Setting up a robust and secure firewall and routing platform is the first line of defense for your network. For those new to the world of network security, this blog post is your starting point on the journey to mastering OPNsense. OPNsense, an open-source and feature-rich firewall solution, empowers you to take control of your network’s security and performance.

In this beginner’s guide, we will walk you through the essential steps of installing and initially configuring OPNsense. By the end of this tutorial, you’ll have a functioning OPNsense firewall in place, ready to safeguard your network against threats while allowing you to manage your traffic effectively.

Whether you’re protecting your home network or managing a small to medium-sized business network, this guide is tailored to your needs. So, let’s dive in and get started with OPNsense, ensuring your network’s security and performance are in capable hands.

Table of Contents

• Preparing for Installation
• Creating a Bootable USB Drive
• Installing OPNsense
• Initial Configuration
• Basic Network Configuration
• Firewall Rules
• Testing the Configuration
• Additional Configuration (Optional)
• Conclusion

Preparing for Installation

Before you embark on your OPNsense journey, it’s essential to ensure you have everything in place to set up your firewall and routing platform successfully. In this section, we’ll go over the crucial steps and considerations to prepare for the installation of OPNsense.

Hardware Requirements

To get started, you’ll need to make sure you have the right hardware. OPNsense can run on a variety of hardware configurations, but here are the basic requirements:

• Compatible Computer: You’ll need a computer or server on which you can install OPNsense. It can be a dedicated machine or a virtualized environment.
• USB Drive: You’ll require a USB drive to create a bootable installation medium. Ensure it has sufficient capacity and back up any data you have on it, as it will be formatted during the process.
• Internet Connection: A reliable internet connection is essential, especially if you plan to download the OPNsense installation image during setup.

Downloading the Latest OPNsense ISO Image

Before you can install OPNsense, you need to obtain the installation media. Visit the official OPNsense website to download the latest ISO image. Be sure to select the appropriate architecture (32-bit or 64-bit) based on your hardware.

Once you’ve downloaded the ISO image, you’re ready to proceed to the next step: creating a bootable USB drive.

In the next section, we’ll guide you through the process of creating a bootable USB drive so that you can start the OPNsense installation.

Creating a Bootable USB Drive

Now that you’ve gathered the necessary hardware and downloaded the latest OPNsense ISO image, it’s time to create a bootable USB drive. This step is crucial, as it will allow you to initiate the installation process. In this section, we’ll provide you with step-by-step instructions on how to create a bootable USB drive with the OPNsense ISO image.

Back Up Your USB Drive

Before proceeding, it’s essential to emphasize that creating a bootable USB drive involves formatting it. Ensure you back up any important data on the USB drive, as this process will erase its contents.

Software for Creating a Bootable USB Drive

To create a bootable USB drive, you’ll need specialized software. The choice of software may vary depending on your operating system:

• Windows: If you’re using Windows, you can use tools like Rufus to create a bootable USB drive. Rufus is a reliable and user-friendly option.
• Linux/macOS: On Linux or macOS, you can use the dd command in the terminal. It’s a powerful and built-in utility for creating bootable drives. We’ll provide instructions for both operating systems.

Creating a Bootable USB Drive with Rufus (Windows)

If you’re on Windows, Rufus is a popular choice for creating bootable USB drives. Here’s how to do it:

1. Insert your USB drive into an available USB port.
2. Download and run Rufus (available for free from its official website).
3. In Rufus, select your USB drive under “Device.”
4. Under “Boot selection,” click the “Select” button and choose the OPNsense ISO image you downloaded earlier.
5. Ensure the partition scheme is set to “MBR” (for legacy BIOS systems) or “GPT” (for UEFI systems), depending on your hardware.
6. For “File system,” select “FAT32.”
7. Click “Start” to begin the process. Rufus will format the USB drive and copy the ISO contents to make it bootable.

