10/12/2020

How to Install and Configure Basic OpnSense Firewall

OpnSense started it’s life off as a simple fork of PfSense but has evolved into an entirely independent firewall solution. This article will cover the installation and basic initial configuration of a new OpnSense installation.

Like PfSense, OpnSense is a FreeBSD based open source firewall solution. The distribution is free to install on one’s own equipment or the company Decisio, sells pre-configured firewall appliances.

OpnSense has a minimal set of requirements and a typical older home tower can easily be setup to run as an OpnSense firewall. The suggested minimum specifications are as follows:

Hardware Minimums

• 500 mhz CPU
• 1 GB of RAM
• 4GB of storage
• 2 network interface cards

Suggested Hardware

• 1GHz CPU
• 1 GB of RAM
• 4GB of storage
• 2 or more PCI-e network interface cards.

If the reader wishes to utilize some of the more advanced features of OpnSense (Suricata, ClamAV, VPN server, etc) the system should be given better hardware.

The more modules the user wishes to enable, the more RAM/CPU/Drive space should be included. It is suggest that the following minimums be met if there are plans to enable advance modules in OpnSense.

• Modern multi-core CPU running at least 2.0 GHz
• 4GB+ of RAM
• 10GB+ of HD space
• 2 or more Intel PCI-e network interface cards

Installation and Configuration of OpnSense Firewall

Regardless of which hardware is chosen, installing OpnSense is a simple process but does require the user to pay close attention to which network interface ports will be used for which purpose (LAN, WAN, Wireless, etc).

Part of the installation process will involve prompting the user to begin configuring LAN and WAN interfaces. The author suggests only plugging in the WAN interface until OpnSense has been configured and then proceed to finish the installation by plugging in the LAN interface.

Downloading OpnSense Firewall

The first step is to obtain the OpnSense software and there are a couple of different options available depending on the device and installation method but this guide will utilize the ‘OPNsense-18.7-OpenSSL-dvd-amd64.iso.bz2’.

The ISO was obtained using the following command:

$ wget -c http://mirrors.nycbug.org/pub/opnsense/releases/mirror/OPNsense-18.7-OpenSSL-dvd-amd64.iso.bz2

Once the file has been downloaded, it needs to be decompressed utilizing the bunzip tool as follows:

$ bunzip OPNsense-18.7-OpenSSL-dvd-amd64.iso.bz2

Once the installer has been downloaded and decompressed, it can either be burned to a CD or it can be copied to a USB drive with the ‘dd’ tool included in most Linux distributions.

The next process is to write the ISO to a USB drive to boot the installer. To accomplish this, use the ‘dd’ tool within Linux.

First, the disk name needs to be located with ‘lsblk‘ though.

$ lsblk

With the name of the USB drive determined as ‘/dev/sdc’, the OpnSense ISO can be written to the drive with the ‘dd’ tool.

$ sudo dd if=~/Downloads/OPNsense-18.7-OpenSSL-dvd-amd64.iso of=/dev/sdc

Note: The above command requires root privileges so utilize ‘sudo’ or login as the root user to run the command. Also this command will REMOVE EVERYTHING on the USB drive. Be sure to backup needed data.

Installation of OpnSense Firewall

Once dd has finished writing to the USB drive, place the media into the computer that will be setup as the OpnSense firewall. Boot that computer to that media and the following screen will be presented.

To continue to the installer, simply press the ‘Enter’ key. This will boot OpnSense into the Live mode but a special user exists to install OpnSense to local media instead.

When the system boots to the login prompt use the username of ‘installer’ with a password of ‘opnsense’.

The installation media will login and launch the actual OpnSense installer. CAUTION: Continuing with the following steps will result in all data on the hard drive within the system being erased! Proceed with caution or exit the installer.

Hitting the ‘Enter’ key will start the installation process. The first step is to select the keymap. The installer likely will detect the proper keymap by default. Review the selected keymap and correct as needed..

The next screen will provide some options for the installation. If the user wishes to do advanced partitioning or import a configuration from another OpnSense box, this can be accomplished at this step. This guide is assuming a fresh installation and will select the ‘Guided Installation’ option.

The following screen will display the recognized storage devices for installation.

Once the storage device is selected, the user will need to decide on which partitioning scheme is used by the installer (MBR or GPT/EFI).

