Curriculum

1. 01Ethernet, MAC and ARP — the Layer 2 the firewall operator must readLayer 2 and Layer 3 foundations · foundation · ~14 min
2. 02IPv4 and IPv6 addressing, CIDR and subnetsLayer 2 and Layer 3 foundations · foundation · ~16 min
3. 03TCP, UDP and ICMP — the protocols every firewall rule decides onLayer 2 and Layer 3 foundations · foundation · ~14 min
4. 04Gateways, default routes and asymmetric routingLayer 2 and Layer 3 foundations · foundation · ~12 min
5. 05DNS for the firewall operatorLayer 2 and Layer 3 foundations · foundation · ~14 min
6. 06DHCP for the firewall operatorLayer 2 and Layer 3 foundations · foundation · ~12 min

1. 07Routing tables and the control planeRouting fundamentals · foundation · ~14 min
2. 08Connected, static and default routesRouting fundamentals · foundation · ~13 min
3. 09Longest prefix match and the routing decisionRouting fundamentals · foundation · ~13 min
4. 10Asymmetric routing and PF stateRouting fundamentals · intermediate · ~15 min
5. 11Policy routing and source-based routingRouting fundamentals · intermediate · ~14 min
6. 12Routing troubleshooting and evidenceRouting fundamentals · intermediate · ~16 min

1. 13Stateful vs stateless filteringStateful firewalling and PF · foundation · ~14 min
2. 14PF rule evaluation orderStateful firewalling and PF · intermediate · ~15 min
3. 15State creation and tracking in PFStateful firewalling and PF · intermediate · ~14 min
4. 16Quick and non-quick rulesStateful firewalling and PF · intermediate · ~12 min
5. 17Tables, anchors, and include in PFStateful firewalling and PF · intermediate · ~14 min
6. 18PF internals and the generated configurationStateful firewalling and PF · advanced · ~16 min

1. 19OPNsense — history, design philosophy and current positionOPNsense architecture · foundation · ~12 min
2. 20FreeBSD as the base — services, rc.d, and what the operator noticesOPNsense architecture · foundation · ~14 min
3. 21The configuration generation model — XML to FreeBSD to running servicesOPNsense architecture · intermediate · ~14 min
4. 22PF and the kernel interface — how packets actually moveOPNsense architecture · intermediate · ~16 min
5. 23The web UI and REST API surfaceOPNsense architecture · intermediate · ~14 min
6. 24Firmware updates and the plugin modelOPNsense architecture · intermediate · ~14 min

1. 25Hardware sizing and selection — CPU, RAM, NIC, throughputInstallation and initial deployment · intermediate · ~14 min
2. 26Physical install on a dedicated appliance — BIOS, IPMI, consoleInstallation and initial deployment · intermediate · ~12 min
3. 27Virtual install on Proxmox — virtio, VLAN trunking, sizing the VMInstallation and initial deployment · intermediate · ~14 minLab
4. 28Boot menu and console — single-user, reset, factory recoveryInstallation and initial deployment · intermediate · ~14 minLab
5. 29The initial wizard — hostname, interfaces, WAN, LAN, admin passwordInstallation and initial deployment · intermediate · ~14 minLab
6. 30Management network isolation, NTP sources, DNS hardeningInstallation and initial deployment · intermediate · ~14 min

1. 31CPU, RAM sizing and throughput targetsHardware and virtualisation design · intermediate · ~14 min
2. 32NIC selection — Intel vs Broadcom vs RealtekHardware and virtualisation design · intermediate · ~13 min
3. 33Offload — checksum, TSO, LRO, RSS — and what to disable for capture/IDSHardware and virtualisation design · intermediate · ~13 min
4. 34Virtualisation — virtio vs e1000 vs vmxnet3 on ProxmoxHardware and virtualisation design · intermediate · ~13 min
5. 35VLAN trunking on a single vNICHardware and virtualisation design · intermediate · ~12 min
6. 36PCI passthrough and isolated NICsHardware and virtualisation design · advanced · ~14 min

1. 37Interface assignments and rolesInterface management · foundation · ~12 min
2. 38Interface tracking and gateway failoverInterface management · intermediate · ~12 min
3. 39Static and DHCP interface configurationInterface management · foundation · ~12 min
4. 40IPv6 on the interfaceInterface management · intermediate · ~13 min
5. 41Bridges, laggs, and bondingInterface management · intermediate · ~12 min
6. 42Wireless, loopback, and GIF tunnel interfacesInterface management · intermediate · ~13 min