Creating a Bootable USB Drive with dd (Linux/macOS)

If you’re using Linux or macOS, you can create a bootable USB drive using the dd command. Here’s how:

1. Open a terminal window.
2. Use the lsblk or diskutil list command to identify the device name of your USB drive (e.g., /dev/sdX on Linux or /dev/diskN on macOS). Be extremely careful with this step to avoid overwriting the wrong device.
3. Use the following command to create the bootable USB drive, replacing /path/to/opnsense-image.iso with the actual path to the OPNsense ISO image and /dev/sdX or /dev/diskN with the appropriate device name:

   sudo dd if=/path/to/opnsense-image.iso of=/dev/sdX bs=4M status=progress

Ensure you use the correct device name and path to the ISO image. This command will overwrite the USB drive’s contents.

Final Steps

Once the bootable USB drive has been created, you’re ready to move on to the next section: Installing OPNsense. Boot your computer or server from the USB drive to start the installation process.

Installing OPNsense

With your bootable USB drive ready, it’s time to take the next crucial step: installing OPNsense on your chosen hardware. In this section, we’ll walk you through the process of installing OPNsense, ensuring that your firewall and routing platform is set up correctly.

Booting from the USB Drive

1. Insert the bootable USB drive into your computer or server’s USB port.
2. Restart your system, and during the startup process, access the boot menu or BIOS/UEFI settings. The key to access this menu may vary depending on your hardware (common keys include F2, F12, DEL, or ESC).
3. In the boot menu or BIOS/UEFI settings, select the USB drive as the boot device to initiate the OPNsense installation process.

Starting the Installation

Once your system boots from the USB drive, you’ll be presented with the OPNsense installation menu. Follow these steps to begin the installation:

1. Select ‘Install/Upgrade’: Use the arrow keys to highlight the ‘Install/Upgrade’ option and press Enter to confirm.
2. Choose Installation Language: Select your preferred installation language to proceed with the installation process.
3. Set Keymap: Choose your desired keyboard layout to ensure accurate input during the installation.
4. Select ‘Install’: Confirm your intent to install OPNsense on the next screen.

Disk Partitioning

OPNsense will guide you through the process of disk partitioning, which involves configuring storage for the installation. Depending on your preference and hardware, you can choose between the following options:

• Full Installation: This option installs OPNsense on the selected disk, erasing any existing data. It’s suitable for dedicated hardware.
• Encrypted Installation (Optional): If you require added security, you can opt for an encrypted installation. This encrypts the data on your disk, requiring a password to access OPNsense.

Follow the on-screen prompts to configure the installation type, partition the disk, and confirm your choices.

Completing the Installation

Once the installation process is complete, OPNsense will prompt you to remove the installation media (USB drive) and press Enter to restart your system.

First Boot and Initial Configuration

Upon rebooting, your system will boot into OPNsense. This marks the completion of the installation phase. During the first boot, you’ll be guided through the initial configuration wizard.

• Logging In: You will be prompted to log in using the default credentials. Make sure to change the default password to enhance security.
• Initial Setup Wizard: Follow the prompts of the initial setup wizard to configure basic network settings, including the WAN (Wide Area Network) and LAN (Local Area Network) interfaces, as well as the system’s hostname and domain.

Congratulations! You’ve successfully installed OPNsense, and your initial configuration is underway. In the next section, we’ll delve into the specifics of basic network configuration, ensuring that your OPNsense firewall is ready to protect and manage your network traffic effectively.

Initial Configuration

Now that you’ve completed the installation of OPNsense, it’s time to proceed with the initial configuration. This phase is crucial as it sets the foundation for your OPNsense firewall and routing platform. In this section, we’ll guide you through the essential steps to get your OPNsense system up and running.

First Boot and Accessing the Web Interface

Upon completing the installation, your system will automatically boot into OPNsense. To begin the initial configuration:

1. Open a web browser on a computer connected to the same network as your OPNsense system.
2. In the browser’s address bar, enter the IP address of your OPNsense system. By default, this is typically 192.168.1.1. Press Enter.
3. You’ll be presented with the OPNsense login page. Enter the username and password you set during the installation process.

