OPNsense Must-Haves: Settings & Plugins You Should Enable

A little over a year ago, I decided to A little over a year ago, I decided to start using OpenSense as the main start using OpenSense as the main start using OpenSense as the main firewall system for running my home lab firewall system for running my home lab firewall system for running my home lab network. This system is absolutely network. This system is absolutely network. This system is absolutely fantastic. It routes all the traffic for fantastic. It routes all the traffic for fantastic. It routes all the traffic for all my home networks. It controls the all my home networks. It controls the all my home networks. It controls the access between all my VLANs and devices access between all my VLANs and devices access between all my VLANs and devices and even handles critical services like and even handles critical services like and even handles critical services like DNS and DHCP. And the more I started DNS and DHCP. And the more I started DNS and DHCP. And the more I started using it, the more I learned what using it, the more I learned what using it, the more I learned what actually matters beyond the initial actually matters beyond the initial actually matters beyond the initial setup because there are a few critical setup because there are a few critical setup because there are a few critical things that you should pay attention to things that you should pay attention to things that you should pay attention to as well as some recent changes that have as well as some recent changes that have as well as some recent changes that have been added to the system. So, I thought been added to the system. So, I thought been added to the system. So, I thought it's a good time to put together an it's a good time to put together an it's a good time to put together an updated guide to all the important updated guide to all the important updated guide to all the important settings that I would configure on a settings that I would configure on a settings that I would configure on a fresh OpenSense installation. So, let's fresh OpenSense installation. So, let's fresh OpenSense installation. So, let's not waste any more time. Let's get not waste any more time. Let's get not waste any more time. Let's get straight into it. So, this is my straight into it. So, this is my straight into it. So, this is my production OpenSense firewall that production OpenSense firewall that production OpenSense firewall that currently runs everything in my home currently runs everything in my home currently runs everything in my home network. So, I hope I don't damage it network. So, I hope I don't damage it network. So, I hope I don't damage it during the recording. But, yeah, let's during the recording. But, yeah, let's during the recording. But, yeah, let's go through some of the important go through some of the important go through some of the important settings and let's first of all start settings and let's first of all start settings and let's first of all start with the file system and backup and with the file system and backup and with the file system and backup and recovery. I think this is pretty recovery. I think this is pretty recovery. I think this is pretty critical for safe operation of your critical for safe operation of your critical for safe operation of your OpenSense firewall. And the first thing OpenSense firewall. And the first thing OpenSense firewall. And the first thing that you should set during the that you should set during the that you should set during the installation of the system is to choose installation of the system is to choose installation of the system is to choose the right file system because here you the right file system because here you the right file system because here you had to choose between UFS and ZFS. And I had to choose between UFS and ZFS. And I had to choose between UFS and ZFS. And I certainly would always recommend you to certainly would always recommend you to certainly would always recommend you to use ZFS because that gives you some cool use ZFS because that gives you some cool use ZFS because that gives you some cool features like snapshots and disk features like snapshots and disk features like snapshots and disk redundancy. Now, on my firewall system, redundancy. Now, on my firewall system, redundancy. Now, on my firewall system, for example, if we open an SSH for example, if we open an SSH for example, if we open an SSH connection to it, this is also great for connection to it, this is also great for connection to it, this is also great for administration in case anything goes administration in case anything goes administration in case anything goes wrong to the web UI. Let's go into the

wrong to the web UI. Let's go into the wrong to the web UI. Let's go into the shell and let's run a ZPool status shell and let's run a ZPool status shell and let's run a ZPool status command. So, this tells you that I'm command. So, this tells you that I'm command. So, this tells you that I'm running my OpenSense firewall with two running my OpenSense firewall with two running my OpenSense firewall with two physical NVMe drives that are mirrored physical NVMe drives that are mirrored physical NVMe drives that are mirrored together. So, in case one fails or has a together. So, in case one fails or has a together. So, in case one fails or has a problem, the secondary drive can keep problem, the secondary drive can keep problem, the secondary drive can keep the system completely operational and I the system completely operational and I the system completely operational and I can easily shut down the system, replace can easily shut down the system, replace can easily shut down the system, replace that broken drive, and restore the ZFS that broken drive, and restore the ZFS that broken drive, and restore the ZFS pool, and I don't lose anything. This is pool, and I don't lose anything. This is pool, and I don't lose anything. This is quite useful setting. Now, of course, quite useful setting. Now, of course, quite useful setting. Now, of course, you had to do this during the you had to do this during the you had to do this during the installation. So, in case you're already installation. So, in case you're already installation. So, in case you're already running Open Sense and you've chosen UFS running Open Sense and you've chosen UFS running Open Sense and you've chosen UFS or you're running this with one hard or you're running this with one hard or you're running this with one hard drive, it's probably not the worst thing drive, it's probably not the worst thing drive, it's probably not the worst thing in the world, but I still would suggest in the world, but I still would suggest in the world, but I still would suggest you think about it. Maybe add a you think about it. Maybe add a you think about it. Maybe add a secondary hard drive and reinstall the secondary hard drive and reinstall the secondary hard drive and reinstall the system with ZFS. Of course, take a system with ZFS. Of course, take a system with ZFS. Of course, take a backup and then later restore from a backup and then later restore from a backup and then later restore from a backup on that new file system. That backup on that new file system. That backup on that new file system. That might be a good idea. Unfortunately, might be a good idea. Unfortunately, might be a good idea. Unfortunately, there's no way in the dash board or the there's no way in the dash board or the there's no way in the dash board or the web UI to see the health status of the web UI to see the health status of the web UI to see the health status of the ZFS pool, which is a limitation. But, if ZFS pool, which is a limitation. But, if ZFS pool, which is a limitation. But, if you watch the video until the end, I you watch the video until the end, I you watch the video until the end, I will have a nice solution for you to will have a nice solution for you to will have a nice solution for you to monitor the status of your ZFS file monitor the status of your ZFS file monitor the status of your ZFS file system on your Open Sense firewall.

