OPNsense for Production Network & Security Administrators

Part I

Networking Foundations for Firewall Administrators

Ethernet, MAC, ARP, IPv4/IPv6, CIDR, subnets, gateways, routing, TCP, UDP, ICMP — the prerequisites every firewall operator must already understand.

6 lessons

Part II

Routing Fundamentals

Routing tables, connected routes, default routes, static routes, longest-prefix match, asymmetric routing, policy routing.

6 lessons

Part III

Stateful Firewalling and PF

Stateful vs stateless filtering, PF rule evaluation, state creation, automatic rules, state lifetime, quick and non-quick behaviour.

6 lessons

Part IV

OPNsense Architecture

FreeBSD base, configuration generation, services (PF, Unbound, ISC DHCP, WireGuard, IPsec), web UI, API, firmware model.

6 lessons

Part V

Installation and Initial Deployment

Hardware sizing, ISO/USB install, console, wizard, interfaces, DNS, NTP, management access.

6 lessons

Part VI

Hardware and Virtualisation Design

CPU, RAM, NIC choice, offloading, virtio, VLAN trunking, passthrough, virtual firewall sizing.

6 lessons

Part VII

Interface Management

WAN, LAN, OPT interfaces, assignments, IPv4/IPv6 addressing, static and DHCP, interface tracking.

6 lessons

Part VIII

Management Plane Security

GUI exposure, HTTPS, SSH, administration networks, source restrictions, MFA, accounts, role separation.

6 lessons

Part IX

Firewall Rules

Interface rules, rule direction, rule processing order, generated rules, automatic rules.

6 lessons

Part X

Aliases and Floating Rules

Host, network, port, URL-table aliases; floating rules; quick; multi-interface use; warnings against misuse.

6 lessons

Part XI

Firewall States

State table, state lifetime, state inspection, clearing states, rule changes vs existing state.

6 lessons

Part XII

NAT Fundamentals and Outbound NAT

SNAT, DNAT, automatic, hybrid, manual outbound NAT, source translation, NAT/PF interaction.

6 lessons

Part XIII

Port Forwarding and NAT Reflection

Inbound DNAT, port forwarding, 1:1 NAT, hairpin/reflection, split-DNS alternatives.

6 lessons

Part XIV

VLANs and Segmentation

802.1Q, VLAN creation, trunk/access, parent interface, inter-VLAN firewalling, east-west traffic.

6 lessons

Part XV

DMZ Architecture

Internet → firewall → DMZ → internal; modern DMZ variants; risks; public service isolation.

6 lessons

Part XVI

IPv6

IPv6 addressing, SLAAC, DHCPv6, router advertisements, prefix delegation, IPv6 firewalling.

6 lessons

Part XVII

DHCP

Scopes, pools, reservations, gateways, DNS, lease behaviour, relay, IPv6 DHCPv6.

6 lessons

Part XVIII

DNS and Unbound

Recursive vs authoritative, Unbound resolver mode, overrides, DNSSEC, DNS over TLS, access lists.

6 lessons

Part XIX

Multi-WAN and Gateway Groups

Redundant WAN, gateway monitoring, failover, load balancing, policy routing, tiered gateways.

6 lessons

Part XX

VPN Fundamentals

Tunnelling, encryption, authentication, routing, remote access, site-to-site, technology comparison.

6 lessons

Part XXI

WireGuard

Peers, keys, allowed IPs, routing, firewall rules, NAT, roaming, troubleshooting.

6 lessons

Part XXII

IPsec

IKEv1/v2, Phase 1/2, proposals, selectors, NAT-T, route-based vs policy-based, OPNsense strongSwan integration.

6 lessons

Part XXIII

VPN Troubleshooting

Layered diagnosis of negotiation, authentication, routing, NAT, firewall, MTU, DNS.

6 lessons

Part XXIV

PKI and Certificates

CA, certificate, private key, CSR, trust chain, revocation, expiry, internal CA, ACME.

6 lessons

Part XXV

Authentication and Identity

Local users, groups, LDAP, RADIUS, MFA, external identity failure implications.

6 lessons

Part XXVI

High Availability Fundamentals

Active/passive, redundancy, shared IP, state sync, config sync, two firewalls are not automatically HA.

