OPNsense

OPNsense is an open source firewall and router distribution based on FreeBSD, managed mainly through a web UI. This sheet covers install, the console menu, firewall rule order, NAT, services and the few command line tools the docs describe. For the other popular choice see pfSense.

Documentation: OPNsense manual

Install #

• Log in to the installer as installer with password opnsense. If that fails, log in as root, choose 8 (Shell) and run opnsense-installer. opnsense-importer is run the same way.
• A new install is root with password opnsense at https://192.168.1.1/. Change it at once.
• ZFS is needed for snapshots and boot environments.

Releases #

• Two major releases a year, with minor updates about every two weeks. Versions are YY.M, so 25.1 is January 2025.
• The Community Edition uses the x.1 and x.7 series. The Business Edition uses x.4 and x.10, with more conservative changes and a commercial firmware repository.
• Major upgrades can be run from console option 12.

Console Menu #

Options 1 and 2 recover a box with a wrong LAN address or VLAN. Option 11 helps when the web UI hangs.

Command Line #

pluginctl, opnsense-code, the pfctl shell commands and a generic configctl service restart form were not found in the docs read, so check them on your own install.

Backups and Snapshots #

• Backups are under System, Configuration, Backups. You can set a password. The History tab compares and reverts, and a reboot may be needed.
• The configuration is /conf/config.xml. Only the USB import path for that file was seen in the docs, so check it before relying on it.
• Snapshots need ZFS. Activate one under System, Snapshots, or from boot menu option 8. Take one before every upgrade.
• Copy configuration backups off the box. See Restic.

Firewall Rules #

• Order: floating rules, then interface groups, then interface rules. Priorities are 200000, 300000 and 400000. NAT is processed before filtering.
• With quick, the first match wins. Without it, the last match wins. Inbound is denied by default and outbound is allowed.
• Automatic rules are visible through Inspect.
• The anti-lockout rule always allows the web UI and SSH on LAN. “Disable anti-lockout” removes it, so only do that with another way in.
• Aliases hold hosts, networks, ports, MAC addresses, URL tables, GeoIP and groups. They can be nested, so use them instead of repeating addresses.

NAT #

• Port forwards are under Firewall, NAT, Destination NAT. The filter rule association options are Manual, Pass and Register rule (recommended).
• Outbound NAT modes are Automatic (default), Manual, Hybrid and Disable.

Services #

• VLANs: Interfaces, Devices, VLAN. Set the parent, a tag from 1 to 4094 and an optional PCP. See VLANs.
• DHCP: Dnsmasq is the default and suits fewer than 1000 clients. Kea suits large and HA setups. ISC is end of life. See dnsmasq DHCP.
• DNS: Unbound is the default resolver. Custom configuration goes in /usr/local/etc/unbound.opnsense.d. See Unbound.
• VPN: OpenVPN and IPsec are core. WireGuard is at VPN, WireGuard. See VPN.
• IDS and IPS: Suricata modes are PCAP (IDS), Netmap and Divert (IPS). Turn off hardware offload for IPS.
• High availability: needs CARP virtual IPs. Preempt is off by default and configuration sync is on demand.

Diagnostics #

• Interfaces, Diagnostics, Packet Capture runs tcpdump (default count 100) and the capture opens in Wireshark.
• The firewall log has Live View and Plain View. Only the first packet of a flow is logged.

Not Verified #

pluginctl, opnsense-code, pfctl from the shell, the location of config.xml beyond the USB import path, backup plugins, Zenarmor, the VLAN how-to page, and when WireGuard moved into core.

See Also #

• pfSense
• VLANs
• Unbound
• Network Troubleshooting