Opnsense Firewall Install

Overview

For this project, we will be looking at Opnsense and its use case in our networking / malware lab. I chose Opnsense mainly because of the way the documentation is formatted and displayed. After a quick glance, it appears that problem solving will be easier due to the docs if I run into any issues later. For my setup, I have already configured the bridges between Proxmox and my home network and will be setting up Opnsense to sit between my virtual machine labs and my home network.

Opnsense Download

Navigate to the Opnsense download page and select the amd64 system architecture, the dvd image type, and any mirror that you want to use for download. Once downloaded, go ahead and store the .iso in a folder for all of your .iso's.

Opnsense download page — selecting amd64 and DVD image

Choose a mirror and download the ISO

Linking and Uploading ISO's to Proxmox

Navigate to Datacenter → Node → local(node name) → ISO Images and click upload. From here, we will be selecting the Opnsense .iso that we downloaded and choosing "none" for the hash (unless you want to hash for verification). Finally, select Upload to get the .iso image into Proxmox. If you already downloaded more operating system .iso's, then you can go ahead and upload the rest here.

Creating the Opnsense VM

In Proxmox, create a new VM with the following settings: allocate sufficient resources (CPU cores, RAM). Attach the Opnsense ISO image. Configure the network interfaces to match your bridge setup. Boot from the ISO and proceed with the Opnsense installation wizard.

Initial Opnsense Configuration

Once Opnsense boots, you'll be guided through the installation process. Configure your network interfaces, set static IPs, and access the web interface. The web GUI is the primary management tool for firewall rules, DNS, DHCP, and security policies.

Once your options are configured, make sure you update and restart Opnsense, after which you are done! You can move on to other OS VM's safely knowing Opnsense has your back!

Problems Encountered

The majority of my problems came from trying to access Opnsense from a computer that was not on the same LAN. Since I am segmenting Proxmox into two separate LANs that need different security containment, I chose not to run a physical RJ45 cable from the Proxmox node to the accessing machine. However, I thought I could get by with accessing the Opnsense management GUI over WAN. After an hour or so of troubleshooting and diagnosing why I could not access the Opnsense GUI from other desktop web browsers, I discovered that for security reasons, Opnsense blocks management access to the firewall itself from the WAN side. Many commands were used that showed lighttpd was open and talking on port 80, but I still could not access it.

Since Opnsense can't be accessed from the WAN, a forum tip led me to creating a light Debian OS virtual machine that was in the same LAN Opnsense was managing. With the Debian VM started up, we could open a web browser and navigate to the Opnsense web GUI and access it correctly. This led me to re-think my malware lab setup and decide (at least for now) that the light Debian VM will also need to start on boot and will stay on (during lab practice) for the duration of the exercise to manage firewall rules.

What Worked Well

The Opnsense documentation is thorough and easy to follow. The web interface is intuitive for managing firewall rules, NAT configurations, and security policies. The integration with Proxmox through bridged networking worked smoothly once properly configured.

What I'd Do Differently

I would have planned the network architecture more carefully before starting. Having a management VM on the same LAN from the beginning would have saved troubleshooting time. I would also document the network topology and firewall rules as I build them.