1. 43GUI exposure and source restrictionsManagement Plane Security · intermediate · ~14 min
2. 44HTTPS and TLS certificates for the GUIManagement Plane Security · intermediate · ~14 min
3. 45SSH administrationManagement Plane Security · intermediate · ~13 min
4. 46Administration networks and VLANsManagement Plane Security · intermediate · ~14 min
5. 47MFA and TOTPManagement Plane Security · intermediate · ~14 min
6. 48Accounts, groups, and role separationManagement Plane Security · intermediate · ~13 min

1. 49Interface rules and directionFirewall Rules · foundation · ~14 min
2. 50Rule processing orderFirewall Rules · foundation · ~14 min
3. 51Rule action: block, reject, passFirewall Rules · foundation · ~12 min
4. 52Automatic rules and default allowFirewall Rules · intermediate · ~13 min
5. 53Rule scheduling and timeFirewall Rules · intermediate · ~12 min
6. 54Rule logging and traceFirewall Rules · intermediate · ~13 min

1. 01Host, network and port aliases — naming and when to useAliases and floating rules · intermediate · ~14 min
2. 02Table aliases and URL feedsAliases and floating rules · intermediate · ~14 min
3. 03Floating rules — purpose and multi-interface matchingAliases and floating rules · intermediate · ~13 min
4. 04Floating rule direction and quick — order, shadowing and intentAliases and floating rules · intermediate · ~13 min
5. 05Alias anti-patterns — overly broad tables, slow refresh, and silent failuresAliases and floating rules · intermediate · ~13 min
6. 06Rule documentation and meta — why the description field is not optionalAliases and floating rules · foundation · ~12 min

1. 01State table anatomy — tuple, timeout, counters, packets, bytesFirewall state operations · intermediate · ~13 min
2. 02State lifetimes and timeouts — TCP, UDP and ICMPFirewall state operations · intermediate · ~13 min
3. 03State inspection with pfctl — reading the state table for diagnosticsFirewall state operations · intermediate · ~12 min
4. 04Clearing states — pfctl -k vs pfctl -F state, and when each is rightFirewall state operations · intermediate · ~12 min
5. 05Rule changes do not affect existing state — the trap that wastes hoursFirewall state operations · foundation · ~12 min
6. 06State exhaustion and DoS — sizing, symptoms and recoveryFirewall state operations · intermediate · ~14 min

1. 01NAT fundamentals — SNAT, DNAT, and where in the packet flow each one happensNAT fundamentals · foundation · ~12 min
2. 02Outbound NAT modes — automatic, hybrid, and manualOutbound NAT · foundation · ~14 min
3. 03Outbound NAT rule fields — interface, source, destination, translation targetOutbound NAT · intermediate · ~13 min
4. 04Outbound NAT with multiple WANs — per-interface source selectionOutbound NAT · intermediate · ~14 min
5. 051:1 NAT and bidirectional NAT — when each is appropriateInbound NAT · intermediate · ~12 min
6. 06NAT anti-patterns — broad translations, ICMP breakage, MTU, and the auto-rule override trapOutbound NAT · intermediate · ~14 min

1. 01Port forwarding packet path — Internet to internal server through OPNsensePort forwarding · foundation · ~13 min
2. 02Port forwarding and the associated firewall rule — automatic vs manualPort forwarding · intermediate · ~13 min
3. 031:1 NAT as destination — exposing an internal server on a public IPInbound NAT · intermediate · ~12 min
4. 04NAT reflection and hairpin NAT — when it is needed and why split DNS is saferNAT reflection · advanced · ~13 min
5. 05Split DNS as an alternative to NAT reflection — Unbound host overridesNAT reflection · intermediate · ~12 min
6. 06Port forward troubleshooting — packet flow verification end-to-endPort forwarding · advanced · ~14 min