system on your Open Sense firewall. system on your Open Sense firewall. However, you should know that redundancy However, you should know that redundancy However, you should know that redundancy is not a backup. So, backup and restore is not a backup. So, backup and restore is not a backup. So, backup and restore is another important thing you should is another important thing you should is another important thing you should pay attention to. The good thing is that pay attention to. The good thing is that pay attention to. The good thing is that Open Sense takes automatic backups Open Sense takes automatic backups Open Sense takes automatic backups regularly and whenever you change a regularly and whenever you change a regularly and whenever you change a configuration setting. So, this is configuration setting. So, this is configuration setting. So, this is something you do not need to set up. If something you do not need to set up. If something you do not need to set up. If you go to history, you can easily just you go to history, you can easily just you go to history, you can easily just pick any time where something in the pick any time where something in the pick any time where something in the configuration changed and then you can configuration changed and then you can configuration changed and then you can easily just pick any timestamp you want easily just pick any timestamp you want easily just pick any timestamp you want to revert the configuration to. Click on to revert the configuration to. Click on to revert the configuration to. Click on revert and then you got back your old revert and then you got back your old revert and then you got back your old configuration. But, of course, this is configuration. But, of course, this is configuration. But, of course, this is only stored on that device. So, in case only stored on that device. So, in case only stored on that device. So, in case anything goes wrong, maybe the complete anything goes wrong, maybe the complete anything goes wrong, maybe the complete device is broken and you need to do a device is broken and you need to do a device is broken and you need to do a disaster recovery on a new appliance, disaster recovery on a new appliance, disaster recovery on a new appliance, it's a good idea to regularly put these it's a good idea to regularly put these it's a good idea to regularly put these backups offsite. So, on a separate backups offsite. So, on a separate backups offsite. So, on a separate device or download them to your device or download them to your device or download them to your workstation. Of course, no one of us workstation. Of course, no one of us workstation. Of course, no one of us does that manually or remembers to do does that manually or remembers to do does that manually or remembers to do that regularly. So, therefore, I would that regularly. So, therefore, I would that regularly. So, therefore, I would automate this. However, this is not a automate this. However, this is not a automate this. However, this is not a function inside the Open Sense firewall function inside the Open Sense firewall function inside the Open Sense firewall system, but there is a plugin that you system, but there is a plugin that you system, but there is a plugin that you can use for this. So, if you go to can use for this. So, if you go to can use for this. So, if you go to system firmware plugins, here you can system firmware plugins, here you can system firmware plugins, here you can install additional features such as the install additional features such as the install additional features such as the OS-SFTP OS-SFTP OS-SFTP backup. So, this is probably the easiest backup. So, this is probably the easiest backup. So, this is probably the easiest way to get backups off the system fully way to get backups off the system fully way to get backups off the system fully automatic. So, if you install that automatic. So, if you install that automatic. So, if you install that plugin, you can easily go to plugin, you can easily go to plugin, you can easily go to configuration backups. And if you scroll configuration backups. And if you scroll configuration backups. And if you scroll down, you can enable the SFTP backup,

down, you can enable the SFTP backup, down, you can enable the SFTP backup, put in the URL to a remote location, add put in the URL to a remote location, add put in the URL to a remote location, add in the SSH private key, and then keep in the SSH private key, and then keep in the SSH private key, and then keep the latest 30 backups fully encrypted the latest 30 backups fully encrypted the latest 30 backups fully encrypted with a password somewhere on a remote with a password somewhere on a remote with a password somewhere on a remote device. For example, I'm doing this on device. For example, I'm doing this on device. For example, I'm doing this on my server production, too. This is, by my server production, too. This is, by my server production, too. This is, by the way, a virtual machine running on my the way, a virtual machine running on my the way, a virtual machine running on my Proxmox system, and this is included in Proxmox system, and this is included in Proxmox system, and this is included in the regular Proxmox backup server the regular Proxmox backup server the regular Proxmox backup server backups. So, in case anything goes wrong backups. So, in case anything goes wrong backups. So, in case anything goes wrong there, I still have another recovery there, I still have another recovery there, I still have another recovery option. One problem with this approach option. One problem with this approach option. One problem with this approach certainly is that you do not have a certainly is that you do not have a certainly is that you do not have a notification system in case the backup notification system in case the backup notification system in case the backup does not work anymore. And yeah, you does not work anymore. And yeah, you does not work anymore. And yeah, you might just regularly take a look at the might just regularly take a look at the might just regularly take a look at the URL location if the backup still arrive URL location if the backup still arrive URL location if the backup still arrive there. But yeah, that's probably the there. But yeah, that's probably the there. But yeah, that's probably the easiest way to get the backups off the easiest way to get the backups off the easiest way to get the backups off the system automatic. All right, let's next system automatic. All right, let's next system automatic. All right, let's next come to safe administration and come to safe administration and come to safe administration and exposure. This is also one of the most exposure. This is also one of the most exposure. This is also one of the most critical things that you should pay critical things that you should pay critical things that you should pay attention to on a firewall system, that attention to on a firewall system, that attention to on a firewall system, that is keeping the system safe. And because is keeping the system safe. And because is keeping the system safe. And because you always hear from regular incidents, you always hear from regular incidents, you always hear from regular incidents, for example, the last one was in January for example, the last one was in January for example, the last one was in January 25 with Fortinet firewalls that were 25 with Fortinet firewalls that were 25 with Fortinet firewalls that were actively exploited. So, where attackers actively exploited. So, where attackers actively exploited. So, where attackers could gain access through the management could gain access through the management could gain access through the management interface of a firewalls. The good thing interface of a firewalls. The good thing interface of a firewalls. The good thing is, by default, the web UI is always is, by default, the web UI is always is, by default, the web UI is always secured with HTTPS. So, whenever you're secured with HTTPS. So, whenever you're secured with HTTPS. So, whenever you're logging in with your credentials, the logging in with your credentials, the logging in with your credentials, the connection is encrypted. However, the connection is encrypted. However, the connection is encrypted. However, the listening interfaces defines from what listening interfaces defines from what listening interfaces defines from what networks one can reach the networks one can reach the networks one can reach the administrative interfaces. Now, OPNsense administrative interfaces. Now, OPNsense administrative interfaces. Now, OPNsense in the official documentation recommends in the official documentation recommends in the official documentation recommends to keep the listening interfaces on all to keep the listening interfaces on all to keep the listening interfaces on all interfaces, so also including the WAN

