OpnSense Router (MiniPC)

OpnSense router is the heart and soul of entire homelab setup. Firewall rules, VLAN configurations, exposing services to the internet, wireguard setup… everything is done in OpnSense. I have setup OpnSense in a Mini PC. This PC has two LAN ports and is powered with Intel N150 processor.

One port connects to XPON modem and the other port connects to Switch. Until switch is configured, the other port can be connected directly to laptop/PC.

This document highlights all the configuration(s) I have done in OpnSense router. I’ll try to document as much as I can, and keep this document updated.

I’ll segregate OpnSense configuration(s) in their own sections. This should make it easy to navigate and jump to relevant sections.

ISP configuration to connect to Internet

#

Assuming XPON is configured and is in registered state, I’ll proceed to setup router to connect to the internet.

My ISP connects over PPPoE and has VLAN configured. I was provided details for both by them.

The VLAN ID provided by ISP is different from VLAN we will configure to segregate internal network. ISPs use VLANs to segregate services provided by them such as internet service, VoIP, etc.

I’ll first create the interfaces (Step #1 and Step #2). Then begin configuring required interfaces. ISP configuration deals with mini pc’s wan interface. I’ll configure the interface devices (VLAN, etc.) as per my ISP’s requirements. On successful configuration, router should be able to connect to the internet. Meaning ping test from router to internet should work.

Create ISP VLAN

#

1. Go to Interfaces -> Devices -> VLAN and create a new VLAN.
2. Enter Device Name (eg: vlan0.<tag>)
3. Select Parent interface. This should be the WAN interface (Important!) - ethernet port to which XPON modem is connected to. For me this is igc1.
4. Enter VLAN tag provided by ISP
5. VLAN Priority 0
6. Description is optional
7. Save and Apply

Create PPPoE device

#

1. Go to Interfaces -> Devices -> Point-to-Point
2. Click Add new interface
3. Link Type - PPPoE
4. Link Interface - VLAN interface created in previous step
5. Description (optional)
6. Username/password - as provided by ISP
7. Leave rest as it is. Populate fields that are applicable to you.
8. Save and Apply

wan (igc1) interface

#

XPON modem is connected to this interface

1. Go to Interfaces -> <wan> interface. Ensure Identifier in interface is wan.
2. Let’s call this UnderWAN. This is because PPPoE device uses this interface under the hood. Set Description = UnderWAN
3. Changes to this interface gets applied to PPPoE device interface automatically.
4. With this new OpnSense router, authentication was failing with ISP because of MAC mismatch. My ISP had previous router’s MAC address registered with them.
5. To fix this, set MAC Address to MAC registered with ISP - for me this is previous router’s MAC address.
6. Save and apply

PPPoE interface Assignment

#

1. The PPPoE device created in Step #2 needs to be enabled
2. Go to Interfaces -> Assignments
3. Create a new assignment for PPPoE device created in Step #2
4. Set description WAN_ISP
5. Save and apply. Once applied, WAN_ISP should be visible under Interfaces section
6. Configuring WAN_ISP interface
7. Go to Interfaces -> WAN_ISP
8. Enable interface if its disabled
9. Set description WAN_ISP
10. IPv4 configuration - select PPPoE
11. MSS - 1492 - Without this setting, router uses default MSS - 1500 which is incorrect. PPPoE connection uses 8 bytes, which should be accounted for in MSS value.
12. Save and apply

Testing connectivity

#

I’ll try pinging host 1.1.1.1 from opnsense router-

1. Go to Interfaces -> Diagnostics -> Ping
2. Enter hostname - 1.1.1.1
3. Address Family - IPv4
4. Keep rest as it is. Click Start
5. Let it run for a few seconds.
6. Note Send and Receive values. If they are greater than 0, internet connect is working.

If it doesn’t work, double-check the following:

• PPPoE credentials
• VLAN tag provided by ISP
• Custom MSS value? Wrong MSS can lead to dropping of packets.
• UnderWAN interface MAC address override.
• Is XPON modem in Registered state?

VLAN configuration

#

This is internal VLAN configuration to segregate internal network.

Here, we work with lan interface which is igc0 for me.

I have following VLANs configured. This serves my current use-case, and might change in future as and when required.

The idea is to isolate PUBLIC and IOT network from TRUSTED network, while keeping all management devices (such as routers/switch/etc.) isolated from all other networks.

Creating VLAN devices

#

1. Go to Interfaces -> Devices -> VLAN
2. Click Add VLAN
3. Enter Device Name (eg: vlan0.<tag>)
4. Select Parent interface. This should be the WAN interface (Important!) - ethernet port to which XPON modem is connected to. For me this is igc1.
5. Enter VLAN tag provided by ISP
6. VLAN Priority 0
7. Description is optional
8. Save and Apply

Repeat this for all other VLANs

Device Assignment

#

After creating VLAN devices, we need to assign them an interface.