1. 79802.1Q and VLAN trunking — what tagged frames actually areVLAN foundations · intermediate · ~14 min
2. 80VLAN creation and parent interfaces — building the trunk in OPNsenseVLAN foundations · intermediate · ~14 min
3. 81VLAN interface addressing and DHCP — IPs, scopes, and what listensVLAN addressing and DHCP · intermediate · ~16 min
4. 82Inter-VLAN routing basics — when the firewall is the routerInter-VLAN routing and east-west filtering · intermediate · ~14 min
5. 83East-west firewalling — VLAN-to-VLAN rules and least privilegeInter-VLAN routing and east-west filtering · advanced · ~16 min
6. 84Default-deny segmentation — design templates for production estatesInter-VLAN routing and east-west filtering · advanced · ~18 min

1. 85DMZ architecture and purpose — the buffer zone between Internet and LANDMZ foundations · intermediate · ~14 min
2. 86Public services in a DMZ — what to expose and what to keep privateDMZ services and isolation · intermediate · ~14 min
3. 87Triple-homed firewall — WAN, DMZ, LAN interfaces and the routing decisionsDMZ services and isolation · advanced · ~16 min
4. 88DMZ bastion and jump hosts — administrative access to the DMZDMZ services and isolation · intermediate · ~14 min
5. 89DMZ isolated by firewall — what the DMZ can and cannot reachDMZ services and isolation · advanced · ~14 min
6. 90DMZ monitoring and incident response — IDS, log forwarding, and what to do when a DMZ host is compromisedDMZ monitoring and incident response · advanced · ~16 min

1. 01IPv6 address plan — /48 upstream, /64 per subnet, ULA for internalIPv6 addressing · intermediate · ~14 min
2. 02SLAAC and Router Advertisements — how OPNsense announces the IPv6 prefixIPv6 addressing · intermediate · ~15 min
3. 03DHCPv6 on OPNsense — stateful, stateless, and when each is rightIPv6 addressing · intermediate · ~14 min
4. 04Prefix delegation from the ISP — how OPNsense receives and uses the prefixIPv6 addressing · intermediate · ~13 min
5. 05IPv6 firewall rules — address families, ICMPv6, and why "block all IPv6" is dangerousIPv6 firewall · advanced · ~16 min
6. 06IPv6 transition pitfalls — dual-stack, NAT64, AAAA records, and what breaksIPv6 firewall · advanced · ~14 min

1. 01DHCP scope and pool design — address range, gateway, DNS, lease timeDHCPv4 server · foundation · ~14 min
2. 02DHCP reservations and static mappings — when to use, MAC format gotchasDHCPv4 server · foundation · ~12 min
3. 03DHCP options 66, 67, 150, 43, and 82 — PXE, VoIP, vendor, and relayDHCPv4 server · intermediate · ~14 min
4. 04DHCP relay across VLANs — when the DHCP server is not on the same VLANDHCP relay · intermediate · ~13 min
5. 05DHCPv6 stateful vs stateless — when each is appropriate, OPNsense configDHCPv6 server · intermediate · ~14 min
6. 06DHCP troubleshooting — common failure modes, log analysis, packet captureDHCP operations · intermediate · ~15 min

1. 01Unbound in resolver mode versus forwarder modeUnbound configuration · foundation · ~12 min
2. 02Unbound configuration — interfaces, ACLs, DNSSEC, prefetch, cache sizeUnbound configuration · intermediate · ~14 min
3. 03DNS over TLS and DNSSEC — confidentiality and validation togetherUnbound configuration · intermediate · ~12 min
4. 04Host overrides and split-horizon DNSSplit-horizon and overrides · intermediate · ~12 min
5. 05DNS access lists — restricting which subnets can query the firewall resolverSplit-horizon and overrides · foundation · ~10 min
6. 06DNS troubleshooting — unbound-control, drill, tcpdump, SERVFAIL patternsTroubleshooting · intermediate · ~14 min

1. 01Multi-WAN concepts — redundancy, capacity, segregationMulti-WAN architecture · foundation · ~12 min
2. 02Gateway monitoring and dpinger — the probe, the thresholds, the triggersGateway monitoring · intermediate · ~12 min
3. 03Gateway groups and tiers — Tier 1 primary, Tier 2 failover, Tier 3 load balanceGateway groups · intermediate · ~12 min
4. 04Policy routing with gateway groups — sending specific traffic over specific WANsPolicy routing · intermediate · ~12 min
5. 05Multi-WAN NAT rules — outbound NAT per WAN, source address translationMulti-WAN NAT · intermediate · ~12 min
6. 06Multi-WAN troubleshooting — false failovers, asymmetric routing, monitoring target issuesMulti-WAN troubleshooting · advanced · ~14 min

