import { useLanguage } from "@/components/LanguageProvider";
+import { Badge } from "@/components/ui/Badge";
+import { Button } from "@/components/ui/Button";
+import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
+import { api, NetworkAction, NetworkKind, NetworkObjects } from "@/lib/api";
+import { Pencil, Plus, Trash2 } from "lucide-react";
+import { useEffect, useState } from "react";
+
+export interface ObjectChange {
+  kind: NetworkKind;
+  action: NetworkAction;
+  uuid?: string;
+  preset?: Record<string, string>;
+}
+
+interface Props {
+  hostId: string;
+  kind: NetworkKind;
+  title: string;
+  reloadKey: number;
+  readOnly: boolean;
+  onChange: (change: ObjectChange) => void;
+}
+
+const FLAG_COLUMNS = new Set(["enabled"]);
+
+/**
+ * One table of a generic object kind (tunables, cron jobs, LAGG, ...) with its add/edit/delete
+ * actions. The rows come from the firewall via the backend's reduced column list.
+ */
+export function NetworkObjectSection({ hostId, kind, title, reloadKey, readOnly, onChange }: Props) {
+  const { t, errorMessage } = useLanguage();
+  const [data, setData] = useState<NetworkObjects | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    api
+      .listNetworkObjects(hostId, kind)
+      .then((d) => !cancelled && (setData(d), setError(null)))
+      .catch((e) => !cancelled && setError(errorMessage(e, "network.loadFailed")));
+    return () => {
+      cancelled = true;
+    };
+  }, [hostId, kind, reloadKey, errorMessage]);
+
+  // Built-in tunables carry a plain name as id (no UUID): the firewall creates an override instead of editing them.
+  const isBuiltIn = (uuid: string) => kind === "tunable" && !uuid.includes("-");
+
+  return (
+    <div>
+      <div className="flex items-center justify-between border-b border-slate-200 px-5 py-3">
+        <h2 className="text-sm font-semibold text-slate-700">{title}</h2>
+        <Button variant="outline" disabled={readOnly || data?.available === false} onClick={() => onChange({ kind, action: "add" })}>
+          <Plus size={16} />
+          {t("network.rowAdd")}
+        </Button>
+      </div>
+      {error && <p className="px-5 py-3 text-sm text-red-600">{error}</p>}
+      {!data && !error && <p className="px-5 py-4 text-sm text-slate-500">{t("common.loading")}</p>}
+      {data && !data.available && <p className="px-5 py-4 text-sm text-slate-500">{t("network.objectsUnavailable")}</p>}
+      {data && data.available && data.rows.length === 0 && <p className="px-5 py-4 text-sm text-slate-500">{t("network.empty")}</p>}
+      {data && data.available && data.rows.length > 0 && (
+        <div className="overflow-x-auto">
+          <Table>
+            <THead>
+              <TRow>
+                {data.columns.map((c) => (
+                  <TH key={c}>{t(`network.field.${c}`)}</TH>
+                ))}
+                <TH>
+                  <span className="sr-only">{t("common.actions")}</span>
+                </TH>
+              </TRow>
+            </THead>
+            <TBody>
+              {data.rows.map((row) => (
+                <TRow key={row.uuid}>
+                  {data.columns.map((c) => (
+                    <TD key={c} className={c === "description" || c === "descr" ? "" : "font-mono text-xs"}>
+                      {FLAG_COLUMNS.has(c) ? (
+                        <Badge tone={row[c] === "1" ? "success" : "neutral"}>{row[c] === "1" ? t("network.active") : t("common.statusDisabled")}</Badge>
+                      ) : (
+                        row[c] || "–"
+                      )}
+                    </TD>
+                  ))}
+                  <TD>
+                    <fieldset disabled={readOnly} className="contents">
+                      <div className="flex justify-end gap-1">
+                        {isBuiltIn(row.uuid) ? (
+                          <Button
+                            variant="ghost"
+                            onClick={() => onChange({ kind, action: "add", preset: { tunable: row.tunable ?? "", value: row.value ?? "" } })}
+                          >
+                            {t("network.override")}
+                          </Button>
+                        ) : (
+                          <>
+                            <Button variant="ghost" aria-label={t("network.rowEdit")} onClick={() => onChange({ kind, action: "set", uuid: row.uuid })}>
+                              <Pencil size={14} />
+                            </Button>
+                            <Button variant="dangerSubtle" aria-label={t("network.rowDelete")} onClick={() => onChange({ kind, action: "del", uuid: row.uuid })}>
+                              <Trash2 size={14} />
+                            </Button>
+                          </>
+                        )}
+                      </div>
+                    </fieldset>
+                  </TD>
+                </TRow>
+              ))}
+            </TBody>
+          </Table>
+        </div>
+      )}
+    </div>
+  );
+}

frontend/components/OneToOnePanel.tsx

@@ -441,7 +441,7 @@ function OneToOneContent() {
               <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
                 <div>
                   <div className="flex flex-wrap items-center gap-2">
-                    <h3 className="font-medium text-slate-900">{rule.description}</h3>
+                    <h2 className="font-medium text-slate-900">{rule.description}</h2>
                     <WorkflowBadge state={rule.workflow_state} />
                   </div>
                   <p className="mt-1 text-sm text-slate-500">

frontend/components/OutboundNatPanel.tsx

@@ -450,7 +450,7 @@ function OutboundNatContent() {
               <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
                 <div>
                   <div className="flex flex-wrap items-center gap-2">
-                    <h3 className="font-medium text-slate-900">{rule.description}</h3>
+                    <h2 className="font-medium text-slate-900">{rule.description}</h2>
                     <WorkflowBadge state={rule.workflow_state} />
                   </div>
                   <p className="mt-1 text-sm text-slate-500">

frontend/components/PortForwardPanel.tsx

@@ -447,7 +447,7 @@ function PortForwardContent() {
               <div className="flex flex-col items-start justify-between gap-4 sm:flex-row">
                 <div>
                   <div className="flex flex-wrap items-center gap-2">
-                    <h3 className="font-medium text-slate-900">{rule.description}</h3>
+                    <h2 className="font-medium text-slate-900">{rule.description}</h2>
                     <WorkflowBadge state={rule.workflow_state} />
                   </div>
                   <p className="mt-1 text-sm text-slate-500">

frontend/lib/api.ts

@@ -144,6 +144,7 @@ export interface TlsProbe {
 
 export interface HostUpdate {
   name?: string;
+  base_url?: string;
   verify_tls?: boolean;
   tls_ca_pem?: string | null;
   clear_tls_pin?: boolean;
@@ -154,6 +155,206 @@ export interface HostUpdate {
   clear_policy_hierarchy_group_id?: boolean;
 }
 