interfaces, so also including the WAN interfaces, so also including the WAN interfaces, which usually is the public interfaces, which usually is the public interfaces, which usually is the public network. network. network. And yeah, while this is the case, I will And yeah, while this is the case, I will And yeah, while this is the case, I will still close this. And you can configure still close this. And you can configure still close this. And you can configure the listen interfaces if you want. Or the listen interfaces if you want. Or the listen interfaces if you want. Or what you can alternatively do create a what you can alternatively do create a what you can alternatively do create a firewall rule that blocks the access firewall rule that blocks the access firewall rule that blocks the access from the public internet to the WAN from the public internet to the WAN from the public internet to the WAN interface of your firewall. So this you interface of your firewall. So this you interface of your firewall. So this you can easily do in firewall rules. Make can easily do in firewall rules. Make can easily do in firewall rules. Make sure to create one firewall rule that sure to create one firewall rule that sure to create one firewall rule that looks like this here. Any traffic that looks like this here. Any traffic that looks like this here. Any traffic that comes to the WAN interface of this comes to the WAN interface of this comes to the WAN interface of this firewall on the admin port. So here I firewall on the admin port. So here I firewall on the admin port. So here I included the SSH port. The port 80 and included the SSH port. The port 80 and included the SSH port. The port 80 and 443 for the web interface from any 443 for the web interface from any 443 for the web interface from any source will get blocked. So this way you source will get blocked. So this way you source will get blocked. So this way you prevent access to your administrative prevent access to your administrative prevent access to your administrative interfaces from outside while still interfaces from outside while still interfaces from outside while still following the OpenSense recommendation. following the OpenSense recommendation. following the OpenSense recommendation. However, one thing that I still would However, one thing that I still would However, one thing that I still would not do is opening the SSH port on the not do is opening the SSH port on the not do is opening the SSH port on the WAN interface. So here for example, I WAN interface. So here for example, I WAN interface. So here for example, I configured it to only listen on the LAN configured it to only listen on the LAN configured it to only listen on the LAN management and production port. You management and production port. You management and production port. You could certainly lock that down as well. could certainly lock that down as well. could certainly lock that down as well. So for example, take that away from the So for example, take that away from the So for example, take that away from the LAN port if you only want controlled LAN port if you only want controlled LAN port if you only want controlled administrative network works to get administrative network works to get administrative network works to get access to SSH if you want that.

access to SSH if you want that. access to SSH if you want that. So that's in my opinion quite important. So that's in my opinion quite important. So that's in my opinion quite important. And of course, you should pay attention And of course, you should pay attention And of course, you should pay attention to these two settings here, root login to these two settings here, root login to these two settings here, root login and authentication method. If you really and authentication method. If you really and authentication method. If you really want that, the best way would be by want that, the best way would be by want that, the best way would be by using an SSH key. You can easily using an SSH key. You can easily using an SSH key. You can easily configure this in the user settings. If configure this in the user settings. If configure this in the user settings. If you go to system, access, and users. So you go to system, access, and users. So you go to system, access, and users. So here for example, create separate users here for example, create separate users here for example, create separate users for separate type of access with for separate type of access with for separate type of access with separate privileges is always separate privileges is always separate privileges is always recommended. Add an authorized SSH key recommended. Add an authorized SSH key recommended. Add an authorized SSH key and then disable the root login with a and then disable the root login with a and then disable the root login with a password. That's the best way to do password. That's the best way to do password. That's the best way to do this. And if you really want to take it this. And if you really want to take it this. And if you really want to take it to the next level, you can also seed an to the next level, you can also seed an to the next level, you can also seed an OTP and one-time password. In my OTP and one-time password. In my OTP and one-time password. In my opinion, this is a little too much opinion, this is a little too much opinion, this is a little too much because I already blocked access from because I already blocked access from because I already blocked access from outside. I have a secure SSH key. I outside. I have a secure SSH key. I outside. I have a secure SSH key. I don't need multi-factor authentication don't need multi-factor authentication don't need multi-factor authentication for just my local network. But in case for just my local network. But in case for just my local network. But in case you're running OpenSense in a larger you're running OpenSense in a larger you're running OpenSense in a larger production network, it might be worth production network, it might be worth production network, it might be worth considering. One thing that you also considering. One thing that you also considering. One thing that you also should do is getting a trusted TLS should do is getting a trusted TLS should do is getting a trusted TLS certificate for your web UI. So here for certificate for your web UI. So here for certificate for your web UI. So here for example, I've created one with the Acme example, I've created one with the Acme example, I've created one with the Acme client. This by the way is also a nice client. This by the way is also a nice client. This by the way is also a nice plug-in that you can find under firmware plug-in that you can find under firmware plug-in that you can find under firmware plug-ins and just search for OS Acme plug-ins and just search for OS Acme plug-ins and just search for OS Acme client. So this allows you to obtain client. So this allows you to obtain client. So this allows you to obtain trusted TLS certificates with HTTP or trusted TLS certificates with HTTP or trusted TLS certificates with HTTP or DNS challenge from Let's Encrypt DNS challenge from Let's Encrypt DNS challenge from Let's Encrypt completely for free. This you can all completely for free. This you can all completely for free. This you can all configure once the plug-in is installed configure once the plug-in is installed configure once the plug-in is installed under services Acme client. So here under services Acme client. So here under services Acme client. So here there are a few steps that you need to there are a few steps that you need to there are a few steps that you need to configure. You need to create an account configure. You need to create an account configure. You need to create an account at Let's Encrypt production with your at Let's Encrypt production with your at Let's Encrypt production with your email address, add a challenge type on