Changing the Default Password

For security reasons, it’s essential to change the default password immediately after logging in. To do this:

1. Click on the “System” menu at the top of the page.
2. Select “Access” from the dropdown menu.
3. Under the “Password” section, enter the current password, followed by your new password and its confirmation. Click “Save” to apply the changes.

Initial Setup Wizard

After changing the password, you’ll be guided through the initial setup wizard. This wizard helps configure fundamental network settings for your OPNsense system.

Interface Configuration

1. WAN Interface: Configure your WAN (Wide Area Network) interface settings, including the type of connection (static, DHCP, PPPoE), IP address assignment, and other relevant details provided by your Internet Service Provider (ISP).
2. LAN Interface: Configure your LAN (Local Area Network) interface settings, such as the IP address and subnet mask. Ensure that this subnet is compatible with your local network.

Hostname and Domain

Set the hostname for your OPNsense system, which is a unique name to identify it on your network. Additionally, specify the domain that your OPNsense system will use for local DNS resolution.

DNS Servers

Enter the IP addresses of the DNS servers you want to use for name resolution. You can use public DNS servers like Google DNS (8.8.8.8 and 8.8.4.4) or specify custom DNS servers if needed.

Time Zone Configuration

Select your time zone to ensure accurate timekeeping on your OPNsense system. This is crucial for logging and time-based rules.

Completing the Initial Setup Wizard

After configuring the settings in the initial setup wizard, review your choices and click “Next” or “Finish” to apply the configuration. Your OPNsense system will apply the changes, and you’ll be directed to the OPNsense web interface dashboard.

Accessing the Web Interface After Configuration

To access the OPNsense web interface after completing the initial configuration, simply enter the IP address you specified for the LAN interface in your browser’s address bar. You’ll now have access to the full range of OPNsense features and settings.

With the initial configuration completed, you’ve taken the first steps in harnessing the power of OPNsense for network security and management. In the next section, we’ll explore basic network configuration in more detail, helping you tailor your OPNsense firewall to your specific network needs.

Basic Network Configuration

Now that you’ve successfully completed the initial setup of OPNsense, it’s time to delve into the basic network configuration. This step is crucial for ensuring that your OPNsense firewall is ready to protect your network while allowing traffic to flow smoothly. In this section, we’ll guide you through the essential steps to configure network interfaces and basic settings.

Configuring Network Interfaces

In the initial setup wizard, you defined your WAN (Wide Area Network) and LAN (Local Area Network) interfaces. Now, let’s take a closer look at how to configure them:

WAN Interface Configuration

1. Access the Web Interface: Log in to the OPNsense web interface using the IP address you assigned to the LAN interface during the initial configuration.
2. Navigate to Interfaces: Click on the “Interfaces” option in the top menu.
3. WAN Configuration: Select the “WAN” tab to configure your WAN interface settings. Here, you can specify the type of connection (e.g., DHCP, PPPoE, static), and enter any required details provided by your Internet Service Provider (ISP).
4. Save Changes: After configuring the WAN interface, be sure to click “Save” to apply the settings.

LAN Interface Configuration

1. Access the Web Interface: Log in to the OPNsense web interface using the IP address you assigned to the LAN interface during the initial configuration.
2. Navigate to Interfaces: Click on the “Interfaces” option in the top menu.
3. LAN Configuration: Select the “LAN” tab to configure your LAN interface settings. Here, you can specify the LAN IP address, subnet mask, and other relevant details. Ensure that the LAN subnet is compatible with your local network.
4. Save Changes: After configuring the LAN interface, click “Save” to apply the settings.

DHCP Server Configuration (Optional)

If you want OPNsense to manage IP address assignments for devices on your LAN, you can set up the DHCP server:

1. Access the Web Interface: Log in to the OPNsense web interface.
2. Navigate to Services: Click on the “Services” option in the top menu.
3. DHCP Server: Select the “DHCP Server” option to configure the DHCP server settings for your LAN.
4. Enable DHCP: Check the “Enable DHCP server on LAN” box to activate the DHCP server.
5. Set DHCP Range: Specify the range of IP addresses that the DHCP server should assign to devices on your LAN.
6. Save Changes: After configuring the DHCP server, click “Save” to apply the settings.

