Sooner or later you will be away from home and need the firewall. The tempting move — opening the OPNsense web interface to the internet — is also the dangerous one. This guide shows the safe pattern everyone serious uses: keep the admin door shut, and walk in through a VPN tunnel instead.
Your firewall's login page is the single most valuable target on your network: whoever owns it owns every packet. Internet scanners find exposed firewall interfaces within hours, and default or weak passwords fall to automated guessing. OPNsense gives you everything needed to avoid that exposure: WireGuard and OpenVPN are built in. The routine is simple — from outside, you join your own VPN; from inside the VPN, the firewall interface is just there, as if you were home.
Opening the web GUI or SSH on the WAN side feels harmless — 'it has a password, after all'. In practice, exposed management interfaces are how small networks get owned: scanners catalogue them, credential-stuffing tools try leaked password lists, and any future bug in the login page is instantly your emergency. The anti-lockout rule and default rules deliberately keep administration on the LAN side. Keep it that way. If you ever find a WAN rule passing traffic to the firewall's own GUI or SSH port, delete it and use the VPN pattern below.
WireGuard is built into OPNsense as a core VPN option (VPN → WireGuard): you create an instance, generate a key pair for each device (phone, laptop), give each peer an address inside a small tunnel network, and add one WAN rule allowing the WireGuard port (UDP, 51820 by default). Phones import the config by QR code. Once connected, your phone is logically inside your home network — open https://192.168.1.1 and log in as normal. OpenVPN is the equally valid alternative, with certificates instead of keys, and slightly better support on restrictive hotel or office networks because it can run over TCP port 443.
Enable the VPN only when you need it, and test the full trip — leave the house (or use mobile data), connect, open the GUI — before the day it matters. Keep SSH key-based if you use it at all, and consider disabling password SSH entirely. Check the firewall log occasionally for VPN connection attempts from addresses you do not recognise; failed attempts against WireGuard are silent noise to ignore, but successful logins you do not remember are a five-alarm fire. When a device is sold or lost, delete its peer the same day.
Watch the complete OPNsense setup in the video and see how remote access fits into a properly secured build.
▶️ Watch Full VideoFor personal remote access, WireGuard is simpler to configure, connects almost instantly, and is gentle on phone batteries. OpenVPN earns its place when you must pass through networks that block unfamiliar UDP ports, since it can run over TCP 443 and look like ordinary HTTPS. Both are built into OPNsense and both are safe when configured with their own keys or certificates per device.
You can, but you should not. Passwords and 2FA protect the login; they do not hide the door. Every scanner on the internet will find and probe an exposed interface, and you are betting the network on the login page never having a bug. The VPN removes the door from the street entirely, which is a categorically stronger position.
Usually the tunnel network is not allowed to reach the LAN. Check that your WireGuard or OpenVPN firewall rules pass traffic from the tunnel network to the LAN (or at least to the firewall's LAN address), and that the peer's allowed addresses include your LAN subnet. Test by pinging the firewall's LAN IP over the tunnel before blaming the browser.