+export interface NetAddress {
+  address: string;
+  vhid: string | null;
+  carp_status: string | null;
+}
+
+export interface NetInterface {
+  device: string;
+  identifier: string | null;
+  description: string;
+  status: string;
+  enabled: boolean;
+  is_physical: boolean;
+  mtu: string | null;
+  mac: string | null;
+  media: string | null;
+  vlan_tag: string | null;
+  vlan_parent: string | null;
+  ipv4_type: string | null;
+  ipv6_type: string | null;
+  addresses: NetAddress[];
+  pending_action: string | null;
+  assigned: boolean;
+  is_management: boolean;
+}
+
+export interface NetVlan {
+  uuid: string;
+  parent: string;
+  tag: string;
+  pcp: string | null;
+  description: string;
+  device: string | null;
+}
+
+export interface NetVip {
+  uuid: string;
+  interface: string;
+  interface_label: string;
+  mode: string;
+  address: string;
+  vhid: string | null;
+  advbase: string | null;
+  advskew: string | null;
+  description: string;
+}
+
+export interface NetGateway {
+  uuid: string;
+  name: string;
+  description: string;
+  interface: string;
+  interface_label: string;
+  ip_protocol: string;
+  address: string;
+  is_default: boolean;
+  disabled: boolean;
+  priority: string | null;
+  status: string;
+}
+
+export interface NetRoute {
+  uuid: string;
+  network: string;
+  gateway: string;
+  description: string;
+  disabled: boolean;
+}
+
+export type NetworkKind =
+  | "vlan" | "vip" | "gateway" | "route" | "interface" | "dns_host" | "dhcp_host" | "kea_subnet" | "kea_reservation"
+  | "tunable" | "cron_job" | "syslog_destination" | "gateway_group" | "lagg" | "bridge" | "loopback" | "gre"
+  | "dns_forward" | "dhcp_range";
+
+export interface NetworkObjects {
+  available: boolean;
+  columns: string[];
+  rows: Record<string, string>[];
+}
+
+export interface NetworkDifference {
+  category: string;
+  key: string;
+  status: "missing" | "different";
+  present_on: string[];
+  missing_from: string[];
+  signatures: Record<string, string>;
+}
+
+export interface ClusterNetworkDrift {
+  name: string;
+  hosts: string[];
+  compared: string[];
+  unreachable: string[];
+  differences: NetworkDifference[];
+}
+
+export interface HostSnapshot {
+  uuid: string;
+  name: string;
+  active: string;
+  size: string;
+  created: string;
+  mountpoint: string;
+}
+export type NetworkAction = "add" | "set" | "del";
+
+export interface NetworkChangeRequest {
+  kind: NetworkKind;
+  action: NetworkAction;
+  uuid?: string;
+  fields: Record<string, string>;
+}
+
+export interface NetworkRisk {
+  code: string;
+  params: Record<string, string>;
+}
+
+export interface NetworkChangePreview {
+  token: string;
+  kind: NetworkKind;
+  action: NetworkAction;
+  uuid: string | null;
+  host_id: string;
+  host_name: string;
+  changes: { field: string; before: string | null; after: string | null }[];
+  risks: NetworkRisk[];
+  warnings: NetworkRisk[];
+  blocks: NetworkRisk[];
+  requires_acknowledgement: boolean;
+  management_device: string | null;
+  can_execute: boolean;
+}
+
+export interface NetworkChangeResult {
+  status: string;
+  uuid: string | null;
+  verified: boolean;
+  mismatches: string[];
+  backup_id: string;
+}
+
+export type NetworkTemplate = Record<string, { value: string; options: { value: string; label: string; selected: boolean }[] | null }>;
+
+export interface NetDnsHost {
+  uuid: string;
+  hostname: string;
+  domain: string;
+  record_type: string;
+  server: string;
+  enabled: boolean;
+  description: string;
+}
+
+export interface NetDhcpHost {
+  uuid: string;
+  host: string;
+  domain: string;
+  ip: string;
+  hwaddr: string;
+  lease_time: string;
+  description: string;
+}
+
+export interface NetKeaSubnet {
+  uuid: string;
+  subnet: string;
+  pools: string;
+  routers: string;
+  dns_servers: string;
+  description: string;
+}
+
+export interface NetKeaReservation {
+  uuid: string;
+  subnet: string;
+  ip_address: string;
+  hw_address: string;
+  hostname: string;
+  description: string;
+}
+
+export interface HostNetwork {
+  host_id: string;
+  host_name: string;
+  interfaces: NetInterface[];
+  vlans: NetVlan[];
+  vips: NetVip[];
+  gateways: NetGateway[];
+  routes: NetRoute[];
+  dns_hosts: NetDnsHost[];
+  dhcp_hosts: NetDhcpHost[];
+  kea_subnets: NetKeaSubnet[];
+  kea_reservations: NetKeaReservation[];
+  management_device: string | null;
+  can_configure_interfaces: boolean;
+  unavailable: string[];
+}
+
 export interface LiveRule {
   uuid: string;
   description: string;
@@ -242,6 +443,7 @@ export type CertStatus = "valid" | "expiring_soon" | "expired" | "unknown";
 
 export interface HostCertificate {
   uuid: string;
+  refid: string;
   descr: string;
   common_name: string | null;
   issuer: string;
@@ -254,6 +456,7 @@ export interface HostCertificate {
 
 export interface HostCa {
   uuid: string;
+  refid: string;
   descr: string;
   common_name: string | null;
   valid_from: string | null;
@@ -288,6 +491,7 @@ export interface Rule {
   destination_net: string;
   destination_port: string | null;
   enabled: boolean;
+  log: boolean;
   created_at: string;
   updated_at: string;
   target_host_ids: string[];
@@ -310,10 +514,29 @@ export interface RuleCreate {
   destination_net: string;
   destination_port: string | null;
   enabled: boolean;
+  log?: boolean;
   target_host_ids: string[];
   target_group_ids: string[];
 }
 
+export interface UnmanagedRule {
+  uuid: string;
+  description: string;
+  interface: string;
+  interface_label: string;
+  direction: string;
+  action: string;
+  protocol: string;
+  source_net: string;
+  source_port: string;
+  destination_net: string;
+  destination_port: string;
+  enabled: boolean;
+  log: boolean;
+  adoptable: boolean;
+  reasons: string[];
+}
+
 export type PolicyAliasType = "host" | "network" | "port" | "networkgroup" | "mac" | "asn";
 
 export interface PolicyAlias {
@@ -882,6 +1105,22 @@ export const api = {
     request<Host>(`/hosts/${id}`, { method: "PATCH", body: JSON.stringify(data) }),
   deleteHost: (id: string) => request<void>(`/hosts/${id}`, { method: "DELETE" }),
   getLiveRules: (id: string) => request<LiveRule[]>(`/hosts/${id}/live-rules`),
+  getHostNetwork: (id: string) => request<HostNetwork>(`/hosts/${id}/network`),
+  listNetworkObjects: (id: string, kind: NetworkKind) => request<NetworkObjects>(`/hosts/${id}/network/objects/${kind}`),
+  getNetworkDrift: () => request<{ clusters: ClusterNetworkDrift[] }>("/network/drift"),
+  listSnapshots: (id: string) => request<{ supported: boolean; rows: HostSnapshot[] }>(`/hosts/${id}/snapshots`),
+  createSnapshot: (id: string, name: string, note: string) =>
+    request<HostSnapshot>(`/hosts/${id}/snapshots`, { method: "POST", body: JSON.stringify({ name, note }) }),
+  deleteSnapshot: (id: string, uuid: string) => request<void>(`/hosts/${id}/snapshots/${uuid}`, { method: "DELETE" }),
+  getNetworkItem: (id: string, kind: NetworkKind, uuid: string) => request<Record<string, string>>(`/hosts/${id}/network/item/${kind}/${uuid}`),
+  getNetworkTemplate: (id: string, kind: NetworkKind) => request<NetworkTemplate>(`/hosts/${id}/network/template/${kind}`),
+  previewNetworkChange: (id: string, data: NetworkChangeRequest) =>
+    request<NetworkChangePreview>(`/hosts/${id}/network/changes/preview`, { method: "POST", body: JSON.stringify(data) }),
+  executeNetworkChange: (id: string, data: NetworkChangeRequest, previewToken: string, acknowledge: boolean) =>
+    request<NetworkChangeResult>(`/hosts/${id}/network/changes`, {
+      method: "POST",
+      body: JSON.stringify({ ...data, preview_token: previewToken, acknowledge }),
+    }),
   getHostPortForwards: (id: string) => request<NatLiveSplit>(`/port-forward/hosts/${id}/live`),
   getHostOneToOne: (id: string) => request<NatLiveSplit>(`/one-to-one/hosts/${id}/live`),
   getHostOutboundNat: (id: string) => request<NatLiveSplit>(`/outbound-nat/hosts/${id}/live`),
@@ -908,6 +1147,8 @@ export const api = {
 
   listRules: () => request<Rule[]>("/rules"),
   createRule: (data: RuleCreate) => request<Rule>("/rules", { method: "POST", body: JSON.stringify(data) }),
+  listUnmanagedRules: (hostId: string) => request<UnmanagedRule[]>(`/rules/unmanaged?host_id=${hostId}`),
+  adoptRule: (hostId: string, ruleUuid: string) => request<Rule>("/rules/adopt", { method: "POST", body: JSON.stringify({ host_id: hostId, rule_uuid: ruleUuid }) }),
   updateRule: (id: string, data: RuleCreate, expectedUpdatedAt: string) => request<Rule>(`/rules/${id}`, { method: "PUT", body: JSON.stringify({ ...data, expected_updated_at: expectedUpdatedAt }) }),
   previewRule: (id: string) => request<RulePreview>(`/rules/${id}/preview`),
   ruleRevisions: (id: string) => request<RuleRevision[]>(`/rules/${id}/revisions`),
@@ -1234,6 +1475,7 @@ export interface NotificationSettings {
   maintenance_unknown_enabled: boolean;
   carp_health_enabled: boolean;
   nat_drift_enabled: boolean;
+  network_drift_enabled: boolean;
   carp_auto_revert_failed_enabled: boolean;
   poll_interval_seconds: number;
   updated_at: string;
@@ -1260,6 +1502,7 @@ export interface NotificationSettingsUpdate {
   maintenance_unknown_enabled?: boolean;
   carp_health_enabled?: boolean;
   nat_drift_enabled?: boolean;
+  network_drift_enabled?: boolean;
   carp_auto_revert_failed_enabled?: boolean;
   poll_interval_seconds?: number;
 }
@@ -1283,7 +1526,7 @@ export interface LogSettingsUpdate {
 