email address, add a challenge type on email address, add a challenge type on your DNS provider, an automation for your DNS provider, an automation for your DNS provider, an automation for restarting the web UI after certificate restarting the web UI after certificate restarting the web UI after certificate renewal, renewal, renewal, and then issue a new certificate when and then issue a new certificate when and then issue a new certificate when you go to certificates at and then add you go to certificates at and then add you go to certificates at and then add your DNS name. For example, for my home your DNS name. For example, for my home your DNS name. For example, for my home lab network, this is lab network, this is lab network, this is opensense.homelab.creativ.de. Configure your challenge type, Acme Configure your challenge type, Acme account, and everything and then get it account, and everything and then get it account, and everything and then get it up and running. So that's why I would up and running. So that's why I would up and running. So that's why I would recommend you to my website recommend you to my website recommend you to my website christianlempa.de. Of course, you will christianlempa.de. Of course, you will christianlempa.de. Of course, you will find a link to it in the description. So find a link to it in the description. So find a link to it in the description. So here you can just watch all my videos. here you can just watch all my videos. here you can just watch all my videos. You can find some great content and You can find some great content and You can find some great content and projects that I publish and also some projects that I publish and also some projects that I publish and also some written guides. So here for example, written guides. So here for example, written guides. So here for example, I've created one for trusted HTTPS for I've created one for trusted HTTPS for I've created one for trusted HTTPS for the Open Sense web UI with Let's the Open Sense web UI with Let's the Open Sense web UI with Let's Encrypt. So here are all the steps and Encrypt. So here are all the steps and Encrypt. So here are all the steps and configuration settings described. You configuration settings described. You configuration settings described. You can just go through this. Then you get can just go through this. Then you get can just go through this. Then you get rid of this annoying certificate warning rid of this annoying certificate warning rid of this annoying certificate warning in the browser and got real trusted in the browser and got real trusted in the browser and got real trusted certificates for your Open Sense certificates for your Open Sense certificates for your Open Sense firewall. So yeah, these are some tips firewall. So yeah, these are some tips firewall. So yeah, these are some tips for safe administration and operation of for safe administration and operation of for safe administration and operation of the system. Let's now come to the system. Let's now come to the system. Let's now come to one of the things that recently changed one of the things that recently changed one of the things that recently changed a little in the system. For example, in a little in the system. For example, in a little in the system. For example, in my last Open Sense tutorial, many of you my last Open Sense tutorial, many of you my last Open Sense tutorial, many of you have complained about me using ISC DHCP have complained about me using ISC DHCP have complained about me using ISC DHCP because that's a legacy implementation.

because that's a legacy implementation. because that's a legacy implementation. I recently just migrated this I recently just migrated this I recently just migrated this configuration to the newer Kea DHCP. configuration to the newer Kea DHCP. configuration to the newer Kea DHCP. So, ISC just ended active maintenance in So, ISC just ended active maintenance in So, ISC just ended active maintenance in 2022 already, and Kea is the new 2022 already, and Kea is the new 2022 already, and Kea is the new actively developed service for DHCP here actively developed service for DHCP here actively developed service for DHCP here on OPNsense. One thing you can also take on OPNsense. One thing you can also take on OPNsense. One thing you can also take a look at if you want a simple a look at if you want a simple a look at if you want a simple configuration is a Dnsmasq DNS and DHCP. configuration is a Dnsmasq DNS and DHCP. configuration is a Dnsmasq DNS and DHCP. Although I've enabled it, I'm not using Although I've enabled it, I'm not using Although I've enabled it, I'm not using this actively to be honest. I'm using this actively to be honest. I'm using this actively to be honest. I'm using the Kea DHCP for my home network because the Kea DHCP for my home network because the Kea DHCP for my home network because I think this gives you many more I think this gives you many more I think this gives you many more options. For example, here you can options. For example, here you can options. For example, here you can configure separate subnets. You can configure separate subnets. You can configure separate subnets. You can create pool ranges. You can also add create pool ranges. You can also add create pool ranges. You can also add more than two DNS servers. This gives more than two DNS servers. This gives more than two DNS servers. This gives you many more granular options for you many more granular options for you many more granular options for configuring DHCP options and everything configuring DHCP options and everything configuring DHCP options and everything like this. What I also would do is, and like this. What I also would do is, and like this. What I also would do is, and this is this is this is especially for firewall rules very especially for firewall rules very especially for firewall rules very practical, is reservations. So, this practical, is reservations. So, this practical, is reservations. So, this means you do not have to configure means you do not have to configure means you do not have to configure static IP addresses for your static IP addresses for your static IP addresses for your administrative devices. For example, my administrative devices. For example, my administrative devices. For example, my Mac Studio or my MacBook or my Mac Studio or my MacBook or my Mac Studio or my MacBook or my production devices where I need to get production devices where I need to get production devices where I need to get access to certain services that other access to certain services that other access to certain services that other devices in my LAN should not get. I'm devices in my LAN should not get. I'm devices in my LAN should not get. I'm doing this via IP address filtering, and doing this via IP address filtering, and doing this via IP address filtering, and I added a reservation for this IP I added a reservation for this IP I added a reservation for this IP address to the MAC addresses of the address to the MAC addresses of the address to the MAC addresses of the network interface cards. So, that means network interface cards. So, that means network interface cards. So, that means only that device, because these MAC only that device, because these MAC only that device, because these MAC addresses are unique for every hardware, addresses are unique for every hardware, addresses are unique for every hardware, only this device will get that only this device will get that only this device will get that particular IP address that is ideally particular IP address that is ideally particular IP address that is ideally outside of the regular DHCP pool. Like

