A new OPNsense deployment is production-ready only when the firewall is on a stable firmware branch, interfaces are correctly assigned with deny-by-default policies, administrative access is locked down to a management network, and the device is integrated with the operator’s backup, logging, and NTP infrastructure. This checklist captures the pre-deploy items that turn a freshly installed OPNsense image into a controlled network control plane.
When to use
Use this checklist before exposing any OPNsense firewall to production traffic for the first time, after a hardware replacement that produces a fresh install, and after a rebuild that mirrors a previous device. It is also the right place to start when a lab or staging firewall is being promoted to production.
How to use
Walk the list top to bottom in the GUI (or via the API) and mark each item verified. Anything with severity critical must be satisfied before traffic is accepted; warn items should be addressed in the same change window or in a tracked follow-up. Capture a final XML configuration export when the checklist is complete and store it in the same change record as the deployment.