 export type ProblemType =
   | "host_offline" | "cert_expiry" | "rule_drift" | "revert_failed" | "maintenance_unknown"
-  | "carp_split_brain" | "nat_drift" | "carp_auto_revert_failed";
+  | "carp_split_brain" | "nat_drift" | "carp_auto_revert_failed" | "network_drift";
 
 export interface CarpEvent {
   id: string;

frontend/lib/i18n/de.json

@@ -62,7 +62,8 @@
         "maintenanceUnknown": "Wartungsergebnis unklar",
         "carpHealth": "CARP-Zustand kritisch (Split-Brain / kein Master)",
         "natDrift": "NAT-Drift im Cluster",
-        "carpAutoRevertFailed": "CARP-Auto-Revert fehlgeschlagen"
+        "carpAutoRevertFailed": "CARP-Auto-Revert fehlgeschlagen",
+        "networkDrift": "Netzwerk-Abweichung im Cluster"
       },
       "pollInterval": "Prüfintervall (Sekunden)",
       "pollHint": "Mindestens 60s, um die Firewalls nicht unnötig zu belasten."
@@ -122,10 +123,12 @@
     "groups": {
       "overview": "Übersicht",
       "policy": "Regelwerk",
+      "network": "Netzwerk",
       "vpn": "VPN",
       "certificates": "Zertifikate",
       "monitoring": "Monitoring",
-      "system": "System"
+      "system": "System",
+      "hostsystem": "Host-System"
     },
     "items": {
       "dashboard": "Dashboard",
@@ -136,6 +139,13 @@
       "groups": "Gruppen",
       "aliases": "Aliase",
       "nat": "NAT",
+      "network-interfaces": "Schnittstellen",
+      "network-vlans": "VLANs",
+      "network-vips": "Virtuelle IPs",
+      "network-gateways": "Gateways",
+      "network-routes": "Routen",
+      "network-dns": "DNS",
+      "network-dhcp": "DHCP",
       "ipsec": "IPsec-VPN",
       "openvpn": "OpenVPN",
       "wireguard": "WireGuard",
@@ -144,7 +154,13 @@
       "audit": "Audit",
       "updates": "Update Center",
       "settings": "Einstellungen",
-      "users": "Benutzer"
+      "users": "Benutzer",
+      "network-devices": "Geräte",
+      "network-compare": "Abgleich",
+      "hostsystem-tunables": "Tunables",
+      "hostsystem-cron": "Cron",
+      "hostsystem-syslog": "Syslog",
+      "hostsystem-snapshots": "Snapshots"
     }
   },
   "dashboard": {
@@ -231,7 +247,8 @@
     "saving": "Speichern…",
     "create": "Host anlegen",
     "editTitle": "Host bearbeiten: {name}",
-    "active": "Aktiv"
+    "active": "Aktiv",
+    "baseUrlEditHint": "Neue Adresse eintragen, wenn die Firewall eine andere IP bekommen hat (z. B. nach einer Änderung der Verwaltungs-Schnittstelle). Verlauf und Zuordnungen bleiben erhalten."
   },
   "rules": {
     "title": "Firewall-Regeln",
@@ -310,7 +327,34 @@
     "actionBlock": "blockieren",
     "actionReject": "ablehnen",
     "dirIn": "eingehend",
-    "dirOut": "ausgehend"
+    "dirOut": "ausgehend",
+    "adopt": {
+      "button": "Von Firewall übernehmen",
+      "title": "Regeln von der Firewall übernehmen",
+      "intro": "Hier stehen Regeln, die direkt in OPNsense angelegt wurden. Nach der Übernahme kannst du sie in OPNexus bearbeiten und ausrollen. Die Übernahme selbst ändert nichts auf der Firewall.",
+      "host": "Firewall",
+      "none": "Keine nicht verwalteten Regeln gefunden.",
+      "action": "Übernehmen",
+      "adopted": "„{name}“ übernommen.",
+      "failed": "Übernahme fehlgeschlagen",
+      "loadFailed": "Regeln konnten nicht geladen werden.",
+      "notPossible": "Nicht übernehmbar",
+      "reasons": {
+        "automatic": "Systemregel",
+        "already_managed": "Wird bereits verwaltet",
+        "interface_not_single": "Mehrere oder keine Schnittstelle (Floating-Regel)",
+        "negated_interface": "Schnittstelle ist invertiert",
+        "negated_source": "Quelle ist invertiert (NOT)",
+        "negated_destination": "Ziel ist invertiert (NOT)",
+        "received_on": "Nutzt „Empfangen auf“",
+        "not_quick": "Keine Quick-Regel (letzter Treffer gewinnt)",
+        "direction_unsupported": "Richtung ist weder ein noch aus",
+        "action_unsupported": "Aktion nicht unterstützt",
+        "ipprotocol_unsupported": "IPv4 und IPv6 in einer Regel",
+        "no_description": "Beschreibung fehlt – bitte in OPNsense setzen"
+      }
+    },
+    "logPackets": "Protokollieren"
   },
   "login": {
     "prompt": "Bitte anmelden",
@@ -438,6 +482,10 @@
     "ZIELE_ODER_DEPLOYMENT_WURDEN_GEAENDERT_VORSCHAU_AKTUALISIEREN": "Ziele oder Deployment wurden geändert. Vorschau aktualisieren.",
     "ZIEL_HOST_NICHT_GEFUNDEN": "Ziel-Host nicht gefunden",
     "OUTBOUND_MODE_UNREADABLE": "Outbound-Modus auf {host} nicht lesbar: {reason}",
+    "INVALID_CHARACTERS": "Die Eingabe enthält ein nicht speicherbares Zeichen (z. B. ein NUL-Zeichen)",
+    "UPSTREAM_REJECTED": "Die Firewall hat die Anfrage abgelehnt: {reason}",
+    "SERVICE_NOT_FOUND": "{service}: Dienst auf dieser Firewall nicht gefunden",
+    "SERVICE_LOCKED": "{service}: Dienst ist gesperrt und kann nicht per API gesteuert werden",
     "OUTBOUND_MODE_BLOCKS_PUSH": "{host}: Outbound-NAT-Modus „{mode}“ erlaubt keinen Push. Modus in OPNsense selbst auf Hybrid/Manuell umstellen. OPNexus ändert diesen Modus nicht.",
     "GROUP_CANNOT_BE_OWN_PARENT": "Eine Gruppe kann nicht ihr eigener Parent sein",
     "GROUP_HIERARCHY_CYCLE": "Diese Zuordnung würde einen Zyklus in der Gruppenhierarchie erzeugen",
@@ -453,7 +501,14 @@
     "TOTP_INVALID": "Ungültiger Zwei-Faktor-Code",
     "TOTP_ALREADY_ENABLED": "Zwei-Faktor-Anmeldung ist bereits aktiv",
     "TOTP_NOT_ENABLED": "Zwei-Faktor-Anmeldung ist nicht aktiv",
-    "TOTP_SETUP_MISSING": "Es wurde keine Einrichtung gestartet"
+    "TOTP_SETUP_MISSING": "Es wurde keine Einrichtung gestartet",
+    "RULE_NOT_ADOPTABLE": "Diese Regel kann nicht übernommen werden ({reasons})",
+    "NETWORK_ACK_REQUIRED": "Diese Änderung kann die Verbindung zur Firewall trennen und muss ausdrücklich bestätigt werden ({reasons})",
+    "NETWORK_APPLY_UNCERTAIN": "Die Änderung wurde geschrieben, das Anwenden auf „{host}“ ist aber fehlgeschlagen oder unklar. Stand auf der Firewall prüfen; Backup: {backup_id}",
+    "NETWORK_BACKUP_FAILED": "Backup von „{host}“ vor der Änderung fehlgeschlagen – es wurde nichts geändert",
+    "NETWORK_CHANGE_BLOCKED": "Die Änderung ist nicht möglich ({reasons})",
+    "NETWORK_FIELD_INVALID": "Ungültiges Feld: {field}",
+    "NETWORK_ITEM_NOT_FOUND": "Das Objekt existiert auf der Firewall nicht (mehr)"
   },
   "workflow": {
     "attention": "Fehler prüfen",
@@ -840,7 +895,9 @@
     "lifetime": "Gültigkeit (Tage)",
     "carefRequired": "CA-Referenz (caref) — Pflicht",
     "carefOptional": "CA-Referenz (caref) — leer = selbstsigniert",
-    "carefPlaceholder": "UUID einer bereits vorhandenen internen CA auf diesem Host",
+    "carefPlaceholder": "Refid einer bereits vorhandenen internen CA auf diesem Host",
+    "carefChoose": "Bitte wählen",
+    "carefSelfSigned": "Selbstsigniert (keine CA)",
     "csr": "CSR (PEM)",
     "certificate": "Zertifikat (PEM)",
     "privateKeyKeep": "Privater Schlüssel (PEM) — leer lassen = unverändert",
@@ -1632,6 +1689,7 @@
     "cancelWarnStrong": "keinen",
     "cancelWarnPost": " erfolgreichen Abschluss — es schließt den Datensatz nur, damit dieser Host/Cluster nicht weiter gesperrt bleibt. Nur nutzen, wenn der erwartete Zustand nachweislich nie eingetreten ist (z. B. CARP-Rollenwechsel hängt fest).",
     "logTitle": "Update-Protokoll · {host}",
+    "logEmpty": "Kein Protokoll vorhanden. OPNsense leert es beim Neustart – nach einem erfolgreichen Update ist das normal. Maßgeblich ist der angezeigte Status der Firewall.",