Testing the Configuration

After configuring your network interfaces and, if desired, the DHCP server, it’s essential to test your configuration:

1. Connect a device to your LAN, either via wired or wireless connection.
2. Ensure that the device receives an IP address from the DHCP server (if enabled) and can access the internet.
3. Attempt to access the OPNsense web interface from the device by entering the LAN interface’s IP address in a web browser. This confirms that your LAN is correctly configured.

Troubleshooting Common Issues

If you encounter any issues during the configuration process or testing, don’t worry; troubleshooting is a natural part of setting up a network. Check for common issues such as incorrect IP settings, cable connections, or firewall rules that may be blocking traffic.

In case of problems, refer to the OPNsense documentation, online forums, or seek assistance from the OPNsense community to resolve any challenges you encounter.

With your basic network configuration in place, you’ve laid a solid foundation for network security and management using OPNsense. In the following sections, we’ll explore more advanced features and configurations to further enhance your network’s capabilities.

Firewall Rules

Now that you’ve configured the basic network settings in OPNsense, it’s time to explore one of its most critical features: firewall rules. Firewall rules allow you to control and manage the flow of traffic through your OPNsense firewall, ensuring the security and integrity of your network. In this section, we’ll dive into the world of firewall rules and show you how to create and manage them effectively.

Understanding Firewall Rules

Firewall rules act as a barrier between your network and the outside world, determining what traffic is allowed or blocked. It’s crucial to understand the fundamentals:

• Pass Rules: These rules allow traffic to pass through the firewall. They are used to permit specific types of traffic.
• Block Rules: These rules block traffic from passing through the firewall. They are used to deny specific types of traffic.

Creating Firewall Rules

To create firewall rules in OPNsense, follow these steps:

1. Access the Web Interface: Log in to the OPNsense web interface using the IP address you assigned to the LAN interface during the initial configuration.
2. Navigate to Firewall Rules: Click on the “Firewall” option in the top menu, then select “Rules” from the dropdown menu.
3. Select the Appropriate Tab: Depending on whether you want to create rules for the WAN or LAN interface, select the corresponding tab.
4. Create a New Rule: Click the “Add” button to create a new firewall rule.
5. Configure Rule Settings: In the rule configuration form, you’ll specify various settings, including:

• Action: Choose “Pass” to allow traffic or “Block” to deny traffic.
• Interface: Select the interface (WAN, LAN, etc.) to which the rule applies.
• Protocol: Specify the protocol (e.g., TCP, UDP, ICMP) for the rule.
• Source and Destination: Define the source and destination IP addresses or networks for the rule.
• Port: If necessary, specify the source and destination port ranges.

1. Additional Settings: Depending on your needs, you can configure additional options such as advanced options, logging settings, and scheduling.
2. Save the Rule: After configuring the rule, click “Save” to apply it.

Rule Order and Evaluation

Firewall rules are evaluated in the order they appear in the list, from top to bottom. It’s essential to understand that rules are processed sequentially, and the first rule that matches a packet determines its fate. Therefore, the order of rules matters.

You can drag and drop rules to reorder them as needed, ensuring that more specific rules are placed above more general rules.

Default Allow LAN to Any Rule

By default, OPNsense includes a “Default Allow LAN to Any” rule that permits LAN devices to access the internet. This rule allows outgoing traffic without any restrictions. However, it’s crucial to create specific rules to control incoming traffic to your LAN.

Testing Firewall Rules

After creating firewall rules, it’s essential to test them to ensure they work as intended. You can do this by trying to access or block specific services or connections that your rules target.

Monitoring and Logging

OPNsense provides extensive monitoring and logging capabilities to help you keep track of firewall activity. You can view logs to see which rules are being matched and whether any traffic is being blocked.

Regular Review and Updates

Networks and their requirements change over time. It’s essential to regularly review and update your firewall rules to reflect these changes and maintain the security and efficiency of your network.