outside of the regular DHCP pool. Like outside of the regular DHCP pool. Like here, the pool range goes from here, the pool range goes from here, the pool range goes from 10.10.10.10 to 10.10.10.10 to 10.10.10.10 to 199, and the reservations are outside of 199, and the reservations are outside of 199, and the reservations are outside of that pool, so that it will never happen that pool, so that it will never happen that pool, so that it will never happen that any other device than these devices that any other device than these devices that any other device than these devices get this IP address. get this IP address. get this IP address. And in the firewall rules, then you can And in the firewall rules, then you can And in the firewall rules, then you can later add uh rules. For example, I have later add uh rules. For example, I have later add uh rules. For example, I have one for these IP addresses that can one for these IP addresses that can one for these IP addresses that can reach the production network or allowed reach the production network or allowed reach the production network or allowed to go anywhere else where other devices to go anywhere else where other devices to go anywhere else where other devices in the LAN are not allowed to do this. in the LAN are not allowed to do this. in the LAN are not allowed to do this. So, these are some best practices for So, these are some best practices for So, these are some best practices for managing DHCP. Now DNS, I just briefly managing DHCP. Now DNS, I just briefly managing DHCP. Now DNS, I just briefly want to cover it because again, as you want to cover it because again, as you want to cover it because again, as you have seen in the DHCP options, I'm not have seen in the DHCP options, I'm not have seen in the DHCP options, I'm not managing DNS on the firewall itself. I'm managing DNS on the firewall itself. I'm managing DNS on the firewall itself. I'm providing the IP addresses to my providing the IP addresses to my providing the IP addresses to my redundant DNS servers via DHCP options redundant DNS servers via DHCP options redundant DNS servers via DHCP options to the clients. So all the requests go to the clients. So all the requests go to the clients. So all the requests go to these servers and these servers do a to these servers and these servers do a to these servers and these servers do a recursive look up themselves. So the recursive look up themselves. So the recursive look up themselves. So the firewall is regularly in my network not firewall is regularly in my network not firewall is regularly in my network not involved in DNS. However, in my old involved in DNS. However, in my old involved in DNS. However, in my old setup, I also have done that via unbound setup, I also have done that via unbound setup, I also have done that via unbound DNS. And now again, OPNsense has a few DNS. And now again, OPNsense has a few DNS. And now again, OPNsense has a few different options for DNS. You can use different options for DNS. You can use different options for DNS. You can use unbound DNS. That is the more advanced unbound DNS. That is the more advanced unbound DNS. That is the more advanced system where you can add block lists, system where you can add block lists, system where you can add block lists, you can do query forwarding, DNS over you can do query forwarding, DNS over you can do query forwarding, DNS over TLS, and all these great things. Might TLS, and all these great things. Might TLS, and all these great things. Might be a bit more complicated to configure, be a bit more complicated to configure, be a bit more complicated to configure, so if you want to have a simple so if you want to have a simple so if you want to have a simple solution, then choose DNSmasq.

solution, then choose DNSmasq. solution, then choose DNSmasq. But yeah, I don't want to make this a But yeah, I don't want to make this a But yeah, I don't want to make this a DNS and DHCP tutorial. I think otherwise DNS and DHCP tutorial. I think otherwise DNS and DHCP tutorial. I think otherwise this probably would go on for hours and this probably would go on for hours and this probably would go on for hours and hours. But yeah, again, these services hours. But yeah, again, these services hours. But yeah, again, these services are pretty critical in your network. You are pretty critical in your network. You are pretty critical in your network. You should pay attention to the setups and should pay attention to the setups and should pay attention to the setups and how you provide the IP addresses and DNS how you provide the IP addresses and DNS how you provide the IP addresses and DNS resolution because this is also the resolution because this is also the resolution because this is also the foundation for creating firewall rules. foundation for creating firewall rules. foundation for creating firewall rules. Now OPNsense in version 26.1 released in Now OPNsense in version 26.1 released in Now OPNsense in version 26.1 released in January 26 promoted the existing January 26 promoted the existing January 26 promoted the existing firewall automation implementation into firewall automation implementation into firewall automation implementation into the new rules. In the recent version, the new rules. In the recent version, the new rules. In the recent version, they removed the legacy stuff now, but they removed the legacy stuff now, but they removed the legacy stuff now, but they are by the way still the same they are by the way still the same they are by the way still the same packet filters. So the underlying packet filters. So the underlying packet filters. So the underlying firewall engine hasn't really changed, firewall engine hasn't really changed, firewall engine hasn't really changed, but they modernized the management of but they modernized the management of but they modernized the management of the rules and configuration with proper the rules and configuration with proper the rules and configuration with proper API support and so on and search and API support and so on and search and API support and so on and search and filtering. So they improved it quite a filtering. So they improved it quite a filtering. So they improved it quite a bit. And this is certainly the heart and bit. And this is certainly the heart and bit. And this is certainly the heart and core of the firewall system which you core of the firewall system which you core of the firewall system which you probably should pay the most attention probably should pay the most attention probably should pay the most attention to. Now if you want to get a deep dive to. Now if you want to get a deep dive to. Now if you want to get a deep dive into how exactly I'm managing my into how exactly I'm managing my into how exactly I'm managing my firewall rules or controlling the access firewall rules or controlling the access firewall rules or controlling the access using VLANs plus the firewall rules. I using VLANs plus the firewall rules. I using VLANs plus the firewall rules. I will link you the video I've already will link you the video I've already will link you the video I've already done about this in the description box done about this in the description box done about this in the description box down below. Honestly, there hasn't down below. Honestly, there hasn't down below. Honestly, there hasn't really been much change to this, but I really been much change to this, but I really been much change to this, but I still want to give you some tips on how still want to give you some tips on how still want to give you some tips on how to actually configure these things here.