1. Go to Interface -> Assignments
2. Click Add
3. Enter description. Ideally it should be identifier for Device we select in next step
4. Select VLAN device for which interface is to be created.
5. Keep rest of the fields default
6. Click Save

Repeat for all VLAN devices. Once done, click Apply for changes to take effect.

After applying, refresh page. Interfaces created should be visible under Interfaces

For each VLAN interface, ensure:

• It is Enabled and have Prevent Interface removal enabled.
• Verify the Device it is assigned to. Should ideally be vlan* device or wan/lan
• Under Generic configuration:
  • Set IPv4 Configuration Type to Static IPv4
  • Under Static IPv4 configuration
  • Enter IPv4 address and subnet. Eg: For IOT, the IPv4 address will be 10.0.30.1 and subnet /24.
  • This IPv4 acts as gateway and interface address.
  • Subnet tells valid range of IPs this interface will work for. Eg: All devices within 10.0.30.1/24 will have gateway pointing to IOT interface.

Repeat for all interfaces.

Next, I’ll configure DHCP ranges for all these interfaces.

DHCP Range configuration

#

This configuration defines valid range the IPs from which DHCP server provides IP addresses to clients.

1. Go to Services -> Dnsmasq DNS & DHCP -> DHCP Ranges
2. Click Add button
3. Select Interface
4. Enter Start Address
5. Enter End Address
6. Keep rest of the fields default
7. Save

Repeat this for all interfaces. Once created, click Apply for changes to take effect.

Example:

This tells IOT devices will get IPs betweek 10.0.30.10 and 10.0.30.199

Firewall Rules

#

By default, firewall restricts traffic for all new interfaces. Meaning all traffic to/from interface will be blocked. I’ll configure firewall rules to allow traffic to flow through the interface(s).

At a high level, these are the basic rules I want:

• IOT, PUBLIC network should not be able to talk to any other internal network (Eg: TRUSTED)
• TRUSTED should be able to talk to all interfaces

Firewall Alias

#

Before proceeding, I’ll create a Firewall alias. This will come handy when I need to refer multiple interfaces in single firewall rule.

1. Go to Firewall -> Aliases
2. Click Add
3. Enter name (eg: internal_networks)
4. Select Type - Network(s)
5. In Content dropdown select all the VLAN and WAN interface(s).
6. Enter optional description
7. Save and Apply

Configuring Firewall for IOT

#

Firewall Rule #1

#

Enable access to all interfaces except internal networks. This will allow IOT to connect to internet

1. Go to Firewall -> Rules
2. Click Add
3. Select Interface as IOT
4. Disable Quick
5. Action Pass
6. Source will be IOT network
7. Destination internal_networks - This should be the alias created above
8. Enable Invert Destination checkbox - with this enabled, the rule applies to all interfaces except for one(s) select in Destination.
9. Keep rest of the fields as default
10. Enable Log if required
11. Save

Firewall Rule #2

#

Rule #1 blocks access to it’s own interface as well. Allow access to IOT interface gateway DNS lookup (Port 53)

1. Go to Firewall -> Rules
2. Click Add
3. Select Interface as IOT
4. Enable Quick
5. Action - Pass
6. Protocol - TCP/UDP
7. Source - IOT network
8. Destination - IOT address
9. Destination port 53 (domain)
10. Keep rest of the fields as default
11. Enable Log if required
12. Save

Once both these rules are created, Click Apply for changes to take effect. IOT devices should now not have access to internal networks, and should be able to access the internet

Repeat same step(s) for PUBLIC. Tweak as required.

Configuring Firewall for TRUSTED

#

For TRUSTED VLAN, I have allowed all access.

1. Go to Firewall -> Rules
2. Click Add
3. Select Interface as PUBLIC
4. Enable Quick
5. Action - Pass
6. Keep rest of the fields as default
7. Enable Log if required
8. Save

Configure firewall rules for all the VLAN devices. Feel free to tweak rules, harden them as required.

Restricting OpnSense to MANAGEMENT VLAN

#

By default, OpnSense management interface is accessible on all Interface addresses. Eg: It will be accessible from IOT device on IP 10.0.30.1, etc.

I don’t want any VLAN other than Management VLAN to be able to access OpnSense management console. To achieve this, I did the following:

Assuming MANAGEMENT VLAN is created and IPv4 is assigned to the interface (Reference: VLAN Configuration)

3. Go to System -> Settings -> Administration
4. Under Web GUI -> Listen Interfaces - Select MANAGEMENT
5. Click Save and Apply

With this, the Opnsense interface is only accessible on MANAGEMENT VLAN.

Wireguard Setup

#

(WIP)