Most modern day systems will support GPT/EFI but if the user is re-purposing an older computer, MBR may be the only option supported. Check within the BIOS settings of the system to see if it supports EFI/GPT.

Once the partitioning scheme is chosen, the installer will begin the installation steps. The process doesn’t take a particularly long time and will prompt the user for information periodically such as the root user’s password.

Once the user has set the root user’s password, the installation will be complete and the system will need to restarted in order to configure the installation. When the system reboots, it should automatically boot into the OpnSense install (make sure to remove the installation medium as the machine restarts).

When the system reboots, it will stop at the console login prompt and await for the user to log in.

Now if the user was paying attention during the installation they might have noticed that they could have pre-configured the interfaces during install. However let’s assume for this article that the interfaces weren’t assigned at install.

After logging in with the root user and password configured during installation, it can be noted that OpnSense only utilized one of the network interface cards (NIC) on this machine. In the image below it is named “LAN (em0)”.

OpnSense will default to the standard “192.168.1.1/24” network for the LAN. However in the above image, the WAN interface is missing! This is easily corrected by typing ‘1’ at the prompt and hitting enter.

This will allow for the re-assignment of the NICs on the system. Notice in the next image that there are two interfaces available: ‘em0’ and ‘em1’.

The configuration wizard will allow for very complex setups with VLANs as well but for now, this guide is assuming a basic two network setup; (ie a WAN/ISP side and a LAN side).

Enter ‘N’ to not configure any VLANs at this time. For this particular setup, the WAN interface is ‘em0’ and the LAN interface is ‘em1’ as seen below.

Confirm the changes to the interfaces by typing ‘Y’ in the prompt. This will cause OpnSense to reload many of it’s services to reflect the changes to the interface assignment.

Once done, connect a computer with a web browser to the LAN side interface. The LAN interface has a DHCP server listening on the interface for clients so the computer will be able to obtain the necessary addressing information to connect to the OpnSense web configuration page.

Once the computer is connected to the LAN interface, open a web browser and navigate to the following url: http://192.168.1.1.

To log into the web console; use the username ‘root’ and the password that was configured during the installation process. Once logged in, the final part of the installation will be completed.

The first step of the installer is used to simply gather more information such as hostname, domain name, and DNS servers. Most users can leave the ‘Override DNS’ option selected.

This will enable the OpnSense firewall to obtain DNS information from the ISP over the WAN interface.

The next screen will prompt for NTP servers. If the user doesn’t have their own NTP systems, OpnSense will provide a default set of NTP server pools.

The next screen is WAN interface setup. Most ISP for home users will use DHCP to provide their customers with necessary network configuration information. Simply leaving the Selected Type as ‘DHCP’ will instruct OpnSense to attempt to gather it’s WAN side configuration from the ISP.

Scroll down to the bottom of the WAN configuration screen to continue. ***Note*** at the bottom of this screen are two default rules to block network ranges that generally shouldn’t be see coming in to the WAN interface. It is recommended to leave these checked unless there is a known reason to allow these networks through the WAN interface!

The next screen is the LAN configuration screen. Most users can simply leave the defaults. Realize there are special network ranges that should be used here, commonly referred to as RFC 1918. Make sure to leave the default or pick a network range from within the RFC1918 range to avoid conflicts/issues!

The final screen in the installation will ask if the user would like to update the root password. This is optional but if a strong password wasn’t created during installation, now would be a good time to correct the issue!

Once past the password change option, OpnSense will ask for the user to reload the configuration settings. Simply click the ‘Reload’ button and give OpnSense a second to refresh the configuration and current page.

When everything is done, OpnSense will welcome the user. To get back to the main dashboard, simply click ‘Dashboard’ in the upper left corner of the web browser window.

At this point the user will be taken to the main dashboard and can continue to install/configure any of the useful OpnSense plugins or functionalities! The author does recommend checking and upgrading the system if upgrades are available. Simply click on the ‘Click to Check for Updates’ button on the main dashboard.

Then on the next screen, ‘Check for Updates’ can be used to see a list of updates or ‘Update Now’ can be used to simply apply any available updates.

At this point a basic install of OpnSense should be up and running as well as fully updated! In future articles, Link aggregation and inter-VLAN routing will be covered to show more of the advanced capabilities of OpnSense!