to actually configure these things here. to actually configure these things here. First of all, by default the firewall First of all, by default the firewall First of all, by default the firewall just blocks everything except for the just blocks everything except for the just blocks everything except for the rules that you create. And [snorts] you rules that you create. And [snorts] you rules that you create. And [snorts] you might be confused when you start you might be confused when you start you might be confused when you start you have no firewall rules but still traffic have no firewall rules but still traffic have no firewall rules but still traffic works and so on. This is because Open works and so on. This is because Open works and so on. This is because Open Sense has automatically generated rules. Sense has automatically generated rules. Sense has automatically generated rules. So this you should add or take a look at So this you should add or take a look at So this you should add or take a look at when you click or expand the drop-down when you click or expand the drop-down when you click or expand the drop-down menu. So here you can see there are many menu. So here you can see there are many menu. So here you can see there are many more rules all running in the background more rules all running in the background more rules all running in the background or created automatically for the system or created automatically for the system or created automatically for the system that this system actually works that this system actually works that this system actually works properly. So they allow DHCP traffic on properly. So they allow DHCP traffic on properly. So they allow DHCP traffic on all these interfaces. They allow DNS all these interfaces. They allow DNS all these interfaces. They allow DNS resolution and firewall access. Here for resolution and firewall access. Here for resolution and firewall access. Here for example, you can see there is an allow example, you can see there is an allow example, you can see there is an allow rule from the trunk port to this rule from the trunk port to this rule from the trunk port to this firewall on the administrative ports. firewall on the administrative ports. firewall on the administrative ports. This is the anti-logout rule for This is the anti-logout rule for This is the anti-logout rule for example, example, example, which you probably should not delete. which you probably should not delete. which you probably should not delete. It's a good idea to take a look at these It's a good idea to take a look at these It's a good idea to take a look at these automatically generated rules as well as automatically generated rules as well as automatically generated rules as well as your interface rules. And while this can your interface rules. And while this can your interface rules. And while this can get quite confusing, I always take a get quite confusing, I always take a get quite confusing, I always take a look at the log files and diagnosis. So look at the log files and diagnosis. So look at the log files and diagnosis. So here for example, in the log files, you here for example, in the log files, you here for example, in the log files, you can see the live view which really helps can see the live view which really helps can see the live view which really helps to get a better overview of what's to get a better overview of what's to get a better overview of what's currently going on your firewall system.

currently going on your firewall system. currently going on your firewall system. So here you can see if anything gets So here you can see if anything gets So here you can see if anything gets blocked. You could also filter on these blocked. You could also filter on these blocked. You could also filter on these actions here actions here actions here like action contains block. like action contains block. like action contains block. On the info icon, you can also see why On the info icon, you can also see why On the info icon, you can also see why that was the case. And you can also see that was the case. And you can also see that was the case. And you can also see the rule ID. So that is the unique the rule ID. So that is the unique the rule ID. So that is the unique identification of the firewall rule so identification of the firewall rule so identification of the firewall rule so that you know what rule actually blocked that you know what rule actually blocked that you know what rule actually blocked that traffic. So here's a label block that traffic. So here's a label block that traffic. So here's a label block private networks from LAN. Let's copy private networks from LAN. Let's copy private networks from LAN. Let's copy this. And then in the firewall rules this. And then in the firewall rules this. And then in the firewall rules overview tab, you can go to properties, overview tab, you can go to properties, overview tab, you can go to properties, enable ID, and then you can search for enable ID, and then you can search for enable ID, and then you can search for that firewall rule ID, and it will show that firewall rule ID, and it will show that firewall rule ID, and it will show you, "Okay, this is an automatically you, "Okay, this is an automatically you, "Okay, this is an automatically generated rule." So, this seems to block generated rule." So, this seems to block generated rule." So, this seems to block all the private IP addresses from the all the private IP addresses from the all the private IP addresses from the WAN interface, probably incoming WAN interface, probably incoming WAN interface, probably incoming traffic. traffic. traffic. And also, if you go to diagnostics And also, if you go to diagnostics And also, if you go to diagnostics sessions, here you can also see all sessions, here you can also see all sessions, here you can also see all opened sessions by your devices like opened sessions by your devices like opened sessions by your devices like here, for example, this is my Mac Studio here, for example, this is my Mac Studio here, for example, this is my Mac Studio has an open connection to that has an open connection to that has an open connection to that destination IP, probably a website that destination IP, probably a website that destination IP, probably a website that I currently opened. But this way, you I currently opened. But this way, you I currently opened. But this way, you can get more insight into the system. By can get more insight into the system. By can get more insight into the system. By the way, when we are talking about the way, when we are talking about the way, when we are talking about firewall rules and security, you might firewall rules and security, you might firewall rules and security, you might have noticed one thing that I just have noticed one thing that I just have noticed one thing that I just recently added to the system, and these recently added to the system, and these recently added to the system, and these are two block rules, one for the WAN are two block rules, one for the WAN are two block rules, one for the WAN interface and one for the LAN interface interface and one for the LAN interface interface and one for the LAN interface for malware IP addresses. Because it's for malware IP addresses. Because it's for malware IP addresses. Because it's great that you control on your firewall great that you control on your firewall great that you control on your firewall what traffic is allowed, like blocking what traffic is allowed, like blocking what traffic is allowed, like blocking WAN access to the web UI and SSH access,

