Your home router's firewall is a locked box you cannot really control. OPNsense is a free, open-source firewall you install on a small PC, and it gives you professional control — real firewall rules, VPN, intrusion detection, per-device visibility. This guide takes you from an empty PC to a working, sensibly secured OPNsense setup.
OPNsense is a firewall and routing platform built on FreeBSD, released as genuinely free and open-source software. You install it on your own hardware — an old PC, a mini PC with two network ports, or a small appliance — and it sits between your modem and your network, deciding what traffic may pass. This guide covers the whole journey in the right order: hardware, install, first login, wizard, rules, DHCP and DNS, and the safety habits that keep you from locking yourself out. Read it once fully before touching anything; a firewall setup goes wrong mostly at the planning stage, not the clicking stage.
OPNsense needs a 64-bit PC with at least two network ports — one for the internet side (WAN), one for your network (LAN). The official guidance is roughly 2 GB RAM minimum and 4 GB or more for comfortable use; an SSD of 40 GB or more is plenty for most homes. Intel network cards are strongly preferred because their FreeBSD drivers are the most reliable — cheap Realtek ports are the single most common cause of strange network drops. A full hardware guide is linked in the companion article on this page's topic list.
Download the VGA USB image from the official OPNsense download page, write it to a pen drive, and boot the firewall PC from it. Log in at the console as installer with password opnsense, accept the defaults, choose your disk and let it copy the system. It erases the target disk completely, so never point it at a disk with data you need. When it finishes, remove the USB stick and reboot.
Connect a laptop to the LAN port. It should receive an address automatically, because OPNsense runs a DHCP server on LAN by default. Open https://192.168.1.1 in the browser — the certificate warning is normal for a fresh install, since the box created its own self-signed certificate. Log in as root. On a truly fresh system the default password is opnsense until you set your own during install. Walk through the wizard: set the hostname and your own local domain, choose DNS servers (or leave the ISP defaults), confirm the WAN type (DHCP is right for most home connections), and confirm the LAN address.
192.168.10.1home.arpa or your own registered domainOut of the box, OPNsense is already a sensible firewall: everything coming in from the internet is blocked, and devices on your LAN are allowed out. There is also an automatic anti-lockout rule on LAN that keeps your access to the web interface alive even if you make a rules mistake. Do not start by adding block rules everywhere. Watch the live log for a day (Firewall → Log Files → Live View), learn what normal traffic looks like, and only then start writing rules with a specific purpose. A separate article in this set covers first rules in depth.
Give important devices fixed addresses with static DHCP mappings (printers, NAS, cameras) so they never move. OPNsense's built-in DNS resolver (Unbound) is enabled by default and is all most networks need. Then go to System → Firmware and run the updates — a fresh install is never fully current, and a firewall is exactly the device that must not run old software. Finally, download a configuration backup (System → Configuration → Backups) and keep it off the box. That one file rebuilds your entire setup in minutes if the hardware ever dies.
The video shows every screen of this setup live — the install, the wizard, the rules and the settings that matter — so you can follow along on your own box.
▶️ Watch Full VideoYes. The community edition of OPNsense is free and open-source software, and it is not a crippled trial — the firewall, VPN, intrusion detection and reporting features are all included. There is an optional paid business edition from the company behind it, but nothing in this guide needs it.
The LAN side starts at 192.168.1.1 with a DHCP server running, and the web interface is at https://192.168.1.1. The default user is root with password opnsense until you set your own password during installation. Change it immediately and store it in a password manager.
An old desktop PC with a second network card added works well for learning and for real use. Laptops are awkward because they usually have one Ethernet port and go to sleep; a mini PC with two Intel network ports is the popular long-term choice. The minimum is about 2 GB of RAM, with 4 GB or more recommended.