Physical install on a dedicated appliance — BIOS, IPMI, console · OPNsense

A physical OPNsense appliance has three access paths the operator configures during install: the BIOS, the IPMI / BMC out-of-band controller, and the serial console. Each is a break-glass path when the others fail. An operator who skips the BIOS setup, leaves IPMI on factory defaults, or forgets the console cable ends up locked out of a production firewall at the worst possible moment.

This lesson covers the BIOS settings that matter, the IPMI configuration for out-of-band management with secure defaults, and the serial console as a last-resort access path.

BIOS settings that matter for a firewall

The BIOS is the first piece of firmware the firewall boots. The operator sets it once during provisioning and rarely touches it again, but the settings have to be right. Five settings deserve explicit attention.

Boot order. The appliance should boot from the install medium (USB key) during the install, then from the local disk (SSD, NVMe) after. The operator sets the boot order to USB first during install, then changes it to local disk first after. Some appliances have a “boot once” option that does this without modifying the default order.
Virtualisation enable. If the operator plans to run the firewall as a VM on this hardware later (uncommon but possible), the VT-x / AMD-V and VT-d / AMD-Vi settings must be enabled. For a dedicated firewall running OPNsense directly, these can be left at the BIOS default.
Power restore behaviour. Set to “Power On” so the appliance boots after a power outage. “Last State” is acceptable; “Off” leaves the appliance down after every power event.
Wake-on-LAN. Disable unless the operator uses it intentionally. WoL is a useful break-glass tool, but a misconfigured WoL can wake a firewall at 03:00 during an unrelated event.
Secure Boot. Disable. OPNsense’s bootloader is not Secure Boot-signed; the firewall will fail to boot with Secure Boot enabled. (The HardenedBSD team has discussed signing the bootloader; the current OPNsense releases do not.)

Read-only / Safedmidecode -t bios— dmidecode reads the SMBIOS table and reports BIOS vendor and version. Knowing the BIOS version is essential for firmware update decisions; the operator cross-references with the vendor's firmware update advisories. Note that dmidecode runs on the running OPNsense host, so this command works after install — for pre-install checks, use the vendor's IPMI web UI.

$ dmidecode -t bios | grep -E 'Vendor|Version|Release'

Vendor: American Megatrends Inc.
Version: 2.18.0
Release Date: 04/12/2025
Address: 0xF0000
Runtime Size: 128 kB

Illustrative output

IPMI / BMC: out-of-band management

IPMI (Intelligent Platform Management Interface) is a standard for the baseboard management controller (BMC) that lives on a separate processor on the appliance motherboard. The BMC has its own power, its own network interface (often the first or last NIC, or a dedicated mgmt port), and its own firmware. It runs regardless of whether the host CPU is up.

The BMC exposes:

Web UI. A separate web interface for monitoring and control. The default URL is https://<bmc-ip>/. Default credentials are vendor-specific and must be changed.
Serial-over-LAN (SOL). A virtual serial console that tunnels the host’s serial console over the BMC network. The operator can reach the firewall’s boot menu and shell as if a physical serial cable were attached.
Power control. Power on, power off, power cycle, and graceful shutdown. The operator can recover from a hung firewall without physical access.
Sensor readings. Temperatures, voltages, fan speeds, power consumption. Useful for monitoring and alerting.

The operator configures the BMC before deploying the firewall. The configuration lives on the BMC, not on OPNsense, so it is independent of the firewall’s state.

IPMI security checklist

The default IPMI configuration is unsafe on the public Internet. The operator’s checklist before the BMC touches a network:

Change the default password. Every BMC ships with a vendor-specific default (ADMIN/ADMIN, root/calvin, etc.). It is in every BMC exploit database. The first configuration step is to set a strong, unique password.
Set a static IP on the management network. The BMC should be on the dedicated management VLAN, with a static IP from that VLAN. DHCP is acceptable for discovery but operationally fragile.
Restrict network access. The BMC should be reachable only from the management network. The operator configures the BMC’s firewall (most BMCs have one) or the upstream switch to drop traffic from outside the management VLAN.
Enable HTTPS only. Disable HTTP and the IPMI v1.5 protocol (the v2.0 / RMCP+ protocol is encrypted). Disable any vendor-specific services that are not needed.
Update BMC firmware. BMCs have their own firmware vulnerabilities. The operator checks the vendor’s security advisories and updates before deployment.

Read-only / Safeipmitool chassis status— ipmitool -I lanplus uses the encrypted RMCP+ protocol to talk to the BMC. chassis status reports the chassis state, power restore policy and intrusion sensors. Power Restore Policy: always_on means the appliance will boot after a power outage — the right setting for a firewall. Chassis Intrusion: inactive means nobody has opened the case since the last reset.