     "readOnlyBadge": "Nur Lesen",
     "lockedPrefix": "Gesperrt",
     "tipCheckAll": "Fragt alle geeigneten Firewalls nach neuen Updates. Es wird nichts installiert.",
@@ -1716,5 +1774,320 @@
     "resetTip": "Entfernt die Zwei-Faktor-Anmeldung dieses Benutzers, z. B. wenn das Gerät verloren ging.",
     "resetConfirm": "Zwei-Faktor-Anmeldung für {name} zurücksetzen?",
     "resetDone": "Zwei-Faktor für {name} zurückgesetzt."
+  },
+  "network": {
+    "host": "Firewall",
+    "loadFailed": "Netzwerkdaten konnten nicht geladen werden.",
+    "empty": "Keine Einträge.",
+    "unassigned": "nicht zugewiesen",
+    "management": "Verwaltung",
+    "default": "Standard",
+    "active": "Aktiv",
+    "managementNote": "OPNexus erreicht diese Firewall über {device}. Änderungen an dieser Schnittstelle können die Verbindung trennen und werden später besonders abgesichert.",
+    "managementUnknown": "Über welche Schnittstelle OPNexus diese Firewall erreicht, lässt sich nicht bestimmen (z. B. über NAT oder eine CARP-Adresse).",
+    "unavailable": "Nicht abrufbar von dieser Firewall: {sections}.",
+    "cannotConfigure": "Diese OPNsense-Version erlaubt keine IP-Konfiguration von Schnittstellen per API (ab ca. 26.7.6).",
+    "sections": {
+      "assignments": "Schnittstellen-Zuweisung",
+      "vlans": "VLANs",
+      "vips": "Virtuelle IPs",
+      "gateways": "Gateways",
+      "routes": "Routen",
+      "dns_hosts": "DNS-Einträge",
+      "dhcp_hosts": "DHCP-Hosts",
+      "kea_subnets": "DHCP-Subnetze",
+      "kea_reservations": "DHCP-Reservierungen"
+    },
+    "col": {
+      "device": "Gerät",
+      "name": "Name",
+      "status": "Status",
+      "addresses": "Adressen",
+      "type": "Typ",
+      "vlan": "VLAN",
+      "parent": "Eltern-Gerät",
+      "tag": "Tag",
+      "pcp": "Priorität (PCP)",
+      "address": "Adresse",
+      "interface": "Schnittstelle",
+      "mode": "Modus",
+      "advskew": "Advskew",
+      "priority": "Priorität",
+      "network": "Netzwerk",
+      "gateway": "Gateway"
+    },
+    "kinds": {
+      "vlan": "VLAN",
+      "vip": "Virtuelle IP",
+      "gateway": "Gateway",
+      "route": "Route",
+      "interface": "Schnittstelle",
+      "dns_host": "DNS-Eintrag",
+      "dhcp_host": "DHCP-Host (dnsmasq)",
+      "kea_subnet": "DHCP-Subnetz (Kea)",
+      "kea_reservation": "DHCP-Reservierung (Kea)",
+      "tunable": "Tunable",
+      "cron_job": "Cron-Job",
+      "syslog_destination": "Syslog-Ziel",
+      "gateway_group": "Gateway-Gruppen",
+      "lagg": "LAGG",
+      "bridge": "Bridge",
+      "loopback": "Loopback",
+      "gre": "GRE-Tunnel",
+      "dns_forward": "DNS-Weiterleitungen",
+      "dhcp_range": "DHCP-Bereiche (dnsmasq)"
+    },
+    "field": {
+      "if": "Eltern-Schnittstelle",
+      "tag": "VLAN-Tag",
+      "pcp": "Priorität (PCP)",
+      "descr": "Beschreibung",
+      "interface": "Schnittstelle",
+      "mode": "Modus",
+      "network": "Adresse / Präfix (z. B. 192.168.1.50/24)",
+      "vhid": "VHID",
+      "advbase": "Advbase",
+      "advskew": "Advskew",
+      "password": "CARP-Passwort",
+      "name": "Name",
+      "ipprotocol": "IP-Version",
+      "gateway": "Gateway",
+      "defaultgw": "Standard-Gateway",
+      "defaultgwHint": "Als Standard-Gateway verwenden",
+      "monitor_disable": "Überwachung",
+      "monitor_disableHint": "Gateway-Überwachung deaktivieren",
+      "priority": "Priorität",
+      "disabled": "Deaktiviert",
+      "disabledHint": "Gateway deaktivieren",
+      "enabled": "Aktiv",
+      "enabledHint": "Route aktiv",
+      "fargw": "Fernes Gateway",
+      "force_down": "Als ausgefallen markieren",
+      "monitor": "Monitor-IP",
+      "weight": "Gewicht",
+      "nosync": "Nicht synchronisieren",
+      "peer": "Peer",
+      "peer6": "Peer (IPv6)",
+      "proto": "Protokoll",
+      "enable": "Aktiviert",
+      "enableHint": "Schnittstelle aktivieren",
+      "type4": "IPv4-Typ",
+      "ipaddr": "IPv4-Adresse / Präfix",
+      "type6": "IPv6-Typ",
+      "ipaddrv6": "IPv6-Adresse / Präfix",
+      "gatewayv6": "IPv6-Gateway",
+      "mtu": "MTU",
+      "blockpriv": "Private Netze sperren",
+      "blockprivHint": "Private Netzwerke blockieren",
+      "blockbogons": "Bogon-Netze sperren",
+      "blockbogonsHint": "Bogon-Netzwerke blockieren",
+      "lock": "Sperre",
+      "lockHint": "Löschen verhindern (Schnittstelle sperren)",
+      "hostname": "Hostname",
+      "domain": "Domain",
+      "rr": "Eintragstyp",
+      "server": "Ziel-Adresse",
+      "mx": "Mail-Server (MX)",
+      "mxprio": "MX-Priorität",
+      "addptr": "PTR-Eintrag",
+      "addptrHint": "Passenden PTR-Eintrag anlegen",
+      "description": "Beschreibung",
+      "host": "Host",
+      "ip": "IP-Adresse(n)",
+      "hwaddr": "MAC-Adresse(n)",
+      "client_id": "Client-ID",
+      "lease_time": "Lease-Dauer (Sekunden)",
+      "local": "Lokal",
+      "localHint": "Nur lokal auflösen",
+      "ignore": "Ignorieren",
+      "ignoreHint": "Anfragen dieses Geräts ignorieren",
+      "subnet": "Subnetz",
+      "pools": "Adress-Pool (z. B. 192.168.1.100-192.168.1.200)",
+      "valid_lifetime": "Gültigkeit der Leases (Sekunden)",
+      "next_server": "Next-Server (TFTP)",
+      "ip_address": "IP-Adresse",
+      "hw_address": "MAC-Adresse",
+      "option_data": {
+        "routers": "Gateway (Router)",
+        "domain_name_servers": "DNS-Server",
+        "domain_name": "Domain-Name",
+        "ntp_servers": "NTP-Server"
+      },
+      "tunable": "Tunable",
+      "value": "Wert",
+      "default_value": "Standardwert",
+      "minutes": "Minute",
+      "hours": "Stunde",
+      "days": "Tag",
+      "months": "Monat",
+      "weekdays": "Wochentag",
+      "who": "Benutzer",
+      "command": "Befehl",
+      "parameters": "Parameter",
+      "transport": "Transport",
+      "program": "Programme",
+      "level": "Level",
+      "facility": "Facility",
+      "rfc5424": "RFC 5424",
+      "rfc5424Hint": "RFC-5424-Format verwenden",
+      "item": "Gateways (Stufe 1)",
+      "item2": "Gateways (Stufe 2)",
+      "item3": "Gateways (Stufe 3)",
+      "item4": "Gateways (Stufe 4)",
+      "item5": "Gateways (Stufe 5)",
+      "trigger": "Auslöser",
+      "poolopts": "Pool-Optionen",
+      "members": "Mitglieder",
+      "primary_member": "Primäres Mitglied",
+      "lacp_fast_timeout": "LACP Fast-Timeout",
+      "lagghash": "Hash-Verfahren",
+      "laggif": "Gerät",
+      "bridgeif": "Gerät",
+      "linklocal": "Link-Local",
+      "linklocalHint": "Link-Local-Adresse automatisch vergeben",
+      "enablestp": "STP",
+      "enablestpHint": "Spanning Tree aktivieren",
+      "deviceId": "Geräte-Nr.",
+      "local-addr": "Lokale Adresse",
+      "remote-addr": "Gegenstelle",
+      "tunnel-local-addr": "Tunnel-Adresse lokal",
+      "tunnel-remote-addr": "Tunnel-Adresse Gegenstelle",
+      "tunnel-remote-net": "Tunnel-Präfix",
+      "greif": "Gerät",
+      "type": "Typ",
+      "verify": "Zertifikat prüfen",
+      "forward_tcp_upstream": "TCP zum Upstream",
+      "forward_tcp_upstreamHint": "Anfragen per TCP weiterleiten",
+      "forward_first": "Zuerst weiterleiten",
+      "forward_firstHint": "Erst weiterleiten, danach selbst auflösen",
+      "start_addr": "Von",
+      "end_addr": "Bis",
+      "subnet_mask": "Subnetzmaske",
+      "domain_type": "Domain-Art"
+    },
+    "risks": {
