Zero-trust segmentation on OPNsense — turning the principles into rules

Zero-trust is a model. The patterns that implement the model on OPNsense are the subject of this lesson: microsegmentation with VLANs, identity-based rules via authentication backends, session-based controls, east-west firewalling. The patterns turn principles into rules; the rules turn principles into evidence.

This lesson covers the patterns that turn zero-trust principles into operational rules on OPNsense, and the limits of what the firewall alone can enforce.

Microsegmentation

Microsegmentation is the discipline of breaking the network into small segments — one segment per service tier, per trust level, per data sensitivity. Each segment has its own ruleset; each segment has its own default-deny; traffic between segments is explicitly allowed, never implicit.

The microsegmentation on OPNsense uses VLANs. Each segment is a VLAN; each VLAN is an OPT interface on the firewall. The firewall becomes the single chokepoint for inter-segment traffic.

The pattern:

1. Identify the segments. Service tiers (web, application, database), trust levels (user, server, management), data sensitivity (public, internal, confidential).
2. Create VLANs. One VLAN per segment. Each VLAN is an OPT interface on the firewall.
3. Default-deny east-west. Each VLAN’s ruleset ends with a default-deny rule that blocks traffic to other VLANs. The rule prevents implicit inter-segment traffic.
4. Explicit allow rules. For each legitimate inter-segment flow, an explicit allow rule. The rule grants the minimum access needed for the flow.

The threats addressed: lateral movement (an attacker in one segment cannot reach other segments without explicit rules), insider threats (a compromised user account in one segment does not grant access to other segments), reconnaissance (an attacker cannot scan for services in other segments).

The evidence produced: the per-VLAN rulesets, the inter-VLAN flow inventory, the default-deny logs.

$ configctl filter show 2>/dev/null | grep -E '^@' | grep 'igb0_vlan' | head -10 && echo '---' && configctl filter show 2>/dev/null | grep -cE 'block.*igb0_vlan.*igb0_vlan'

@12 pass in quick on igb0_vlan10 inet proto tcp from 192.0.2.0/24 to 192.0.2.50 port = 5432
@13 pass in quick on igb0_vlan20 inet proto tcp from 192.0.2.30 to 192.0.2.50 port = 5432
@14 block in quick on igb0_vlan10 inet from any to <other_segments>
4

Identity-based rules

Identity-based rules match on user identity, not source IP. The pattern on OPNsense:

1. Authentication backend. OPNsense integrates with LDAP, RADIUS, or Active Directory. The backend resolves a username to a set of IP addresses (the user’s currently-authenticated devices).
2. Group alias. The firewall maps backend groups to aliases. The alias contains the IP addresses of devices currently authenticated as members of the group.
3. Identity-based rules. Rules that allow traffic from a group alias to a destination. The rule matches only traffic from devices currently authenticated as members of the group.

The pattern requires:

• The authentication backend is configured and reachable from the firewall.
• The user is authenticated to the backend (via 802.1X, captive portal, or VPN).
• The firewall queries the backend to resolve the group to IP addresses.
• The rules use the resolved alias.

The threats addressed: source-IP-based exploits (an attacker who steals an IP is not the user), credential theft (the attacker with the user’s password still needs the device posture), lateral movement (the attacker who compromises one user does not inherit the access of other users).

The evidence produced: the authentication logs, the group alias resolution logs, the audit trail of which users accessed which resources.

Session-based controls

Session-based controls re-validate trust at intervals. The pattern on OPNsense:

1. State timeouts. The firewall’s state-table timeouts are tuned to re-validate sessions at intervals. A long-lived TCP connection is re-checked against the rule set at the timeout.
2. Session re-authentication. For sensitive flows, the firewall can require re-authentication at intervals. The user is re-prompted for credentials; the rule continues to apply only if the re-authentication succeeds.
3. Idle timeout. Sessions that are idle for longer than the timeout are terminated. The user must re-authenticate to resume.

The session-based controls require session-tracking infrastructure on the firewall. OPNsense’s state table is the session tracker; the timeouts are the re-validation intervals.

The threats addressed: stolen sessions (an attacker who hijacks a session is re-validated at the timeout), long-lived compromised sessions (a session that becomes invalid is terminated at the timeout), credential rotation (a session that exceeds the credential lifetime is re-validated).

The evidence produced: the state-table timeouts, the re-authentication logs, the session termination logs.

East-west firewalling

East-west firewalling is the discipline of inspecting traffic between segments, not just at the perimeter. The pattern on OPNsense:

1. Per-VLAN rulesets. Each VLAN has its own ruleset. The ruleset applies to traffic entering the VLAN from any other VLAN (or from the firewall itself).
2. Default-deny east-west. Each VLAN’s ruleset ends with a default-deny rule that blocks traffic from other VLANs. The rule prevents implicit inter-segment traffic.
3. IDS/IPS for east-west. Suricata inspects east-west traffic. The IDS/IPS rules catch malicious payloads traversing between segments.

The east-west firewalling complements the microsegmentation. The microsegmentation defines the segments; the east-west firewalling inspects the traffic between them.

The threats addressed: lateral movement (an attacker in one segment is caught trying to reach another segment), command-and-control (a compromised host in one segment is caught reaching C2 infrastructure in another segment), data exfiltration (a compromised host trying to send data outside its segment is caught).

The evidence produced: the per-VLAN rulesets, the Suricata alerts on east-west traffic, the default-deny logs.

Limits of what the firewall alone can enforce

The firewall is one layer of zero-trust. The firewall enforces network-layer controls: source restrictions, destination restrictions, port restrictions, protocol restrictions. The firewall does not enforce:

1. Endpoint posture. The firewall does not know whether the device is patched, whether the disk is encrypted, whether the screen lock is enabled. Endpoint posture is enforced by the endpoint management system (MDM, Intune, Jamf, etc.).
2. Application-layer controls. The firewall does not know what application is sending the traffic, what data the application is accessing, whether the application is authorised for the user. Application-layer controls are enforced by the application itself or by an application-layer gateway.
3. Identity binding. The firewall can resolve a username to an IP address, but cannot verify that the user at the IP is actually the authenticated user. Identity binding is enforced by the authentication mechanism (802.1X, certificates, etc.) and by the endpoint.

The zero-trust deployment that relies solely on the firewall is incomplete. The deployment must include:

• Endpoint management. Devices are managed; posture is verified; non-compliant devices are denied access at the network layer (by the firewall consulting the endpoint management system) or at the application layer (by the application consulting the same).
• Identity provider. The authentication backend is a strong identity provider: multi-factor authentication, certificate-based authentication, or passkeys. The identity is not just a password.
• Application-layer controls. Applications enforce their own authorisation: per-resource access control, per-action permissions, audit logs.

The firewall is the network layer; the endpoint management, identity provider, and application-layer controls are the other layers. A zero-trust deployment addresses all four layers.

Summary

• Microsegmentation: per-service VLANs, default-deny east-west, explicit allow rules for each flow.
• Identity-based rules: authentication backend, group aliases, rules that match the resolved aliases.
• Session-based controls: state timeouts, re-authentication, idle timeouts.
• East-west firewalling: per-VLAN rulesets, default-deny, IDS/IPS for east-west traffic.
• The firewall is one layer. Zero-trust also requires endpoint management, strong identity provider, and application-layer controls.