With a solid understanding of firewall rules, you can control the flow of traffic in and out of your network, enhancing security and ensuring that your OPNsense firewall operates effectively. In the next sections, we’ll explore more advanced OPNsense features and configurations to further optimize your network.

Testing the Configuration

After configuring your OPNsense firewall and setting up firewall rules, it’s crucial to test the configuration to ensure that it’s working as expected. Testing helps identify any issues or misconfigurations and allows you to make necessary adjustments. In this section, we’ll guide you through the process of testing your OPNsense configuration.

Connectivity Testing

To verify the basic functionality of your OPNsense firewall and network, follow these connectivity tests:

Internet Access from LAN

1. Ensure a device is connected to your LAN network.
2. Attempt to access websites or services on the internet from the connected device.

• If you can access the internet without issues, it indicates that outbound traffic from your LAN is allowed, and the WAN interface is correctly configured.
• If you encounter connectivity problems, check the following:
  • Firewall rules on the LAN interface to ensure they permit outgoing traffic.
  • WAN interface configuration to verify that it’s obtaining an IP address and gateway settings correctly.

Access to LAN Resources from LAN

1. Try accessing resources on your LAN from another device on the same network, such as shared files, printers, or local services.

• If you can access LAN resources without issues, it indicates that communication within your LAN is functioning correctly.
• If you encounter issues accessing LAN resources, review your firewall rules and ensure that they allow the necessary traffic between LAN devices.

Port Forwarding (If Applicable)

If you have configured port forwarding rules to allow external access to specific services on devices within your LAN, test these rules:

1. Access the external IP address or hostname from an external network to verify that the port forwarding rules correctly route traffic to the intended internal device and service.

• If the service is accessible, it indicates that your port forwarding rules are working as expected.
• If the service is not accessible, review your port forwarding rules, ensuring that they specify the correct external and internal ports and the target device.

Firewall Rule Testing

To validate your firewall rules, you can perform tests by accessing or blocking specific services or connections that your rules target:

Access Rules

1. Access a service or resource that should be allowed according to your firewall rules (e.g., accessing a web server, email server, or remote desktop).

• If you can access the service without issues, it indicates that your “pass” rules are functioning correctly.
• If access is denied, review your “pass” rules to ensure they match the intended traffic and destinations.

Block Rules

1. Attempt to access a service or resource that should be blocked according to your firewall rules (e.g., a restricted website or blocked port).

• If access is denied as expected, it confirms that your “block” rules are working correctly.
• If access is allowed when it should be blocked, review your “block” rules to ensure they are configured accurately.

Monitoring and Logging

Use the monitoring and logging capabilities of OPNsense to review the firewall activity and check if rules are being matched:

1. Access the OPNsense web interface.
2. Navigate to the firewall logs or monitoring section to view the logs and see which rules are being applied to traffic.

• Review the logs for any unexpected or suspicious activity that may indicate a misconfiguration or a security concern.

Regular Testing and Maintenance

Testing your OPNsense configuration should not be a one-time task. To maintain the security and performance of your network, consider performing regular tests, especially after making changes to your firewall rules or network topology. Regular testing helps identify and address issues proactively.

By conducting thorough testing, you can ensure that your OPNsense firewall and network configuration provide the security and functionality you desire. If any issues arise during testing, refer to the documentation, online forums, or seek assistance from the OPNsense community to resolve them effectively.

Additional Configuration (Optional)

While you’ve already set up the fundamental aspects of your OPNsense firewall, there are many more features and configurations you can explore to enhance your network’s capabilities. In this optional section, we’ll introduce you to some advanced settings and functionalities in OPNsense that you may find useful for specific requirements.

Virtual Private Network (VPN) Configuration

If you need secure remote access to your network or wish to establish site-to-site connections, configuring VPNs is a powerful option. OPNsense supports various VPN protocols, including OpenVPN and IPsec. You can set up VPN servers and clients to encrypt and secure your network traffic.

• Site-to-Site VPN: Connect multiple office locations securely over the internet.
• Remote Access VPN: Allow remote users to connect to your network from anywhere.

