Bachelor Tech
  • Home
  • Tutorials
  • Portfolio
  • About Jan
  • Contact Jan

Initial OPNSense Set up in Web GUI

by Jan Bachelor September 23, 2020

Last Updated on September 23, 2020 by Jan Bachelor

1. Wizard

  • Once you log in to the OPNSense GUI, you can set some basic parameters for your network by going to System -> Wizard.
  • In the first step, confirm the hostname of your VM and specify a domain. For a private network, I used a non-resolvable domain name (.priv), but you can use anything you like. Just keep in mind that if you use a resolvable domain name (e.g. hello.com), if you point to a VM that is offline, your local DNS resolver will try to reach devices on the internet.
  • In the next step, choose your time zone and leave the rest as-is.
  • Then in the WAN inteface settings, leave it at DHCP, since your ISP’s modem will typically provide an address for this interface (unless they provided a manual IP assignment, in which case, enter it here). Then make sure that ‘Block private networks from entering WAN’ is ticked (the only expection is if you have a manual private IP assigned from your ISP) and that you ticked ‘Block non-Internet routed networks from entering via WAN’.
WAN settings – typically, use DHCP + tick these two boxes
  • On the LAN interface tab, chose the address to be assigned to your OPNSense instance (typically, this is 192.168.1.1 with a subnet mask of 255.255.255.0 = /24).
  • Then retype your root password, click ‘Next’ and then reload the configuration.

2. Apply & schedule updates

  • Go to ‘System’ -> ‘Firmware’ -> ‘Updates’ -> click on ‘Check for updates’. If there any updates pending, apply them. A restart of the VM may be required.
Apply updates after the initial set up
  • To apply updates in future, schedule automatic firmware updates. Go to ‘System’ -> ‘Settings’ -> ‘Cron’ and add a new entry by clicking on the + sign. Choose a suitable time in the night (such as Hours: 3, Days of the week: 5) and the command to be ‘Automatic firmware update’. Description can be something like ‘Weekly fw update and reboot’. Save it. Then click on the ‘Apply’ button.
Set up an automatic update schedule for your OPNSense

3. Confirm AES-NI support + CPU temperature monitoring

  • In ‘System’ -> “Settings’ -> ‘Miscellaneous’ in the ‘Cryptography settings’ section, confirm that ‘AES-NI CPU-based Acceleration (aesni)’ is selected. This is confirms that AES-NI instructions can be used by OPNSense, if supported by your Inter/AMD CPU.
  • Then in the ‘Thermal Sensors’ section below it, choose the Intel or AMD supported driver for temperature monitoring.
Check AES-NI support and select which CPU driver to be used for temperature monitoring

4. Verify interfaces (WAN / LAN) & first Proxmox snapshot

  • Verify that the correct interface is assigned for WAN and LAN. Go to ‘Interfaces’ -> ‘Assignments’. The vnet0 (and its MAC address) should match the first virtual network card in Proxmox, which we defined to be for all LAN physical interfaces (vmbr0).
  • Similarly, since we defined the WAN interface in Proxmox (as vmbr1) and assigned it to the OPSense VM in step 5 of the OPNSense VM set up section, it should be showing as the WAN interface in Proxmox.
Virtual interface assignment in OPNSense
Virtual interface assignment in Proxmox
  • What could be a little confusing is that for devices like Qotom, you may have 4-8 ports and you only see one LAN port here. This is because all the physical LAN ports are under one virtual LAN port, as shown below:
WAN versus LAN interface assignment in Proxmox

5. Take the first snapshot of your configuration

  • Go to Proxmox -> ‘Datacenter’ -> your node -> locate your VM -> Snapshots -> click on the ‘Take Snapshot’ button. Give it a name without spaces and dashes (underscores are allowed). Leave the ‘Include RAM’ button as ticked.
Taking your first OPNSense VM snapshot
  • In future, at any point, if you cut yourself off or have some other issues, you can always recover the VM to the working state in which it was before.