+      "management_interface": "Diese Änderung betrifft {device}, die Schnittstelle, über die OPNexus die Firewall erreicht. Die Verbindung kann abbrechen.",
+      "management_address": "Die Adresse {address} ist die, unter der OPNexus die Firewall erreicht.",
+      "management_unknown": "Über welche Schnittstelle OPNexus diese Firewall erreicht, ist nicht bestimmbar (NAT oder CARP-Adresse). Die Auswirkung kann nicht eingeschätzt werden.",
+      "default_gateway": "{name} ist das Standard-Gateway. Ohne es kann der Verkehr ins Netz ausfallen.",
+      "default_gateway_change": "Das Standard-Gateway wird gewechselt oder gesetzt. Der gesamte ausgehende Verkehr nimmt danach einen anderen Weg.",
+      "management_gateway": "{name} hängt an der Schnittstelle, über die OPNexus die Firewall erreicht.",
+      "default_route": "Eine Standardroute ({network}) verändert den Weg für fast den gesamten Verkehr.",
+      "route_covers_management": "Die Route {network} deckt die Adresse der Firewall ab. Die Antworten an OPNexus können einen anderen Weg nehmen.",
+      "interface_rules_removed": "Beim Entfernen löscht OPNsense selbst {count} Regel(n), die diese Schnittstelle nutzen: {names}",
+      "management_member": "{device} ist die Schnittstelle, über die OPNexus die Firewall erreicht, und gehört zu diesem Gerät. Die Verbindung kann abbrechen.",
+      "tunable_change": "Tunables ändern das Verhalten des gesamten Systems; manche greifen erst nach einem Neustart und manche können die Firewall unbrauchbar machen."
+    },
+    "warnings": {
+      "carp_change": "CARP-Änderungen können einen Wechsel zwischen Master und Backup auslösen.",
+      "cluster_peers": "Diese Firewall gehört zu einem Cluster. Dieselbe Änderung muss ggf. auch auf {hosts} erfolgen. VIPs und Gateways werden nicht automatisch synchronisiert.",
+      "core_interface": "{name} ist eine Kern-Schnittstelle der Firewall. Änderungen wirken sich auf alle Regeln und Dienste darauf aus.",
+      "gateway_group_in_use": "Regeln, die diese Gateway-Gruppe nutzen, verlieren ihr Ziel."
+    },
+    "blocks": {
+      "api_unavailable": "Diese Firewall stellt dafür keine API bereit ({section}).",
+      "nothing_to_change": "Es gibt nichts zu ändern.",
+      "interface_api_unavailable": "Diese OPNsense-Version kann Schnittstellen nicht per API konfigurieren (ab ca. 26.7.6).",
+      "interface_changes_pending": "Auf der Firewall warten bereits vorgemerkte Schnittstellen-Änderungen auf das Anwenden. Zuerst dort prüfen und anwenden oder verwerfen.",
+      "interface_locked": "Die Schnittstelle ist gesperrt. Zuerst die Sperre aufheben, dann löschen.",
+      "tunable_default_row": "Das ist eine Vorgabe der Firewall. Zum Ändern einen eigenen Eintrag mit „Überschreiben“ anlegen."
+    },
+    "change": {
+      "title": {
+        "add": "{kind} hinzufügen",
+        "set": "{kind} bearbeiten",
+        "del": "{kind} löschen"
+      },
+      "loadFailed": "Das Formular konnte nicht geladen werden.",
+      "previewFailed": "Die Vorschau konnte nicht erstellt werden.",
+      "applyFailed": "Die Änderung konnte nicht angewendet werden.",
+      "keepUnchanged": "unverändert lassen…",
+      "toPreview": "Weiter zur Vorschau",
+      "back": "Zurück",
+      "apply": "Jetzt anwenden",
+      "riskTitle": "Achtung, diese Änderung kann die Verbindung kappen",
+      "noChanges": "Keine Änderungen.",
+      "backupNote": "Vor dem Anwenden wird ein Backup der Firewall-Konfiguration gespeichert. Ein automatisches Zurückrollen gibt es nicht: Wenn die Verbindung abbricht, kann OPNexus die Änderung nicht selbst rückgängig machen.",
+      "ack": "Ich habe verstanden, dass diese Änderung die Verbindung zu {host} trennen kann und nicht automatisch zurückgerollt wird.",
+      "typeHost": "Zur Bestätigung den Namen der Firewall eingeben: {host}",
+      "applied": "Änderung angewendet.",
+      "verified": "Angewendet und geprüft",
+      "notVerified": "Angewendet, Prüfung weicht ab",
+      "mismatch": "Die Firewall meldet abweichende Werte: {fields}",
+      "backupId": "Backup vor der Änderung: {id}",
+      "col": {
+        "field": "Feld",
+        "before": "Vorher",
+        "after": "Nachher"
+      },
+      "invalidValue": "Ungültiger Wert.",
+      "unreachable": "Die Änderung wurde angewendet, aber „{host}“ antwortet unter der bisherigen Adresse nicht mehr. Wurde die Verwaltungs-Adresse geändert, die neue Adresse unter Hosts › Bearbeiten eintragen. Das Backup vor der Änderung bleibt gespeichert.",
+      "transferHint": "Dieselbe Änderung auch auf den Partner im Cluster anwenden? Zuerst den Backup-Knoten, dann den Master.",
+      "transfer": "Auf {host} übertragen"
+    },
+    "rowAdd": "Hinzufügen",
+    "rowEdit": "Bearbeiten",
+    "rowDelete": "Löschen",
+    "hint": {
+      "interfaceDescr": "Nur Buchstaben, Ziffern und Unterstriche (keine Leerzeichen oder Bindestriche)."
+    },
+    "dhcp": {
+      "dnsmasq": "Hosts (dnsmasq: statisches DHCP und DNS)",
+      "keaSubnets": "Subnetze (Kea)",
+      "keaReservations": "Reservierungen (Kea)"
+    },
+    "objectsUnavailable": "Diese OPNsense-Version bietet dafür keine API.",
+    "override": "Überschreiben",
+    "compare": {
+      "loadFailed": "Der Abgleich konnte nicht geladen werden.",
+      "noClusters": "Kein Cluster mit mindestens zwei Hosts vorhanden.",
+      "intro": "Vergleicht die Netzwerk-Konfiguration der Knoten eines Clusters. Adressen, CARP-Advskew und das aktive Standard-Gateway dürfen sich unterscheiden und werden nicht verglichen.",
+      "unreachable": "Nicht erreichbar: {hosts}",
+      "same": "Identisch",
+      "count": "{count} Abweichung(en)",
+      "category": "Bereich",
+      "object": "Objekt",
+      "state": "Zustand",
+      "missing": "Fehlt",
+      "different": "Weicht ab",
+      "absent": "fehlt",
+      "categories": {
+        "interfaces": "Schnittstelle",
+        "vlans": "VLAN",
+        "vips": "Virtuelle IP",
+        "gateways": "Gateway",
+        "routes": "Route",
+        "dns_hosts": "DNS-Eintrag",
+        "dhcp_hosts": "DHCP-Host",
+        "kea_subnets": "DHCP-Subnetz",
+        "kea_reservations": "DHCP-Reservierung"
+      }
+    }
+  },
+  "hostsystem": {
+    "intro": {
+      "tunables": "Systemparameter der Firewall (sysctl). Die Werte der Firewall selbst bleiben unberührt, eigene Einträge überschreiben sie.",
+      "cron": "Zeitgesteuerte Aufgaben, die die Firewall selbst ausführt.",
+      "syslog": "Entfernte Log-Ziele, an die die Firewall ihre Meldungen schickt.",
+      "snapshots": "ZFS-Snapshots der Firewall als zusätzliches Sicherheitsnetz vor größeren Änderungen. Aktivieren (mit Neustart) geschieht bewusst nur in OPNsense selbst."
+    },
+    "snapshots": {
+      "create": "Snapshot anlegen",
+      "createHint": "Der Snapshot hält den aktuellen Systemzustand fest. Er ersetzt kein Konfigurations-Backup.",
+      "name": "Name",
+      "nameHint": "Buchstaben, Ziffern, Punkt, Unterstrich und Bindestrich.",
+      "note": "Notiz",
+      "state": "Zustand",
+      "size": "Größe",
+      "createdAt": "Erstellt",
+      "activeNow": "aktiv",
+      "activeNext": "aktiv nach Neustart",
+      "unsupported": "Diese Firewall unterstützt keine Snapshots (kein ZFS).",
+      "created": "Snapshot „{name}“ angelegt.",
+      "createFailed": "Snapshot konnte nicht angelegt werden.",
+      "deleted": "Snapshot „{name}“ gelöscht.",
+      "deleteFailed": "Snapshot konnte nicht gelöscht werden.",
+      "deleteConfirm": "Snapshot „{name}“ wirklich löschen?"
+    }
   }
 }