1. 01VPN concepts — tunnelling and encryption, and what a tunnel actually isVPN fundamentals · foundation · ~13 min
2. 02VPN authentication and authorisation — who is on the other end, and what they can doVPN fundamentals · foundation · ~13 min
3. 03VPN routing and tunnel interfaces — putting the tunnel inside the routing tableVPN fundamentals · intermediate · ~14 min
4. 04Remote access vs site-to-site — the two shapes of VPN trafficVPN fundamentals · foundation · ~12 min
5. 05VPN protocol comparison — IPsec, WireGuard and OpenVPN at the firewallVPN fundamentals · intermediate · ~14 min
6. 06VPN design decisions — picking protocol, topology, addressing and authenticationVPN fundamentals · advanced · ~14 min

1. 01WireGuard concepts and keys — the cryptographic identity of a peerWireGuard · foundation · ~13 min
2. 02WireGuard AllowedIPs and routing — the most consequential line in the configurationWireGuard · intermediate · ~14 min
3. 03WireGuard firewall rules and NAT — the rules that let VPN traffic throughWireGuard · intermediate · ~13 min
4. 04WireGuard site-to-site — building tunnels between networksWireGuard · intermediate · ~14 minLab
5. 05WireGuard remote access — VPN for individual users, full-tunnel and split-tunnelWireGuard · intermediate · ~14 minLab
6. 06WireGuard troubleshooting — diagnosing tunnels that do not come upWireGuard · advanced · ~15 min

1. 01IPsec concepts — IKEv1 vs IKEv2, transports, and the tunnel building blocksIPsec fundamentals · intermediate · ~14 min
2. 02IPsec Phase 1 and Phase 2 — authentication, key exchange, and lifetimesIPsec fundamentals · intermediate · ~15 minLab
3. 03IPsec proposals and ciphers — encryption, integrity, and DH group choicesIPsec fundamentals · intermediate · ~14 min
4. 04IPsec route-based vs policy-based — how OPNsense wires the tunnel into the firewallIPsec configuration models · intermediate · ~14 minLab
5. 05IPsec site-to-site on OPNsense — building, configuring and verifying a tunnelSite-to-site deployment · advanced · ~16 minLab
6. 06IPsec NAT-Traversal and MTU — encapsulating through NAT, encapsulating within a wireIPsec operational considerations · intermediate · ~13 minLab

1. 01VPN diagnostic methodology — the layered evidence-first approachDiagnostic methodology · advanced · ~15 min
2. 02VPN negotiation failures — proposal mismatches, identifier errors, network reachabilityNegotiation failures · advanced · ~14 minLab
3. 03VPN authentication and certificate failures — diagnosing AUTHENTICATION_FAILED, expiry, and chain errorsAuthentication and certificates · advanced · ~14 minLab
4. 04VPN routing failures — when the tunnel is up but traffic does not reach the remote subnetRouting failures · advanced · ~14 minLab
5. 05VPN MTU and fragmentation — path MTU discovery, MSS clamping, and the ICMP that disappearsMTU and fragmentation · advanced · ~14 minLab
6. 06VPN DNS after tunnel up — split-horizon DNS, resolver selection, and the surprisesDNS after tunnel up · advanced · ~14 min

1. 01PKI fundamentals — the cryptography the firewall operator must understandPKI and certificate management · foundation · ~14 min
2. 02Running an internal CA on OPNsensePKI and certificate management · intermediate · ~14 minLab
3. 03Certificate signing requests — what a CSR really containsPKI and certificate management · intermediate · ~14 minLab
4. 04Importing certificates and distributing the trust anchorPKI and certificate management · intermediate · ~14 minLab
5. 05ACME and automated certificate renewalPKI and certificate management · intermediate · ~14 minLab
6. 06Certificate expiry monitoring — the alert that prevents the outagePKI and certificate management · intermediate · ~14 min

1. 01Local users and groups — the firewall’s first identity storeAuthentication and identity · foundation · ~14 min
2. 02Privilege separation and roles — least privilege on the firewallAuthentication and identity · intermediate · ~14 min
3. 03LDAP integration — central identity for the fleetAuthentication and identity · intermediate · ~14 minLab
4. 04RADIUS and TACACS+ — protocol-level authorisation for the fleetAuthentication and identity · intermediate · ~14 minLab
5. 05Two-factor authentication and TOTP — the second factor that mattersAuthentication and identity · intermediate · ~14 minLab
6. 06External identity failure implications — when the directory is downAuthentication and identity · intermediate · ~14 min