6. Restart and switch-over

  • It is highly advisable to perform a ‘warm’ reboot of your OPSense VM to ensure it reboots after the many configuration changes we made earlier.
  • While you could reboot it directly from Proxmox, because there is no Qemu agent for FreeBSD (at the time of writing this guide, at least), Proxmox would perform a ‘cold’ restart, potentially damaging system files. For this reason, rather go to ‘Power’ -> ‘Reboot’ and confirm ‘Yes’.
Reboot your VM to confirm it restarts correctly.
  • While you are waiting for VM to reboot, make sure that the OPNSense VM is set up to autostart at Proxmox’s boot:
Ensure that your OPNSense VM is set up to auto-start at Proxmox’s boot
  • After the restart, it is time to power it off again, followed by powering off your Proxmox and swap your Qotom for your ISP router! This could be a daunting operation, but I encourage you to give it a go!

Troubleshooting

  • When you switch over, be patient with the booting time. You can connect to the QOTOM box via HDMI to see whether Promox has successfully booted and then assign your computer a static IP (e.g. 192.168.1.10 with network mask of 255.255.255.0 and gateway of 192.168.1.1) to connect without a router directly to access the web interface of Proxmox, and then to check OPNSense’s console.
  • Keep in mind that even if you cannot reach the web GUI of OPNSense, you can always access the console from Proxmox and navigate to the console view of the VM.

WAN / LAN Set Up (Before OPNSense Installation)
Dynamic DNS Set Up with DuckDNS on OPNSense
Back to: Build Your Own Router – Proxmox, OPNSense, OpenVPN server and a VPN client all in one!

1 comment

Network Guru September 23, 2020 - 6:51 pm

All worked as described here, thank you!

Reply

Leave a Comment Cancel Reply

Save my name, email, and website in this browser for the next time I comment.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

0 comment 0 FacebookWhatsappEmail

Build Your Own Router – Proxmox, OPNSense, OpenVPN server and a VPN client all in one!

  • Previous
  • Next
Collapse
Expand
  • Hardware Considerations
  • Disabling default Proxmox firewall
  • OPNSense VM Set Up
  • OPNSense Installation
  • PCI Passthrough Set Up (Optional)
  • WAN / LAN Set Up (Before OPNSense Installation)
  • Initial OPNSense Set up in Web GUI
  • Dynamic DNS Set Up with DuckDNS on OPNSense
  • Choosing a VPN provider for your OPNSense
  • Is it worth getting VPN on OPNSense?
  • NordVPN installation on OPNSense
  • Multi-WAN Set Up in Proxmox & OPNSense

Search for articles

Other Tips

  • How to mount an NFS share (such as from FreeNAS) from an Android box
  • How to download a Windows 10 ISO on a Windows device – easy work-around

Other Tutorials

  • Build Your Own Router - Proxmox, OPNSense, OpenVPN server and a VPN client all in one!
    12 Steps
  • Dynamically Populate Gravity Forms from Google Sheets (GSheets APIv4)
    6 Steps

Recent Comments

  • Jan Bachelor on Use Integromat to get computer IDs from user email in JamF ProHi Robert, the static groups were created in the p…
  • Robert Petitto on Use Integromat to get computer IDs from user email in JamF ProCan you share how you'd use Make (integromat) to a…
  • Martin on Part 1 – What do we want to do + Required technology (bank feed)This tutorial deserves more credit, I've not seen…
  • Jan Bachelor on WAN / LAN Set Up (Before OPNSense Installation)Hi Ed, I have not tested it with PCI passthrough y…
  • Ed on OPNSense VM Set UpIn step 4 firewall you turned off firewall, should…

Tags

chrome iso windows

Categories

  • Android
  • FreeNAS
  • Linux
  • Windows

Recent Posts

  • How to mount an NFS share (such as from FreeNAS) from an Android box

  • How to download a Windows 10 ISO on a Windows device – easy work-around

Facebook Twitter Instagram Pinterest Linkedin Youtube

@2019 - All Right Reserved. Designed and Developed by PenciDesign

Bachelor Tech
  • Home
  • Tutorials
  • Portfolio
  • About Jan
  • Contact Jan