WAN access to the web UI and SSH access, WAN access to the web UI and SSH access, but of course, any allowed connection in but of course, any allowed connection in but of course, any allowed connection in the firewall rules can still involve a the firewall rules can still involve a the firewall rules can still involve a malicious host. And that's why threat malicious host. And that's why threat malicious host. And that's why threat intelligent feeds provide an updated intelligent feeds provide an updated intelligent feeds provide an updated list that you can use in your firewall list that you can use in your firewall list that you can use in your firewall rules to block known malicious rules to block known malicious rules to block known malicious destination IP addresses outbound and destination IP addresses outbound and destination IP addresses outbound and known malicious sources inbound to your known malicious sources inbound to your known malicious sources inbound to your exposed services. And I'm using for this exposed services. And I'm using for this exposed services. And I'm using for this the threat intelligence for OPNsense the threat intelligence for OPNsense the threat intelligence for OPNsense made by Q feeds. Now, Q feeds has a nice made by Q feeds. Now, Q feeds has a nice made by Q feeds. Now, Q feeds has a nice option to include a plugin with a free option to include a plugin with a free option to include a plugin with a free community tier. So, you do not have to community tier. So, you do not have to community tier. So, you do not have to pay anything. Of course, there are also pay anything. Of course, there are also pay anything. Of course, there are also enterprise licenses and for more premium enterprise licenses and for more premium enterprise licenses and for more premium IP data as well as more frequent updates IP data as well as more frequent updates IP data as well as more frequent updates to these, but the community's feed is to these, but the community's feed is to these, but the community's feed is completely free for life. You can easily completely free for life. You can easily completely free for life. You can easily just sign up on their portal, and then just sign up on their portal, and then just sign up on their portal, and then in the Q feeds threat intelligence in the Q feeds threat intelligence in the Q feeds threat intelligence platform, you can easily just go to platform, you can easily just go to platform, you can easily just go to account settings, manage API keys, and account settings, manage API keys, and account settings, manage API keys, and create one with a free community edition create one with a free community edition create one with a free community edition that you can then use or import in the that you can then use or import in the that you can then use or import in the OPNsense firewall rule, and then the Q OPNsense firewall rule, and then the Q OPNsense firewall rule, and then the Q Feeds plugin is regularly updating the Feeds plugin is regularly updating the Feeds plugin is regularly updating the malicious IP block lists. You just need malicious IP block lists. You just need malicious IP block lists. You just need to go to system firmware plugins, click to go to system firmware plugins, click to go to system firmware plugins, click on view community plugins, and search on view community plugins, and search on view community plugins, and search for OSQ Feeds connector. This you of for OSQ Feeds connector. This you of for OSQ Feeds connector. This you of course need to install, and then under course need to install, and then under course need to install, and then under security you find this plugin where you security you find this plugin where you security you find this plugin where you need to put in your API key and activate need to put in your API key and activate need to put in your API key and activate the malicious IP and domain feeds. Set

the malicious IP and domain feeds. Set the malicious IP and domain feeds. Set up the firewall rule. Again, it's all up the firewall rule. Again, it's all up the firewall rule. Again, it's all described in their documentation, so I'm described in their documentation, so I'm described in their documentation, so I'm not going through this entire setup, but not going through this entire setup, but not going through this entire setup, but this way you can get protection with this way you can get protection with this way you can get protection with over 200K malware IPs and over 100K over 200K malware IPs and over 100K over 200K malware IPs and over 100K malware domains completely for free on malware domains completely for free on malware domains completely for free on your OPNsense firewall. So, in case your OPNsense firewall. So, in case your OPNsense firewall. So, in case anyone opens a connection to a malicious anyone opens a connection to a malicious anyone opens a connection to a malicious host, this automatically gets blocked by host, this automatically gets blocked by host, this automatically gets blocked by your firewall rules. Of course, make your firewall rules. Of course, make your firewall rules. Of course, make sure to add logging to the rules, but sure to add logging to the rules, but sure to add logging to the rules, but then in security under Q Feeds events, then in security under Q Feeds events, then in security under Q Feeds events, there are certainly some connections to there are certainly some connections to there are certainly some connections to malicious IPs blocked for my Mac Studio malicious IPs blocked for my Mac Studio malicious IPs blocked for my Mac Studio device. So, this adds some good threat device. So, this adds some good threat device. So, this adds some good threat intelligence protection on your OPNsense intelligence protection on your OPNsense intelligence protection on your OPNsense firewall as well. All right, so let's firewall as well. All right, so let's firewall as well. All right, so let's come last but not least to monitoring come last but not least to monitoring come last but not least to monitoring and alerting. I think this is also a and alerting. I think this is also a and alerting. I think this is also a quite important topic. OPNsense quite important topic. OPNsense quite important topic. OPNsense certainly has a great default dashboard certainly has a great default dashboard certainly has a great default dashboard that provides you some great insight that provides you some great insight that provides you some great insight into the system, the interface into the system, the interface into the system, the interface statistics, memory, disk, and firewall statistics, memory, disk, and firewall statistics, memory, disk, and firewall and traffic in and out. and traffic in and out. and traffic in and out. So, that's great. However, I still think So, that's great. However, I still think So, that's great. However, I still think the system is a bit limited. That's also the system is a bit limited. That's also the system is a bit limited. That's also the reason why I made a full dedicated the reason why I made a full dedicated the reason why I made a full dedicated tutorial on OPNsense monitoring with tutorial on OPNsense monitoring with tutorial on OPNsense monitoring with Prometheus and Grafana. So, this you Prometheus and Grafana. So, this you Prometheus and Grafana. So, this you might have already seen. If not, I'll might have already seen. If not, I'll might have already seen. If not, I'll link you this in the description box link you this in the description box link you this in the description box down below, of course. There are a few down below, of course. There are a few down below, of course. There are a few cool ways how you can get the monitoring cool ways how you can get the monitoring cool ways how you can get the monitoring and statistics of the OPNsense firewall and statistics of the OPNsense firewall and statistics of the OPNsense firewall out into your monitoring solution with out into your monitoring solution with out into your monitoring solution with Grafana. I'm using Grafana Alloy to Grafana. I'm using Grafana Alloy to Grafana. I'm using Grafana Alloy to scrape the metrics and logs from the scrape the metrics and logs from the scrape the metrics and logs from the system and put this into Prometheus and system and put this into Prometheus and system and put this into Prometheus and Grafana Loki for managing the logs. And Grafana Loki for managing the logs. And Grafana Loki for managing the logs. And then you can create some nice Grafana