1. 01Availability and redundancy — why a second firewall, what HA is actually solvingAvailability and redundancy · foundation · ~11 min
2. 02Active/passive versus active/active — the two HA topologies and when each is the right answerHA topologies · intermediate · ~12 min
3. 03Shared IP and virtual IPs — the abstraction that lets two firewalls look like oneVirtual IPs · intermediate · ~11 min
4. 04State synchronisation concepts — keeping the backup warm for failoverState synchronisation · intermediate · ~14 min
5. 05Configuration synchronisation concepts — keeping the two nodes in lockstepConfiguration synchronisation · intermediate · ~13 min
6. 06HA prerequisites and design questions — what to confirm before the first failover testHA prerequisites · intermediate · ~13 min

1. 01CARP concepts and VHIDs — the protocol that makes a shared IP workCARP fundamentals · intermediate · ~13 min
2. 02CARP advertisements and skew — the maths of who is masterCARP fundamentals · intermediate · ~14 min
3. 03CARP virtual IP configuration on OPNsense — the GUI, the ifconfig, and the packet flowCARP configuration · intermediate · ~15 min
4. 04CARP multicast and switches — what the Layer 2 must do for HA to workCARP wire-level behaviour · intermediate · ~13 min
5. 05CARP failover triggers — what makes the backup take overCARP failover · intermediate · ~14 min
6. 06CARP troubleshooting — split-brain, flap, and the demotion that will not clearCARP operations · intermediate · ~17 min

1. 01pfsync — state synchronisation between OPNsense peersState and configuration synchronisation · advanced · ~14 min
2. 02pfsync configuration on OPNsenseState and configuration synchronisation · advanced · ~12 min
3. 03pfsync interface and securityState and configuration synchronisation · advanced · ~10 min
4. 04Configuration synchronisation — what does and does not syncState and configuration synchronisation · advanced · ~12 min
5. 05Configuration synchronisation — versioning and conflictsState and configuration synchronisation · advanced · ~10 min
6. 06Configuration synchronisation — failure modesState and configuration synchronisation · advanced · ~12 min

1. 01HA reference topology — production-grade OPNsense pairHA operations · advanced · ~16 min
2. 02HA sync interface and management planeHA operations · advanced · ~10 min
3. 03HA failure — node lossHA operations · advanced · ~12 min
4. 04HA failure — interface lossHA operations · advanced · ~10 min
5. 05HA failure — split brainHA operations · advanced · ~14 min
6. 06HA rolling maintenance — the canonical procedureHA operations · advanced · ~16 min

1. 01Static versus dynamic routing — when the operator manages routes and when the routers doStatic versus dynamic routing · foundation · ~12 min
2. 02FRR and Quagga on OPNsense — the routing daemons and how OPNsense exposes themFRR and Quagga on OPNsense · intermediate · ~13 min
3. 03OSPF concepts — areas, LSAs, neighbours, and the shortest-path treeOSPF concepts · intermediate · ~14 min
4. 04OSPF on OPNsense — configuring FRR, advertising networks, and the production disciplineOSPF on OPNsense · advanced · ~15 min
5. 05BGP concepts — autonomous systems, path vectors, and the policy that connects networksBGP concepts · advanced · ~15 min
6. 06BGP on OPNsense — configuring FRR, peering with upstreams, and the production disciplineBGP on OPNsense · advanced · ~16 min

1. 01IDS versus IPS — detection, prevention, and where the firewall fits in betweenIDS versus IPS · foundation · ~11 min
2. 02Suricata architecture — the engine, the threads, the packet flow, and the rule setSuricata architecture · intermediate · ~14 min
3. 03Suricata installation on OPNsense — the plugin, the interfaces, the home net, and the rule setSuricata installation on OPNsense · intermediate · ~14 min
4. 04Suricata rule categories — what the Emerging Threats rulesets cover and how to chooseSuricata rule categories · intermediate · ~13 min
5. 05Suricata IPS mode and blocking — inline detection, drop rules, and the cost of false positivesSuricata IPS mode and blocking · advanced · ~15 min
6. 06Suricata tuning and false positives — disabling rules, suppressing alerts, and the operational disciplineSuricata tuning and false positives · advanced · ~16 min

