OPNsense Firewall Setup

Choose the Hardware — Two Network Ports Minimum

OPNsense is a firewall and routing platform built on FreeBSD. You install it on your own hardware — a spare PC, a mini PC or a small appliance — and it sits between your modem and your network, deciding what traffic may pass. The hardware must be a 64-bit PC with at least two network ports: one becomes the WAN (internet side), the other the LAN (your network). The official guidance is roughly 2 GB of RAM as a minimum, 4 GB or more for comfortable use, and an SSD of 40 GB or more is plenty for most homes and small offices. Intel network cards are strongly preferred because their FreeBSD drivers are the most reliable — cheap Realtek ports are the single most common cause of strange network drops. Fanless mini PCs with dual Intel ports are the popular long-term choice: silent and low on power.

Download the Official Image and Verify the Checksum

Go to the official OPNsense download page at opnsense.org and pick a mirror near you. For a normal PC install from a pen drive, choose the amd64 VGA image for USB — the file name ends with -vga.img.bz2. VGA means it displays on an ordinary monitor; the serial image is for headless appliances with a console cable, and the DVD ISO is for virtual machines and optical media. The file is compressed, so extract it first (7-Zip handles the .bz2 format). Then verify the download: the SHA-256 checksum is published beside the image on the download page — compare it with your downloaded file's checksum before writing anything. A matching checksum proves the file arrived complete and untampered.

Write the Image to a USB Stick

Write the extracted image to a pen drive with a raw image writer such as balenaEtcher, or Rufus in DD mode. This is not a file copy — the stick becomes a bootable FreeBSD installer, and everything already on it is destroyed, so use a stick you do not care about; 4 GB or larger is enough. Then connect the cables before you boot: the modem into the port you intend as WAN, and a laptop or switch into the port you intend as LAN. Insert the stick and boot the PC from USB — usually a boot-menu key like F8, F11 or F12 at power-on; it varies by board.

Install OPNsense and Set a Strong Root Password

The live system boots to a console login prompt. Log in with the user name installer and the password opnsense, and the installer starts. Accept the keymap, choose Install, pick the target disk — double-check it — accept the filesystem default the installer offers, and let it copy the system. When it finishes, reboot and remove the USB stick. On the first boot the console may ask you to assign interfaces: choose which physical port is LAN and which is WAN, and for a normal single-network setup answer no to VLANs.

During the install you are asked to set the root password — make it long and unique, and store it in a password manager. Until you set your own, a fresh OPNsense still answers to the well-known default password opnsense for the root account, which anyone can look up. The install is not finished while that default is still live.

First Login and the Setup Wizard

Connect a laptop to the LAN port. It should receive an address automatically, because OPNsense runs a DHCP server on the LAN by default, handing out addresses in the 192.168.1.x range. Open the web interface in the browser:

https://192.168.1.1

Your browser will warn about the certificate — that is expected on a fresh install, because the box created its own self-signed certificate; proceed to the site. Log in as root with the password you set during the install, and walk through the setup wizard: the hostname and your own local domain (pick a private name such as home.arpa, not a real public domain), DNS servers (or leave the defaults), the correct time zone — wrong time breaks certificates and makes logs useless — and the WAN type: DHCP for most home connections, PPPoE if your ISP gave you a username and password.

Understand the Default Rules, Then Add Your Own

Before adding rules of your own, understand the starting point — out of the box, OPNsense is already a sensible firewall. Everything coming in from the internet is blocked, devices on your LAN are allowed out, and an automatic anti-lockout rule on the LAN keeps your access to the web interface alive even if you make a rules mistake. Rules are read top to bottom, and the first matching rule wins. So do not start by adding block rules everywhere. Watch the live log for a day (Firewall → Log Files → Live View), learn what normal traffic on your network looks like, and only then add rules — one at a time, each with a specific purpose.

Set Up DHCP and DNS

With the firewall up, finish the everyday basics. OPNsense's built-in DNS resolver (Unbound) is enabled by default and is all most networks need — your devices already use the firewall as their DNS server. What you add by hand is certainty for the devices that must never move: printers, a NAS and cameras get static DHCP mappings, so each one always receives the same address (in recent versions under Services → DHCP — Kea DHCP; ISC DHCP in older ones). Static mappings also let you give local names to your devices, so you can reach them by name instead of memorising numbers.

Remote Access the Safe Way — VPN Only

Sooner or later you will want to check the firewall from outside. Do it the safe way: the web interface and SSH are the keys to the whole network, so they are never opened to the internet directly. The safe route is a VPN — connect into your network with a VPN first, then open the web interface exactly as if you were sitting at home. A strong password alone is not a substitute: an admin page exposed to the internet is found by scanners within hours and attacked around the clock.

Update, Back Up the Configuration and Go Live

Two habits finish the setup. First, updates: a fresh install is never fully current, and a firewall is exactly the device that must not run old software — go to System → Firmware and run the updates. Second, the configuration backup: download it from System → Configuration → Backups and keep the file off the box. That one small file rebuilds your entire setup in minutes if the hardware ever dies, so back up again after every meaningful change, not just once. And if you ever lock yourself out of the web interface with a settings mistake, the physical console is the safety net — monitor and keyboard on the box, log in as root, and fix the interface addresses or reset the password from the console menu. Never panic-reinstall; the console fixes almost everything.