Port Forwarding and NAT

If you host services on devices within your LAN that need to be accessible from the internet, you can use port forwarding and Network Address Translation (NAT) to route external traffic to internal servers. This is useful for services like web servers, email servers, or gaming servers.

• Port Forwarding: Forward specific external ports to internal devices.
• 1:1 NAT: Assign a dedicated public IP address to an internal device.
• Outbound NAT: Control how internal devices are translated when they access external resources.

Package Installation

OPNsense offers a package system that allows you to extend its functionality by installing additional packages. These packages can add features such as web content filtering, intrusion detection and prevention, caching, and more.

Some popular packages include:

• Suricata: An Intrusion Detection and Prevention System (IDS/IPS) for enhanced network security.
• Squid Proxy: A caching proxy server for web content filtering and optimization.
• HAProxy: A high-availability load balancer and proxy server.

Quality of Service (QoS)

To ensure that critical applications and services receive the necessary network resources and prioritize traffic, you can configure Quality of Service (QoS) policies in OPNsense. QoS allows you to manage bandwidth effectively and reduce latency for specific applications or devices.

• Traffic Shaping: Control and allocate bandwidth for different types of traffic.
• Prioritization: Assign priority levels to applications or devices for better network performance.

Dynamic DNS (DDNS)

If you have a dynamic public IP address from your Internet Service Provider (ISP) and need to access your network remotely, consider configuring Dynamic DNS (DDNS). DDNS ensures that your domain name is always associated with your changing IP address.

Customizing Dashboard and Widgets

OPNsense allows you to customize its dashboard and add widgets to provide at-a-glance information about your network’s status. You can personalize the dashboard layout and display widgets for system information, traffic graphs, and more.

High Availability (HA) Setup

For businesses requiring high uptime and failover capabilities, OPNsense supports High Availability (HA) configurations. HA setups involve redundant firewall appliances or virtual machines that automatically take over if one fails, ensuring uninterrupted network operation.

Remember that these advanced configurations are optional and should be implemented based on your specific network requirements. It’s essential to thoroughly understand each feature before making changes to your OPNsense firewall to avoid unintended disruptions or security vulnerabilities.

As you explore these advanced configurations, refer to the OPNsense documentation, seek guidance from the community, or consider consulting with network security professionals for expert assistance in designing and implementing complex setups.

Conclusion

Congratulations, you’ve reached the end of this beginner’s guide to setting up OPNsense! We’ve taken you through the essential steps of installation, initial configuration, and introduced you to some advanced configurations that can enhance your network’s security and performance.

In conclusion, let’s recap the key takeaways from this guide:

• OPNsense Empowers You: OPNsense is a powerful, open-source firewall and routing platform that empowers you to take control of your network’s security and performance.
• Start with the Basics: Begin by ensuring you have the right hardware, creating a bootable USB drive, and successfully installing OPNsense on your chosen hardware.
• Initial Configuration Matters: During the initial setup, remember to change the default password, configure network interfaces, and complete the initial setup wizard.
• Firewall Rules: Understand the importance of firewall rules, create them to allow or block specific types of traffic, and regularly review and update them.
• Testing Is Crucial: Regularly test your configuration to ensure that it’s working as expected. Use connectivity tests, rule testing, and monitoring to verify your setup.
• Optional Advanced Configurations: Explore advanced configurations like VPN setup, port forwarding, package installation, QoS, and more based on your specific network requirements.
• Security First: Always prioritize network security. Regularly update OPNsense and review firewall rules to mitigate security risks.
• Documentation and Community Support: Utilize the extensive OPNsense documentation and seek assistance from the OPNsense community when needed.

As you continue to explore and fine-tune your OPNsense firewall, remember that network security is an ongoing process. Stay informed about the latest threats and best practices to keep your network safe and efficient.

OPNsense offers a wide range of features and capabilities that can adapt to your evolving network needs. Whether you’re managing a small home network or a complex business environment, OPNsense provides the tools you need to safeguard your network and maintain reliable connectivity.

Thank you for choosing OPNsense and for taking the time to learn how to set it up effectively. We hope this guide has been valuable in getting you started on your journey to network security and management.