1. 01TLS inspection concepts and risks — what MITM at the firewall meansTLS inspection concepts · intermediate · ~14 min
2. 02Internal CA for TLS intercept — issuing the certificate the proxy will forgeTLS inspection concepts · intermediate · ~13 minLab
3. 03TLS intercept deployment — putting the proxy between the client and the InternetTLS intercept deployment · intermediate · ~16 minLab
4. 04Web filtering plugins — URL categories, content types, and application controlWeb filtering and content control · intermediate · ~13 minLab
5. 05Threat intelligence and blocklists — feeding the firewall from external sourcesThreat intelligence feeds · intermediate · ~13 min
6. 06Content filtering policy and ethics — what the operator is allowed to doContent filtering policy · intermediate · ~12 min

1. 01Logging architecture on OPNsense — where the logs come from and where they goLogging architecture · foundation · ~12 min
2. 02Firewall log reading — what each filterlog line tells youLog reading · intermediate · ~14 min
3. 03System and service logs — what lives outside the filter logLog reading · intermediate · ~13 min
4. 04Syslog protocol and format — the wire format every log forwarder speaksSyslog fundamentals · foundation · ~12 min
5. 05Remote syslog to observability — forwarding OPNsense logs to a SIEM or log serverRemote forwarding · intermediate · ~14 minLab
6. 06Log retention and rotation — keeping what you need, deleting what you do notLog retention · intermediate · ~11 min

1. 01Monitoring the firewall itself — what to instrument before anything elseMonitoring the firewall itself · intermediate · ~13 min
2. 02Prometheus exporter on OPNsense — getting the firewall into a time-series databasePrometheus and time-series collection · intermediate · ~14 min
3. 03Grafana dashboards for OPNsense — from raw metrics to operator insightGrafana dashboards · intermediate · ~14 min
4. 04SNMP and traditional monitoring — the protocol that pre-dates Prometheus and still earns its placeSNMP and traditional monitoring · intermediate · ~13 min
5. 05Health checks and Monit — local self-healing and the discipline of a daemon that restarts servicesHealth checks and Monit · intermediate · ~12 min
6. 06Observability of the firewall architecture — the discipline of seeing the whole stack, not just the deviceObservability of the firewall architecture · advanced · ~14 min

1. 01Throughput and packets per second — the two numbers that define firewall capacityThroughput and packet rate · intermediate · ~14 min
2. 02State table sizing and defaults — the limits that determine whether new flows are acceptedState table sizing and defaults · intermediate · ~13 min
3. 03State table exhaustion symptoms — recognising the failures before the user doesState table exhaustion symptoms · intermediate · ~12 min
4. 04CPU and interrupt saturation — when the packet path becomes the bottleneckCPU and interrupt saturation · advanced · ~15 min
5. 05VPN performance and crypto offload — what determines how fast the tunnel goesVPN performance and crypto offload · advanced · ~14 min
6. 06IDS performance impact — what Suricata costs and how to keep it from breaking the firewallIDS performance impact · advanced · ~15 min

1. 01Packet capture fundamentals — what tcpdump actually shows and what it leaves outPacket capture fundamentals · intermediate · ~14 min
2. 02tcpdump on the firewall — the operator's primary capture tooltcpdump on the firewall · intermediate · ~13 min
3. 03GUI live capture — when to use the web interface and when to drop to the shellGUI live capture · intermediate · ~11 min
4. 04BPF filters for firewall traffic — writing precise capture expressionsBPF filters for firewall traffic · intermediate · ~15 min
5. 05Capture on VLANs and tunnels — seeing traffic that lives on the wrong interfaceCapture on VLANs and tunnels · advanced · ~14 min
6. 06Capture-driven troubleshooting — using packet captures to close firewall incidentsCapture-driven troubleshooting · advanced · ~16 min

1. 01Packet flow overview — the journey of a packet through OPNsensePacket flow overview · intermediate · ~14 min
2. 02Source to ingress interface — what happens before PF sees the packetSource to ingress interface · intermediate · ~12 min
3. 03Firewall rule evaluation — how PF decides to pass or blockFirewall rule evaluation · intermediate · ~14 min
4. 04State creation and match — how PF tracks flows and passes return trafficState creation and match · intermediate · ~14 min
5. 05Routing decision and egress — from PF pass to packet on the wireRouting decision and egress · intermediate · ~13 min
6. 06NAT in the packet flow — where translation happens and why it surprises operatorsNAT in the packet flow · intermediate · ~14 min

