Hardening is what makes OPNsense a controlled device rather than a feature-rich router with a default password. The defaults from OPNsense are reasonable but not production-grade: the admin GUI listens on all interfaces, SSH allows password authentication, and the kernel tunables reflect a balance rather than a posture. This checklist moves every knob that the operator can move into a hardened position.
When to use
Use this checklist when a fresh OPNsense install is being prepared for production, after any change to administrative access, after an incident where admin credentials or access were implicated, and at least annually as a regression check. It also pairs with the post-upgrade checklist, since upgrades sometimes reset tunables.
How to use
Walk the list, capture the current value and the target value for each tunable, apply the change in a tracked maintenance window, and re-export the running configuration to version control. Anything marked critical must be confirmed before the firewall is connected to a production network.