then you can create some nice Grafana then you can create some nice Grafana dashboards that give you more insights dashboards that give you more insights dashboards that give you more insights into what's going on about the service into what's going on about the service into what's going on about the service status history about gateway and also status history about gateway and also status history about gateway and also ZFS. Now, this ZFS monitoring was not ZFS. Now, this ZFS monitoring was not ZFS. Now, this ZFS monitoring was not included in my old video. So, I'm included in my old video. So, I'm included in my old video. So, I'm quickly going to show this to you now quickly going to show this to you now quickly going to show this to you now because for this I've added a new plugin because for this I've added a new plugin because for this I've added a new plugin that provides metrics for the ZFS health that provides metrics for the ZFS health that provides metrics for the ZFS health as well. So, if you go to system as well. So, if you go to system as well. So, if you go to system firmware plugins, you will see firmware plugins, you will see firmware plugins, you will see I've added a new OS plugin called I've added a new OS plugin called I've added a new OS plugin called Telegraf. Telegraf is also a plugin that Telegraf. Telegraf is also a plugin that Telegraf. Telegraf is also a plugin that can expose metrics here. In the input can expose metrics here. In the input can expose metrics here. In the input settings, you can enable CPU, disk IO, settings, you can enable CPU, disk IO, settings, you can enable CPU, disk IO, memory, processes, and other metrics for memory, processes, and other metrics for memory, processes, and other metrics for built-in services as well. I've disabled built-in services as well. I've disabled built-in services as well. I've disabled everything because I'm already exposing everything because I'm already exposing everything because I'm already exposing these metrics with the Prometheus these metrics with the Prometheus these metrics with the Prometheus exporter. exporter. exporter. But, I've just enabled ZFS metrics But, I've just enabled ZFS metrics But, I've just enabled ZFS metrics exposure here. By the way, the output exposure here. By the way, the output exposure here. By the way, the output then of course you can also set to feed then of course you can also set to feed then of course you can also set to feed these metrics into InfluxDB, Graphite, these metrics into InfluxDB, Graphite, these metrics into InfluxDB, Graphite, Graylog, Elasticsearch, or just expose Graylog, Elasticsearch, or just expose Graylog, Elasticsearch, or just expose them with a Prometheus endpoint on that them with a Prometheus endpoint on that them with a Prometheus endpoint on that port here for example. And then port here for example. And then port here for example. And then configure Grafana Alloy to regularly configure Grafana Alloy to regularly configure Grafana Alloy to regularly scrape these metrics and put them into scrape these metrics and put them into scrape these metrics and put them into your Prometheus database. And then you your Prometheus database. And then you your Prometheus database. And then you can easily scrape these metrics here can easily scrape these metrics here can easily scrape these metrics here like the ZFS pool health status. So, like the ZFS pool health status. So, like the ZFS pool health status. So, then I know it's online, how much is then I know it's online, how much is then I know it's online, how much is used, and the arc size for caching. So, used, and the arc size for caching. So, used, and the arc size for caching. So, this for example would monitor if one of

this for example would monitor if one of this for example would monitor if one of the hard drives fail, which you cannot the hard drives fail, which you cannot the hard drives fail, which you cannot really see in the open sense dashboard really see in the open sense dashboard really see in the open sense dashboard unfortunately. But, you can also add unfortunately. But, you can also add unfortunately. But, you can also add Grafana alerts to get notified about Grafana alerts to get notified about Grafana alerts to get notified about anything that goes wrong here. Now, I anything that goes wrong here. Now, I anything that goes wrong here. Now, I think this obviously deserves think this obviously deserves think this obviously deserves a separate video. Again, [snorts] I've a separate video. Again, [snorts] I've a separate video. Again, [snorts] I've already done one for the monitoring and already done one for the monitoring and already done one for the monitoring and metrics scraping, but I certainly would metrics scraping, but I certainly would metrics scraping, but I certainly would do a dedicated video on Grafana alerts do a dedicated video on Grafana alerts do a dedicated video on Grafana alerts because I think this deserves its own because I think this deserves its own because I think this deserves its own video. But this way, you can easily add video. But this way, you can easily add video. But this way, you can easily add monitoring and alerting to your monitoring and alerting to your monitoring and alerting to your OpenSense firewall system. And I think OpenSense firewall system. And I think OpenSense firewall system. And I think this is a much better way than using the this is a much better way than using the this is a much better way than using the built-in system metrics, which are built-in system metrics, which are built-in system metrics, which are already great, but having a separate already great, but having a separate already great, but having a separate monitoring system is in my opinion quite monitoring system is in my opinion quite monitoring system is in my opinion quite important. But yeah, this we will cover important. But yeah, this we will cover important. But yeah, this we will cover in more detail in an upcoming video. in more detail in an upcoming video. in more detail in an upcoming video. This was everything that I just wanted This was everything that I just wanted This was everything that I just wanted to share with you, everything that I to share with you, everything that I to share with you, everything that I certainly would pay attention to when I certainly would pay attention to when I certainly would pay attention to when I install or set up a new OpenSense install or set up a new OpenSense install or set up a new OpenSense firewall and what plugins I use for firewall and what plugins I use for firewall and what plugins I use for this. But I'm pretty sure I missed this. But I'm pretty sure I missed this. But I'm pretty sure I missed anything, so some of you might want to anything, so some of you might want to anything, so some of you might want to recommend me another plugin or another recommend me another plugin or another recommend me another plugin or another topic that I should cover about topic that I should cover about topic that I should cover about OpenSense firewall. So if you have a OpenSense firewall. So if you have a OpenSense firewall. So if you have a good idea, if you want to share good idea, if you want to share good idea, if you want to share something with me, then please put it in something with me, then please put it in something with me, then please put it in the comments of this video or let's the comments of this video or let's the comments of this video or let's discuss it on Discord. So then I can discuss it on Discord. So then I can discuss it on Discord. So then I can make a follow-up video on this, but I make a follow-up video on this, but I make a follow-up video on this, but I hope this already gives you a good hope this already gives you a good hope this already gives you a good starting point. And yeah, if you want starting point. And yeah, if you want starting point. And yeah, if you want more content like this, then consider more content like this, then consider more content like this, then consider supporting me on Patreon. Thanks to all supporting me on Patreon. Thanks to all supporting me on Patreon. Thanks to all the people already doing this. You guys the people already doing this. You guys the people already doing this. You guys are so amazing. Of course, you will find are so amazing. Of course, you will find are so amazing. Of course, you will find a link to this program in the a link to this program in the a link to this program in the description box down below. And to

description box down below. And to description box down below. And to everybody else, thank you so much for everybody else, thank you so much for everybody else, thank you so much for watching. Of course, I'm going to catch watching. Of course, I'm going to catch watching. Of course, I'm going to catch you in the next video. Take care. you in the next video. Take care. you in the next video. Take care. Bye-bye.