frontend/lib/i18n/en.json

@@ -62,7 +62,8 @@
         "maintenanceUnknown": "Maintenance outcome unclear",
         "carpHealth": "CARP state critical (split-brain / no master)",
         "natDrift": "NAT drift in the cluster",
-        "carpAutoRevertFailed": "CARP auto-revert failed"
+        "carpAutoRevertFailed": "CARP auto-revert failed",
+        "networkDrift": "Network differences in the cluster"
       },
       "pollInterval": "Check interval (seconds)",
       "pollHint": "At least 60s, so the firewalls are not loaded unnecessarily."
@@ -122,10 +123,12 @@
     "groups": {
       "overview": "Overview",
       "policy": "Policy",
+      "network": "Network",
       "vpn": "VPN",
       "certificates": "Certificates",
       "monitoring": "Monitoring",
-      "system": "System"
+      "system": "System",
+      "hostsystem": "Host system"
     },
     "items": {
       "dashboard": "Dashboard",
@@ -136,6 +139,13 @@
       "groups": "Groups",
       "aliases": "Aliases",
       "nat": "NAT",
+      "network-interfaces": "Interfaces",
+      "network-vlans": "VLANs",
+      "network-vips": "Virtual IPs",
+      "network-gateways": "Gateways",
+      "network-routes": "Routes",
+      "network-dns": "DNS",
+      "network-dhcp": "DHCP",
       "ipsec": "IPsec VPN",
       "openvpn": "OpenVPN",
       "wireguard": "WireGuard",
@@ -144,7 +154,13 @@
       "audit": "Audit",
       "updates": "Update Center",
       "settings": "Settings",
-      "users": "Users"
+      "users": "Users",
+      "network-devices": "Devices",
+      "network-compare": "Compare",
+      "hostsystem-tunables": "Tunables",
+      "hostsystem-cron": "Cron",
+      "hostsystem-syslog": "Syslog",
+      "hostsystem-snapshots": "Snapshots"
     }
   },
   "dashboard": {
@@ -231,7 +247,8 @@
     "saving": "Saving…",
     "create": "Create host",
     "editTitle": "Edit host: {name}",
-    "active": "Active"
+    "active": "Active",
+    "baseUrlEditHint": "Enter the new address if the firewall got a different IP (e.g. after changing its management interface). History and assignments are kept."
   },
   "rules": {
     "title": "Firewall rules",
@@ -310,7 +327,34 @@
     "actionBlock": "block",
     "actionReject": "reject",
     "dirIn": "inbound",
-    "dirOut": "outbound"
+    "dirOut": "outbound",
+    "adopt": {
+      "button": "Adopt from firewall",
+      "title": "Adopt rules from the firewall",
+      "intro": "These rules were created directly in OPNsense. Once adopted you can edit and deploy them from OPNexus. Adopting itself changes nothing on the firewall.",
+      "host": "Firewall",
+      "none": "No unmanaged rules found.",
+      "action": "Adopt",
+      "adopted": "Adopted “{name}”.",
+      "failed": "Adopting failed",
+      "loadFailed": "Could not load rules.",
+      "notPossible": "Cannot be adopted",
+      "reasons": {
+        "automatic": "System rule",
+        "already_managed": "Already managed",
+        "interface_not_single": "Several or no interface (floating rule)",
+        "negated_interface": "Interface is inverted",
+        "negated_source": "Source is inverted (NOT)",
+        "negated_destination": "Destination is inverted (NOT)",
+        "received_on": "Uses “received on”",
+        "not_quick": "Not a quick rule (last match wins)",
+        "direction_unsupported": "Direction is neither in nor out",
+        "action_unsupported": "Action not supported",
+        "ipprotocol_unsupported": "IPv4 and IPv6 in one rule",
+        "no_description": "Description missing – please set one in OPNsense"
+      }
+    },
+    "logPackets": "Log matching packets"
   },
   "login": {
     "prompt": "Please sign in",
@@ -438,6 +482,10 @@
     "ZIELE_ODER_DEPLOYMENT_WURDEN_GEAENDERT_VORSCHAU_AKTUALISIEREN": "The targets or deployment changed. Refresh the preview.",
     "ZIEL_HOST_NICHT_GEFUNDEN": "Target host not found",
     "OUTBOUND_MODE_UNREADABLE": "Outbound mode on {host} not readable: {reason}",
+    "INVALID_CHARACTERS": "The input contains a character that cannot be stored (e.g. a NUL character)",
+    "UPSTREAM_REJECTED": "The firewall rejected the request: {reason}",
+    "SERVICE_NOT_FOUND": "{service}: service not found on this firewall",
+    "SERVICE_LOCKED": "{service}: service is locked and cannot be controlled via the API",
     "OUTBOUND_MODE_BLOCKS_PUSH": "{host}: outbound NAT mode “{mode}” does not allow a push. Switch the mode to Hybrid/Manual in OPNsense itself. OPNexus does not change this mode.",
     "GROUP_CANNOT_BE_OWN_PARENT": "A group cannot be its own parent",
     "GROUP_HIERARCHY_CYCLE": "This assignment would create a cycle in the group hierarchy",
@@ -453,7 +501,14 @@
     "TOTP_INVALID": "Invalid two-factor code",
     "TOTP_ALREADY_ENABLED": "Two-factor authentication is already enabled",
     "TOTP_NOT_ENABLED": "Two-factor authentication is not enabled",
-    "TOTP_SETUP_MISSING": "No setup has been started"
+    "TOTP_SETUP_MISSING": "No setup has been started",
+    "RULE_NOT_ADOPTABLE": "This rule cannot be adopted ({reasons})",
+    "NETWORK_ACK_REQUIRED": "This change can cut the connection to the firewall and must be confirmed explicitly ({reasons})",
+    "NETWORK_APPLY_UNCERTAIN": "The change was written, but applying it on “{host}” failed or is unclear. Check the firewall; backup: {backup_id}",
+    "NETWORK_BACKUP_FAILED": "Backup of “{host}” before the change failed – nothing was changed",
+    "NETWORK_CHANGE_BLOCKED": "The change is not possible ({reasons})",
+    "NETWORK_FIELD_INVALID": "Invalid field: {field}",
+    "NETWORK_ITEM_NOT_FOUND": "The object does not exist on the firewall (any more)"
   },
   "workflow": {
     "attention": "Check errors",
@@ -840,7 +895,9 @@
     "lifetime": "Validity (days)",
     "carefRequired": "CA reference (caref) — required",
     "carefOptional": "CA reference (caref) — empty = self-signed",
-    "carefPlaceholder": "UUID of an existing internal CA on this host",
+    "carefPlaceholder": "Refid of an existing internal CA on this host",
+    "carefChoose": "Please choose",
+    "carefSelfSigned": "Self-signed (no CA)",
     "csr": "CSR (PEM)",
     "certificate": "Certificate (PEM)",
     "privateKeyKeep": "Private key (PEM) — leave empty = unchanged",
@@ -1632,6 +1689,7 @@
     "cancelWarnStrong": "not confirm",
     "cancelWarnPost": " a successful completion — it only closes the record so this host/cluster is no longer locked. Only use it if the expected state demonstrably never occurred (e.g. a CARP role switch is stuck).",
     "logTitle": "Update log · {host}",
+    "logEmpty": "No log available. OPNsense clears it on reboot – after a successful update that is normal. The firewall's status shown on this page is what counts.",
     "readOnlyBadge": "Read-only",
     "lockedPrefix": "Locked",
     "tipCheckAll": "Asks all eligible firewalls for new updates. Nothing is installed.",
@@ -1716,5 +1774,320 @@
     "resetTip": "Removes this user's two-factor sign-in, e.g. when the device was lost.",
     "resetConfirm": "Reset two-factor sign-in for {name}?",
     "resetDone": "Two-factor reset for {name}."
