Installing OPNsense takes about fifteen minutes when you know the order of the screens. The traps are small ones: the wrong image file, the installer login nobody told you, the LAN and WAN cables swapped. This guide walks the exact path from download to the web interface, slowly.
You need three things ready before you start: the OPNsense VGA image, a pen drive of 4 GB or more, and the firewall PC connected to a monitor and keyboard. The install itself erases the target disk completely, which is the only truly irreversible moment in the whole process — after that, everything is settings. Follow the steps in order and do not skip the part where you label the cables.
Go to the official OPNsense download page and choose the amd64 VGA image for USB (the file name ends with -vga.img.bz2). VGA means it displays on a normal monitor; the serial image is for headless appliances with a console cable. The file is compressed, so extract it first — tools like 7-Zip handle the .bz2 format. If you want to be thorough, compare the checksum of your download with the value published beside it; that proves the file arrived complete and untampered.
Write the extracted image to the pen drive with a raw image writer such as balenaEtcher or Rufus in DD mode. This is not a copy-paste of a file — the stick becomes a bootable FreeBSD installer, and everything already on it is destroyed. Then plug the modem cable into the port you intend as WAN, a laptop or switch into the port you intend as LAN, insert the stick, and boot the PC from USB (usually a boot-menu key like F8, F11 or F12 at power-on — it varies by board).
The live system boots to a login prompt. Log in as installer with password opnsense and the installer starts. Accept the keymap, choose Install, pick the target disk (double-check — it will be wiped), confirm, and set a strong root password when asked. Reboot and remove the stick. On first boot the console may ask you to assign interfaces: answer the prompts, choosing which physical port is LAN and which is WAN. If you skip it, OPNsense makes a reasonable default assignment — the first port typically becomes LAN — and you can change it later from the console menu option 1.
Connect your laptop to the LAN port and let it take an automatic address — OPNsense's DHCP server hands out addresses in the 192.168.1.x range. Browse to https://192.168.1.1. Your browser will warn about the certificate; that is expected, because a fresh firewall uses a self-signed certificate that no public authority has vouched for — proceed to the site. Log in as root with the password you set. The setup wizard asks for a hostname, your own local domain name, DNS servers, time zone, and the WAN connection type (DHCP for most home lines, PPPoE if your ISP gave you a username and password). Apply, and the firewall reloads with your settings.
Watch the install performed start to finish in the video — including the screens that usually confuse first-time installers.
▶️ Watch Full VideoCheck the keyboard layout first — the console may be using a different keymap than your keyboard, so characters in the password can come out differently. Type the password in a visible field to see what the console receives. Also make sure you booted the USB installer and not an already-installed system, which expects the root password instead.
Yes, and it is a good way to practise. Create a VM with two virtual network adapters, attach the ISO, and install normally. Just remember that if the VM becomes your real firewall, your whole network depends on that host computer staying up — fine for a lab, risky as a permanent home setup unless the host is reliable.
Confirm the image was written as a raw image (not copied as a file), try a different USB port — front-panel and USB 3 ports occasionally misbehave with installers — and check the BIOS boot order and Secure Boot settings. The VGA image supports UEFI booting, so a standard modern board should boot it without legacy mode tricks.