6 lessons

Part XXVII

CARP

CARP VIPs, VHID, advertisements, MASTER/BACKUP, skew, multicast, switch dependencies.

6 lessons

Part XXVIII

pfsync and Configuration Synchronisation

State replication, configuration sync, what does and does not synchronise, security of sync interface.

6 lessons

Part XXIX

HA Network Design, Failure Scenarios, Maintenance

Reference HA topology, failure scenarios (node, interface, CARP, pfsync), rolling maintenance.

6 lessons

Part XXX

Dynamic Routing

Static vs dynamic, OSPF/BGP integration, advertising risks, FRR/OSPFd/BIRD on OPNsense.

6 lessons

Part XXXI

Intrusion Detection and Suricata

IDS vs IPS, Suricata architecture, rules, categories, alerts, IPS mode, tuning.

6 lessons

Part XXXII

TLS Inspection and Content Filtering

TLS interception limits, privacy, MITM, web filtering plugins, threat-intel blocklists.

6 lessons

Part XXXIII

Logging and Remote Logging

Firewall logs, system logs, VPN logs, DNS logs, IDS logs, remote syslog integration.

6 lessons

Part XXXIV

Monitoring and Observability Integration

CPU, memory, interfaces, gateways, state table, VPN, HA, services, Prometheus, Grafana, Loki.

6 lessons

Part XXXV

Performance and State Table

PPS, throughput, state count, CPU, NIC offload, crypto workload, state-table sizing, exhaustion.

6 lessons

Part XXXVI

Packet Capture and Diagnostics

tcpdump, GUI live capture, BPF filters, interface selection, capture-driven troubleshooting.

6 lessons

Part XXXVII

Packet Flow Methodology

The systematic source → ingress → rule → state → NAT → route → egress → destination flow.

6 lessons

Part XXXVIII

Troubleshooting Methodology

Define symptom, determine impact, gather evidence, identify subsystem, form hypothesis, test, validate.

6 lessons

Part XXXIX

Lockout Prevention and Console Recovery

Management rules, LAN rule changes, interface reassignment, console, serial, hypervisor console.

6 lessons

Part XL

Backup, Restore, Disaster Recovery

Configuration backup, restore, interface mapping, certificates, plugins, full-appliance loss recovery.

6 lessons

Part XLI

Upgrades and Plugin Management

Read release notes, backup, check plugins, validate HA, upgrade secondary, test, fail over, upgrade primary.

6 lessons

Part XLII

API and Automation

OPNsense API, authentication, permissions, endpoints, automation safety.

6 lessons

Part XLIII

Ansible-Driven Firewall Configuration

Conceptual integration with Ansible; configuration deployment, drift, validation, inventory.

6 lessons

Part XLIV

Change Management and Rule Review

Pre-checks, blast radius, rollback, peer review, periodic rule review, anti-patterns.

6 lessons

Part XLV

Production Hardening and Zero-Trust Concepts

Hardening checklist, zero-trust principles, least privilege, identity, segmentation boundaries.

6 lessons

Part XLVI

Remote Access and Site-to-Site Architecture

Admin remote access, user VPN, site-to-site, multi-site, cloud connectivity.

6 lessons

Part XLVII

Capacity Planning

Bandwidth, PPS, state count, VPN throughput, IDS/IPS throughput, logging volume, sizing.

6 lessons

Part XLVIII

Production Reference Architecture

A realistic mission-critical reference architecture with HA, multi-WAN, VLANs, VPN, IDS, monitoring.

6 lessons

Part Labs

Hands-On Labs

Disposable-virtualisation labs covering install, rules, NAT, VLANs, VPN, HA, IDS, API, backup, and recovery.

0 lessons

Part Runbooks

Operational Runbooks

Operational procedures: deploy, troubleshoot, change, fail over, restore, recover.

0 lessons

Part Checklists

Production Checklists

Printable readiness, change, and review checklists.

0 lessons

Part Break/Fix

Break/Fix Scenarios

Deliberate operational incidents with evidence-first diagnosis.

0 lessons

Part Capstone

Capstone: Production OPNsense Estate

A complete HA OPNsense estate with multi-WAN, VLANs, VPN, IDS, logging, monitoring, backup, and validated recovery.

0 lessons

Part Final

Final Assessment

Theory and practical assessment of every production competency.

0 lessons