1. 01Troubleshooting mindset — the discipline that prevents incidents from becoming outagesTroubleshooting methodology · intermediate · ~14 min
2. 02Symptom, cause and contributing factor — separating what the user sees from what the firewall didTroubleshooting methodology · intermediate · ~12 min
3. 03Evidence-first diagnosis — commands, outputs and the discipline of reading themTroubleshooting methodology · intermediate · ~16 min
4. 04Firewall rule troubleshooting — finding the rule that drops the packetSubsystem troubleshooting · intermediate · ~16 min
5. 05NAT troubleshooting — finding the translation that did not happenSubsystem troubleshooting · advanced · ~16 min
6. 06Routing troubleshooting — finding the missing route, the wrong gateway, and the asymmetric returnSubsystem troubleshooting · advanced · ~17 min

1. 01Lockout risks and prevention — every way an operator can lock themselves outLockout prevention · intermediate · ~14 min
2. 02Anti-lockout rule and defaults — the safety net that lets you change other rulesLockout prevention · intermediate · ~13 min
3. 03Safe rule change procedure — the discipline that prevents lockoutsLockout prevention · intermediate · ~15 min
4. 04Physical console recovery — the hard path that always worksConsole recovery · intermediate · ~14 min
5. 05Virtual console and serial — recovering OPNsense on Proxmox, VMware, and KVMConsole recovery · intermediate · ~13 min
6. 06Factory reset and configuration restore — the last-resort recovery pathsConsole recovery · advanced · ~15 min

1. 01Config backup strategy — what to back up, when, and why cadence mattersBackup strategy · intermediate · ~14 min
2. 02Config backup content — what is in the XML, what is not, and what to redactBackup content · intermediate · ~15 min
3. 03Secure storage and versioning of configuration backupsSecure storage and versioning · intermediate · ~14 min
4. 04Restore from backup — the procedure, the verification, and the rollback planRestore from backup · intermediate · ~16 min
5. 05Interface mapping considerations across hardware revisionsInterface mapping · advanced · ~16 min
6. 06Full appliance disaster recovery — the runbook when the box is goneDisaster recovery · advanced · ~18 min

1. 01Upgrade process and cadence — when to upgrade, how often, and what to read firstUpgrade process · intermediate · ~14 min
2. 02Pre-upgrade validation — the checklist before the rebootPre-upgrade validation · intermediate · ~15 min
3. 03Major version upgrades — the 25.x to 26.x leap and what it carriesMajor version upgrades · advanced · ~18 min
4. 04Plugin management lifecycle — install, configure, update, retirePlugin lifecycle · intermediate · ~15 min
5. 05Plugin abandonment and alternatives — when the maintainer walks awayPlugin abandonment · advanced · ~14 min
6. 06Rollback strategy — when the upgrade fails, the firmware is broken, or the plugin is incompatibleRollback strategy · advanced · ~18 min

1. 01API authentication and tokens — key/secret pairs, Basic auth, and least privilege for the automation tierAPI and automation fundamentals · intermediate · ~14 min
2. 02API endpoints overview — the taxonomy, the namespaces, and where to find what you needAPI and automation fundamentals · intermediate · ~14 min
3. 03API safety and rate limiting — staged writes, idempotency, and the operational guardrailsAPI operations · intermediate · ~16 min
4. 04API firewall rule automation — building rules safely from a scriptAPI operations · advanced · ~16 min
5. 05API alias automation — hosts, networks, ports, URL-tables, and nested tablesAPI operations · advanced · ~14 min
6. 06API monitoring and webhooks — driving observability from firewall eventsAPI operations · intermediate · ~14 min