+  },
+  "network": {
+    "host": "Firewall",
+    "loadFailed": "Could not load network data.",
+    "empty": "No entries.",
+    "unassigned": "unassigned",
+    "management": "Management",
+    "default": "Default",
+    "active": "Active",
+    "managementNote": "OPNexus reaches this firewall through {device}. Changes to this interface can cut the connection and will get extra safeguards later.",
+    "managementUnknown": "Which interface OPNexus uses to reach this firewall cannot be determined (e.g. via NAT or a CARP address).",
+    "unavailable": "Not available from this firewall: {sections}.",
+    "cannotConfigure": "This OPNsense version does not allow configuring interface IPs through its API (from about 26.7.6).",
+    "sections": {
+      "assignments": "interface assignments",
+      "vlans": "VLANs",
+      "vips": "virtual IPs",
+      "gateways": "gateways",
+      "routes": "routes",
+      "dns_hosts": "DNS entries",
+      "dhcp_hosts": "DHCP hosts",
+      "kea_subnets": "DHCP subnets",
+      "kea_reservations": "DHCP reservations"
+    },
+    "col": {
+      "device": "Device",
+      "name": "Name",
+      "status": "Status",
+      "addresses": "Addresses",
+      "type": "Type",
+      "vlan": "VLAN",
+      "parent": "Parent device",
+      "tag": "Tag",
+      "pcp": "Priority (PCP)",
+      "address": "Address",
+      "interface": "Interface",
+      "mode": "Mode",
+      "advskew": "Advskew",
+      "priority": "Priority",
+      "network": "Network",
+      "gateway": "Gateway"
+    },
+    "kinds": {
+      "vlan": "VLAN",
+      "vip": "Virtual IP",
+      "gateway": "Gateway",
+      "route": "Route",
+      "interface": "Interface",
+      "dns_host": "DNS entry",
+      "dhcp_host": "DHCP host (dnsmasq)",
+      "kea_subnet": "DHCP subnet (Kea)",
+      "kea_reservation": "DHCP reservation (Kea)",
+      "tunable": "Tunable",
+      "cron_job": "Cron job",
+      "syslog_destination": "Syslog target",
+      "gateway_group": "Gateway groups",
+      "lagg": "LAGG",
+      "bridge": "Bridge",
+      "loopback": "Loopback",
+      "gre": "GRE tunnel",
+      "dns_forward": "DNS forwards",
+      "dhcp_range": "DHCP ranges (dnsmasq)"
+    },
+    "field": {
+      "if": "Parent interface",
+      "tag": "VLAN tag",
+      "pcp": "Priority (PCP)",
+      "descr": "Description",
+      "interface": "Interface",
+      "mode": "Mode",
+      "network": "Address / prefix (e.g. 192.168.1.50/24)",
+      "vhid": "VHID",
+      "advbase": "Advbase",
+      "advskew": "Advskew",
+      "password": "CARP password",
+      "name": "Name",
+      "ipprotocol": "IP version",
+      "gateway": "Gateway",
+      "defaultgw": "Default gateway",
+      "defaultgwHint": "Use as default gateway",
+      "monitor_disable": "Monitoring",
+      "monitor_disableHint": "Disable gateway monitoring",
+      "priority": "Priority",
+      "disabled": "Disabled",
+      "disabledHint": "Disable gateway",
+      "enabled": "Enabled",
+      "enabledHint": "Route enabled",
+      "fargw": "Far gateway",
+      "force_down": "Mark as down",
+      "monitor": "Monitor IP",
+      "weight": "Weight",
+      "nosync": "Do not sync",
+      "peer": "Peer",
+      "peer6": "Peer (IPv6)",
+      "proto": "Protocol",
+      "enable": "Enabled",
+      "enableHint": "Enable interface",
+      "type4": "IPv4 type",
+      "ipaddr": "IPv4 address / prefix",
+      "type6": "IPv6 type",
+      "ipaddrv6": "IPv6 address / prefix",
+      "gatewayv6": "IPv6 gateway",
+      "mtu": "MTU",
+      "blockpriv": "Block private networks",
+      "blockprivHint": "Block private networks",
+      "blockbogons": "Block bogon networks",
+      "blockbogonsHint": "Block bogon networks",
+      "lock": "Lock",
+      "lockHint": "Prevent removal (lock interface)",
+      "hostname": "Hostname",
+      "domain": "Domain",
+      "rr": "Record type",
+      "server": "Target address",
+      "mx": "Mail server (MX)",
+      "mxprio": "MX priority",
+      "addptr": "PTR record",
+      "addptrHint": "Create the matching PTR record",
+      "description": "Description",
+      "host": "Host",
+      "ip": "IP address(es)",
+      "hwaddr": "MAC address(es)",
+      "client_id": "Client ID",
+      "lease_time": "Lease time (seconds)",
+      "local": "Local",
+      "localHint": "Resolve locally only",
+      "ignore": "Ignore",
+      "ignoreHint": "Ignore requests from this device",
+      "subnet": "Subnet",
+      "pools": "Address pool (e.g. 192.168.1.100-192.168.1.200)",
+      "valid_lifetime": "Lease validity (seconds)",
+      "next_server": "Next server (TFTP)",
+      "ip_address": "IP address",
+      "hw_address": "MAC address",
+      "option_data": {
+        "routers": "Gateway (router)",
+        "domain_name_servers": "DNS servers",
+        "domain_name": "Domain name",
+        "ntp_servers": "NTP servers"
+      },
+      "tunable": "Tunable",
+      "value": "Value",
+      "default_value": "Default value",
+      "minutes": "Minute",
+      "hours": "Hour",
+      "days": "Day",
+      "months": "Month",
+      "weekdays": "Weekday",
+      "who": "User",
+      "command": "Command",
+      "parameters": "Parameters",
+      "transport": "Transport",
+      "program": "Programs",
+      "level": "Level",
+      "facility": "Facility",
+      "rfc5424": "RFC 5424",
+      "rfc5424Hint": "Use RFC 5424 format",
+      "item": "Gateways (tier 1)",
+      "item2": "Gateways (tier 2)",
+      "item3": "Gateways (tier 3)",
+      "item4": "Gateways (tier 4)",
+      "item5": "Gateways (tier 5)",
+      "trigger": "Trigger",
+      "poolopts": "Pool options",
+      "members": "Members",
+      "primary_member": "Primary member",
+      "lacp_fast_timeout": "LACP fast timeout",
+      "lagghash": "Hash algorithm",
+      "laggif": "Device",
+      "bridgeif": "Device",
+      "linklocal": "Link-local",
+      "linklocalHint": "Assign a link-local address automatically",
+      "enablestp": "STP",
+      "enablestpHint": "Enable spanning tree",
+      "deviceId": "Device no.",
+      "local-addr": "Local address",
+      "remote-addr": "Remote address",
+      "tunnel-local-addr": "Tunnel address (local)",
+      "tunnel-remote-addr": "Tunnel address (remote)",
+      "tunnel-remote-net": "Tunnel prefix",
+      "greif": "Device",
+      "type": "Type",
+      "verify": "Verify certificate",
+      "forward_tcp_upstream": "TCP to upstream",
+      "forward_tcp_upstreamHint": "Forward queries over TCP",
+      "forward_first": "Forward first",
+      "forward_firstHint": "Forward first, then resolve locally",
+      "start_addr": "From",
+      "end_addr": "To",
+      "subnet_mask": "Subnet mask",
+      "domain_type": "Domain type"
+    },
+    "risks": {
+      "management_interface": "This change affects {device}, the interface OPNexus uses to reach the firewall. The connection may drop.",
+      "management_address": "The address {address} is the one OPNexus uses to reach the firewall.",