$ ipmitool -I lanplus -H 10.0.99.10 -U admin -P REDACTED chassis status

System Power         : on
Power Overload       : false
Power Interlock      : false
Main Power Fault     : false
Power Control Fault  : false
Power Restore Policy : always_on
Last Power Event     : ac-fail
Chassis Intrusion    : inactive
Front Panel Lockout  : inactive
Drive Bay Lockout    : inactive
Power-on Password    : disabled

Illustrative output

Serial console: the break-glass path

The serial console is a physical or virtual serial port that gives the operator direct access to the boot loader, the kernel messages, and a FreeBSD shell. On a physical appliance, the serial port is either:

A physical DB9 or RJ45 port on the appliance, connected to a laptop with a serial cable (USB-to-serial adapters are cheap and reliable).
A virtual serial port exposed by the BMC as Serial-over- LAN (SOL), reached from the BMC web UI or from ipmitool -I lanplus sol activate.

Either way, the operator reaches the same FreeBSD console. OPNsense boots and shows its menu on the serial console by default; the operator can interrupt the boot loader, select a different boot environment, drop to single-user mode, or reset the root password.

The course’s lockout-prevention lesson covers single-user mode and root-password reset in detail. For the install path, the operator needs the serial console to:

Watch the boot process and confirm the kernel detects all NICs.
Configure interface assignments from the console menu when no keyboard/monitor is attached.
Reach the bootloader to select an alternate boot environment after a failed upgrade.

Connecting to the serial console

Read-only / Safecu -l— cu -l /dev/cuau0 -s 115200 opens a serial connection to the first FreeBSD serial port at 115200 baud. The default speed for OPNsense serial console is 115200 8N1. The boot loader prints its banner, the kernel detects devices, and OPNsense shows its menu. ^C exits cu; ~. drops the connection. On Linux, the equivalent is minicom or screen /dev/ttyUSB0 115200.

$ cu -l /dev/cuau0 -s 115200

Connected.
[FreeBSD loader]
>> FreeBSD/x86 boot block
 Start @ 0x...
 Boot loader: /boot/loader

Console: serial port
BIOS drive: 0
Booting from disk...
OK
OPNsense 25.7.4 ...

Illustrative output

The operator tests the serial console during provisioning. Serial console problems that surface after deployment (wrong baud rate, wrong cable, BMC SOL not enabled) are much harder to diagnose than serial problems found during install.

The provisioning checklist

The operator’s full checklist before the firewall goes live:

BIOS configured. Boot order, power restore, virtualisation settings, WoL, Secure Boot disabled. Document the BIOS version.
BMC firmware updated and configured. Latest vendor firmware; default password changed; static IP on management VLAN; HTTPS only; access restricted. Test that SOL works.
Serial console tested. Cable, baud rate, BMC SOL — all verified to give a console prompt during install.
Physical NIC inventory. Document which physical NIC maps to which label on the chassis, which driver FreeBSD attaches, and which MAC address each NIC reports. This document saves hours during interface assignment.
Cable plan. WAN, LAN, DMZ, management — every cable labelled and documented. A firewall that is mis-cabled at install time is mis-cabled until the operator notices in production, which is much later than the operator would prefer.

How the BMC and the host interact

The BMC is an independent computer on the appliance motherboard. It has its own CPU, its own RAM, its own network interface, and its own firmware. The BMC and the host communicate over a shared bus (usually a serial link between the BMC and the host’s southbridge). The BMC can:

Power the host on and off.
Read the host’s serial console over the shared bus (this is how SOL works).
Write to the host’s firmware (BMC-mediated firmware updates work even when the host is off).
Read sensors on the motherboard (temperature, voltage, fan speed) regardless of host state.

The BMC does not need the host to be running. A firewall that is hung, kernel-panicked, or unbootable is still reachable through the BMC — which is why the BMC is the most important piece of break-glass infrastructure on a physical firewall.

The security implication: anyone who can reach the BMC has effectively physical access to the host. The BMC is on the management VLAN and behind a strong password because anything less compromises the host.

Common install-day mistakes

Three mistakes the course has seen repeatedly:

Leaving IPMI on the default password. CVE databases are full of exploits that work against default credentials. The fix: change the password before the BMC touches a network.
Forgetting to test the serial console. The operator installs via a KVM-over-IP session through the BMC, then leaves without testing the serial console. Months later, the BMC is unreachable (firmware bug, network misconfiguration), and the serial console has a wrong baud rate or wrong cable. The fix: test the serial console during provisioning.
Mis-cabling the management interface. The operator assigns the wrong NIC to the management VLAN. The firewall comes up, the management interface is unreachable, and the operator has to attach a console to fix it. The fix: label every cable, document the plan, and verify the management interface is reachable before leaving the rack.

Summary

BIOS settings: boot order, virtualisation, power restore, WoL, Secure Boot. Configure during install, document.
IPMI / BMC: out-of-band management. Change the default password, put on the management VLAN, restrict access, enable HTTPS only, update firmware.
Serial console: the break-glass path. Test during provisioning. Know the baud rate (115200).
The provisioning checklist: BIOS, BMC, serial, NIC inventory, cable plan. Verify each before leaving the rack.