1. 01Ansible for firewalls — concepts, trade-offs, and blast-radius disciplineAnsible foundations · intermediate · ~16 min
2. 02OPNsense Ansible collection — ansibleguy.opnsense modules, installation, and version pinningAnsible foundations · intermediate · ~14 min
3. 03Ansible inventory for firewalls — static hosts, group_vars, host_vars, and dynamic discoveryInventory design · intermediate · ~14 min
4. 04Ansible playbook shape — pre-flight, change, post-flight, and the anti-lockout gatesPlaybook design · advanced · ~18 min
5. 05Drift detection with Ansible — comparing desired state to actual state across the estateDrift and observability · advanced · ~14 min
6. 06Ansible failure modes — partial fleet, lockouts, idempotency breakage, and recoveryFailure modes and recovery · advanced · ~18 min

1. 01Pre-change checklist — the discipline that turns a risky change into a reversible oneChange management · intermediate · ~14 min
2. 02Change documentation and tickets — the audit trail that survives the operatorChange management · intermediate · ~13 min
3. 03Rollback strategies — how to reverse a change that turned out to be wrongChange management · advanced · ~15 min
4. 04Rule review cadence — the schedule that keeps the ruleset honestRule review · intermediate · ~14 min
5. 05Shadowed and redundant rules — finding the rules that are doing nothingRule review · intermediate · ~15 min
6. 06Rule cleanup and hygiene — the discipline that keeps the ruleset maintainableRule review · advanced · ~13 min

1. 01Hardening checklist overview — frameworks, scope, and the discipline of defence in depthProduction hardening · intermediate · ~14 min
2. 02Management plane hardening — securing the GUI, SSH, API, and console pathsProduction hardening · intermediate · ~15 min
3. 03Network plane hardening — anti-spoofing, bogon blocking, ICMP rate-limiting, and the perimeterProduction hardening · advanced · ~14 min
4. 04Data plane hardening — defaults, IDS/IPS posture, TLS inspection, and the rulesetProduction hardening · advanced · ~16 min
5. 05Zero-trust principles — the model that replaces the perimeterZero-trust · advanced · ~14 min
6. 06Zero-trust segmentation on OPNsense — turning the principles into rulesZero-trust · advanced · ~16 min

1. 01Admin remote access and the bastion pattern — keeping the keys off the perimeterRemote access and site-to-site architecture · advanced · ~14 min
2. 02User VPN architectures — split tunnel, full tunnel, always-on and the choices that matterRemote access and site-to-site architecture · advanced · ~15 min
3. 03Site-to-site VPN architecture — hub-and-spoke, full-mesh and the topology that fitsRemote access and site-to-site architecture · advanced · ~14 min
4. 04Multi-site fabric — combining VPN, dynamic routing and addressing into one networkRemote access and site-to-site architecture · advanced · ~15 min
5. 05Cloud connectivity from OPNsense — IPsec and WireGuard to AWS, Azure and GCPRemote access and site-to-site architecture · advanced · ~16 min
6. 06VPN fabric monitoring — knowing whether the tunnels are up, slow or silently brokenRemote access and site-to-site architecture · advanced · ~14 min

1. 01Throughput sizing — how much traffic the firewall can actually moveCapacity planning · advanced · ~14 min
2. 02State table sizing — how many flows the firewall can track before it breaksCapacity planning · intermediate · ~13 min
3. 03VPN throughput budget — accounting for the encryption cost in the firewall sizingCapacity planning · advanced · ~14 min
4. 04IDS/IPS throughput budget — what Suricata costs and how to budget for itCapacity planning · advanced · ~14 min
5. 05Log volume budget — planning disk, network and observability capacity for logsCapacity planning · intermediate · ~13 min
6. 06Growth planning and headroom — sizing the firewall for next year, not this weekCapacity planning · advanced · ~13 min

1. 01Reference architecture — Internet edgeReference architecture · advanced · ~18 min
2. 02Reference architecture — Multi-WAN, gateway groups, and policy routingReference architecture · advanced · ~16 min
3. 03Reference architecture — Segmentation and DMZReference architecture · advanced · ~16 min
4. 04Reference architecture — VPN and remote accessReference architecture · advanced · ~14 min
5. 05Reference architecture — Monitoring, logging, and backupReference architecture · advanced · ~14 min
6. 06Reference architecture — Operating the estateReference architecture · advanced · ~14 min

No lessons published in this part yet. The full curriculum is planned in docs/courses/opnsense/curriculum.md on GitHub.

No lessons published in this part yet. The full curriculum is planned in docs/courses/opnsense/curriculum.md on GitHub.

No lessons published in this part yet. The full curriculum is planned in docs/courses/opnsense/curriculum.md on GitHub.