+      "management_unknown": "Which interface OPNexus uses to reach this firewall cannot be determined (NAT or a CARP address). The impact cannot be judged.",
+      "default_gateway": "{name} is the default gateway. Without it, traffic to the internet may fail.",
+      "default_gateway_change": "The default gateway is being set or switched. All outbound traffic will take a different path afterwards.",
+      "management_gateway": "{name} sits on the interface OPNexus uses to reach the firewall.",
+      "default_route": "A default route ({network}) changes the path for almost all traffic.",
+      "route_covers_management": "The route {network} covers the firewall's own address. Replies to OPNexus may take a different path.",
+      "interface_rules_removed": "Removing it makes OPNsense itself delete {count} rule(s) that use this interface: {names}",
+      "management_member": "{device} is the interface OPNexus uses to reach the firewall, and it is a member of this device. The connection may drop.",
+      "tunable_change": "Tunables change how the whole system behaves; some only apply after a reboot and some can make the firewall unusable."
+    },
+    "warnings": {
+      "carp_change": "CARP changes can trigger a switch between master and backup.",
+      "cluster_peers": "This firewall is part of a cluster. The same change may be needed on {hosts} as well. VIPs and gateways are not synchronised automatically.",
+      "core_interface": "{name} is a core interface of the firewall. Changes affect every rule and service on it.",
+      "gateway_group_in_use": "Rules that use this gateway group lose their target."
+    },
+    "blocks": {
+      "api_unavailable": "This firewall does not offer an API for this ({section}).",
+      "nothing_to_change": "There is nothing to change.",
+      "interface_api_unavailable": "This OPNsense version cannot configure interfaces through its API (from about 26.7.6).",
+      "interface_changes_pending": "Interface changes are already staged on the firewall and waiting to be applied. Check and apply or discard them there first.",
+      "interface_locked": "The interface is locked. Remove the lock first, then delete.",
+      "tunable_default_row": "This is a built-in default of the firewall. To change it, create your own entry with “Override”."
+    },
+    "change": {
+      "title": {
+        "add": "Add {kind}",
+        "set": "Edit {kind}",
+        "del": "Delete {kind}"
+      },
+      "loadFailed": "The form could not be loaded.",
+      "previewFailed": "The preview could not be created.",
+      "applyFailed": "The change could not be applied.",
+      "keepUnchanged": "leave unchanged…",
+      "toPreview": "Continue to preview",
+      "back": "Back",
+      "apply": "Apply now",
+      "riskTitle": "Careful, this change can cut the connection",
+      "noChanges": "No changes.",
+      "backupNote": "A backup of the firewall configuration is saved before applying. There is no automatic rollback: if the connection drops, OPNexus cannot undo the change itself.",
+      "ack": "I understand that this change can cut the connection to {host} and is not rolled back automatically.",
+      "typeHost": "To confirm, type the firewall's name: {host}",
+      "applied": "Change applied.",
+      "verified": "Applied and checked",
+      "notVerified": "Applied, check differs",
+      "mismatch": "The firewall reports different values: {fields}",
+      "backupId": "Backup before the change: {id}",
+      "col": {
+        "field": "Field",
+        "before": "Before",
+        "after": "After"
+      },
+      "invalidValue": "Invalid value.",
+      "unreachable": "The change was applied, but “{host}” no longer answers on its previous address. If the management address was changed, enter the new one under Hosts › Edit. The backup taken before the change is kept.",
+      "transferHint": "Apply the same change to the partner in the cluster as well? Backup node first, then the master.",
+      "transfer": "Transfer to {host}"
+    },
+    "rowAdd": "Add",
+    "rowEdit": "Edit",
+    "rowDelete": "Delete",
+    "hint": {
+      "interfaceDescr": "Letters, digits and underscores only (no spaces or hyphens)."
+    },
+    "dhcp": {
+      "dnsmasq": "Hosts (dnsmasq: static DHCP and DNS)",
+      "keaSubnets": "Subnets (Kea)",
+      "keaReservations": "Reservations (Kea)"
+    },
+    "objectsUnavailable": "This OPNsense version offers no API for this.",
+    "override": "Override",
+    "compare": {
+      "loadFailed": "Could not load the comparison.",
+      "noClusters": "No cluster with at least two hosts.",
+      "intro": "Compares the network configuration of a cluster's nodes. Addresses, CARP advskew and the active default gateway may differ and are not compared.",
+      "unreachable": "Unreachable: {hosts}",
+      "same": "Identical",
+      "count": "{count} difference(s)",
+      "category": "Area",
+      "object": "Object",
+      "state": "State",
+      "missing": "Missing",
+      "different": "Differs",
+      "absent": "missing",
+      "categories": {
+        "interfaces": "Interface",
+        "vlans": "VLAN",
+        "vips": "Virtual IP",
+        "gateways": "Gateway",
+        "routes": "Route",
+        "dns_hosts": "DNS entry",
+        "dhcp_hosts": "DHCP host",
+        "kea_subnets": "DHCP subnet",
+        "kea_reservations": "DHCP reservation"
+      }
+    }
+  },
+  "hostsystem": {
+    "intro": {
+      "tunables": "System parameters of the firewall (sysctl). The firewall's own values stay untouched; your own entries override them.",
+      "cron": "Scheduled tasks the firewall runs itself.",
+      "syslog": "Remote log targets the firewall sends its messages to.",
+      "snapshots": "ZFS snapshots of the firewall as an extra safety net before bigger changes. Activating one (with a reboot) is deliberately left to OPNsense itself."
+    },
+    "snapshots": {
+      "create": "Create snapshot",
+      "createHint": "The snapshot captures the current system state. It does not replace a configuration backup.",
+      "name": "Name",
+      "nameHint": "Letters, digits, dot, underscore and hyphen.",
+      "note": "Note",
+      "state": "State",
+      "size": "Size",
+      "createdAt": "Created",
+      "activeNow": "active",
+      "activeNext": "active after reboot",
+      "unsupported": "This firewall does not support snapshots (no ZFS).",
+      "created": "Snapshot “{name}” created.",
+      "createFailed": "Could not create the snapshot.",
+      "deleted": "Snapshot “{name}” deleted.",
+      "deleteFailed": "Could not delete the snapshot.",
+      "deleteConfirm": "Really delete snapshot “{name}”?"
+    }
   }
 }

frontend/lib/version.ts

@@ -1,6 +1,6 @@
 // Manually bumped whenever a notable change ships — mirrors the dated
 // entries already kept in the project README/CHANGELOG.md, no build
 // tooling involved. Versioning scheme: see CHANGELOG.md ("Versionierung").
-export const APP_VERSION = "1.11.0";
-export const APP_CODENAME = "Merlin";
+export const APP_VERSION = "1.13.0";
+export const APP_CODENAME = "Buzzard";
 export const APP_MAINTAINER = "Julian Boldt";