RunBook AcademyOPNsense

← All checklists in OPNsense

Before deploymentNetworking

Internet Edge Security

15 items ·10 critical ·3 warn ·2 info

The WAN-facing side of an OPNsense firewall is where the firewall earns its keep: every inbound connection is untrusted and every outbound connection is a chance for a service to be exfiltrated. This checklist enforces the minimum posture that should be true of any production WAN: deny by default, no exposed admin, no exposed management, and outbound NAT that covers every internal subnet so return traffic cannot be hijacked.

When to use

Use this checklist before a new OPNsense firewall is connected to an ISP hand-off, before any change to the WAN-side rule set or NAT, and after any ISP change (new provider, new CPE, new prefix). It is also the right checklist to re-run after any WAN-facing incident.

How to use

Walk the list in the GUI while reviewing the WAN interface, the outbound NAT configuration, and the WAN rules. Mark each item, capture a pf state-table baseline, and file the change with the operator’s change system. Anything with severity critical must be satisfied before the WAN cable is connected to upstream.

Critical10 items

Default deny rule on the WAN interface; no implicit pass for inbound traffic.
```
Firewall > Rules > WAN; the last rule must be a reject.
```
Block private networks and block bogons are both enabled on WAN.
```
Interfaces > WAN; both checkboxes on.
```
Multicast is blocked on WAN via firewall rule or interface option.
Outbound NAT is configured for every internal subnet and the chosen mode (Hybrid or Manual) is documented.
```
Firewall > NAT > Outbound.
```
Port forwards (NAT > Port Forward) match the published service inventory and each has a matching firewall rule.
UPnP / NAT-PMP is disabled on WAN unless explicitly required by a controlled service.
```
Firewall > Settings > Advanced; UPnP IGD.
```
PPPoE WAN (where used) has MSS clamping enabled to prevent fragmentation on common MTU paths.
```
Interfaces > WAN; "Use MSS clamping"  on.
```
Anti-spoofing via reverse-path filtering is enforced (block non-routable sources on WAN).
No WAN-side service (SSH, GUI, API) is exposed to the public internet.
DMZ hosts are placed in a separate VLAN / interface and inter-VLAN rules enforce deny by default.

Warning3 items

No 1:1 NAT entries exist unless documented; review each mapping for stale entries.
ICMP inbound is limited to diagnostic types; traceroute is not facilitated unnecessarily.
Provider-side expectations (e.g. CPE managed by ISP) are documented; OPNsense handles the public-facing side.

Info2 items

ICMPv6 ND is permitted only where IPv6 is offered via the same provider (and the prefix is correct).
A clean state table baseline (size, age) is captured for later comparison.
```
pfctl -ss | wc -l; pfctl -si.
```