The initial wizard — hostname, interfaces, WAN, LAN, admin password

The OPNsense initial wizard is the first interaction the operator has with a freshly-installed firewall. The wizard asks the questions every operator answers on every install: hostname, domain, upstream DNS, NTP, WAN type, LAN configuration, and the admin password. The right answers for production are not always the wizard’s defaults; an operator who clicks through without thinking ends up with a firewall that works but is misconfigured for the environment it is supposed to protect.

This lesson walks through each step of the wizard in order, with the production answer and the reasoning behind it.

Step 1: Hostname and domain

The wizard’s first step asks for the hostname and the domain.

Hostname:    fw-edge-01
Domain:      example.com

Hostname. Pick a name that identifies the firewall’s role and location. fw-edge-01 says “firewall, edge, first of several”. fw-dc-primary says “firewall, datacentre, primary”. The hostname appears in syslog, monitoring, and the certificate common name — pick deliberately.

Domain. The DNS domain the firewall belongs to. For an internal firewall, this is the internal domain (corp.example.com). For an ISP edge, the operator uses the registered domain. The domain is appended to unqualified hostnames throughout the firewall’s logs and tools; pick the right one.

Anti-pattern. Default values opnsense and localdomain. They work for a single-firewall home network; they fail miserably in production where multiple firewalls need distinguishable names and where the domain matters for certificate generation.

$ configctl system hostname show

Hostname: fw-edge-01
Domain:   example.com
FQDN:     fw-edge-01.example.com

Step 2: DNS servers

The wizard asks for upstream DNS resolvers. The production answer is not “8.8.8.8” — it is “the resolver your operations team controls”.

Three options:

1. Public resolvers (8.8.8.8, 1.1.1.1). Reliable and well-maintained. The cost: every DNS query from the firewall (NTP pool resolution, plugin update checks, syslog destination lookups) leaks metadata to a third party.
2. ISP resolvers. Stable but tied to the ISP. A failover to a backup ISP that does not have the same resolvers requires reconfiguration.
3. Internal resolvers. The cleanest answer when one exists. The operator’s internal Unbound or BIND server receives the query, validates DNSSEC, applies split-horizon overrides, and recurses only for what the firewall genuinely needs.

The wizard accepts up to four DNS servers. The operator fills the slots with resolvers that are reachable on the WAN link, fall back gracefully, and do not all share a single failure mode.

Step 3: Time zone and NTP

The wizard asks for the time zone and the NTP server(s).

Time zone. Pick the operational time zone, not the local one. A firewall in a London datacentre serving European users uses Europe/London. Logs, scheduled tasks, certificate expiry all align with this.

NTP servers. The wizard’s default is 0.opnsense.pool.ntp.org. That points at the NTP pool — a reliable, distributed NTP service. The production answer:

• Two or three NTP servers, ideally from different sources (pool + ISP + internal).
• An internal NTP server (a chrony instance or a hardware appliance) is the cleanest answer when the network has one.
• The NTP traffic goes over UDP port 123; the operator verifies that the firewall’s outbound rules allow it.

$ ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
+ntp1.example.c .PPS.            1 u  64  64  377   0.523  -0.041   0.184
*ntp2.example.c .PPS.            1 u  66  64  377   0.612   0.012   0.197
+time.cloudflare 10.15.16.1      2 u  12  64  377    8.241   0.523   1.045

A firewall with the wrong time is a firewall with broken certificates (they appear expired or not-yet-valid), broken logs (timestamps are wrong), broken HA (CARP skew is in seconds), and broken IDS (Suricata timestamps are wrong). The wizard step is one minute of work that prevents hours of debugging.

Step 4: WAN interface and type

The wizard asks which physical interface is the WAN and what type of addressing it uses.

Interface choice. Pick the interface that physically connects to the upstream network. On a fresh install with no labels, the operator checks the MAC addresses (the wizard prints them) against the physical NICs. The lesson on hardware install covers the labelling discipline.

Addressing type.

• DHCP. The upstream is a cable modem, a basic ISP, or a router that hands out DHCP. The firewall accepts the configuration automatically. The lease is logged and the firewall renews it.
• Static. The upstream gives the operator a fixed IP, mask, and gateway. The operator enters them. Static WANs are common for business circuits (fibre, leased line, dedicated Internet).
• PPPoE. Some ISPs use PPPoE over Ethernet. The wizard asks for the PPPoE username and password. PPPoE links typically have shorter MTUs and need MSS clamping.
• None / DHCP on WAN disabled. A transparent firewall or a routed bridge does not need a WAN address. Pick “None” and configure the interfaces later.

Step 5: LAN interface and addressing

The wizard asks which interface is the LAN and what subnet it uses.

Interface choice. The interface that physically connects to the internal network. The operator picks a different interface from the WAN; if WAN is igb0, LAN is igb1 or igb2.

Addressing. RFC 1918 private space is the right answer for an internal LAN:

• 10.0.0.0/8 — 16M addresses, the most flexible. Common in larger networks.
• 172.16.0.0/12 — 1M addresses. Common in mid-sized networks.
• 192.168.0.0/16 — 65k addresses. Common in small networks but exhausted quickly.

The wizard’s default 192.168.1.1/24 is fine for a home network. For a production network, the operator picks a subnet that is consistent with the rest of the estate and large enough for the devices it serves. The course’s addressing lesson covers the choice in detail.

$ ifconfig igb1

igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
      options=82018<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU>
      ether 00:50:56:00:00:02
      inet 10.20.0.1 netmask 0xffffff00 broadcast 10.20.0.255
      inet6 fe80::250:56ff:fe00:2%igb1 prefixlen 64 scopeid 0x2
      nd6 options=21<PERFORMNUD,ACCEPT_RTADV>

Step 6: Admin password

The wizard’s final step sets the password for the root user. The production answer is not the wizard’s “no password” default.

The right password:

• 16+ characters.
• Not based on a dictionary word.
• Unique to this firewall.
• Stored in the team’s password manager.
• Tracked in the audit log when changed.

The operator also enables MFA at this point if the OPNsense TOTP plugin is installed. The course’s authentication lessons cover the MFA setup.

After the wizard

Once the wizard completes, the firewall reboots (or just applies the configuration, depending on the version) and the operator has a working appliance with default-deny rules. The operator’s next steps:

1. Verify connectivity. From a host on the LAN, ping the firewall’s LAN IP and a known external address. Verify that the WAN IP is what the operator expects (DHCP lease or static configuration).
2. Enable management access from the management network. The default LAN rule allows LAN to any; the operator replaces this with a rule that allows the management network only, and the management network’s gateway is on the LAN. The course’s management network lesson covers this.
3. Back up the configuration. System → Configuration → Backups → Download saves the full config. The backup is the recovery artefact.
4. Add the firewall to monitoring. The monitoring system polls the firewall’s SNMP / API for health metrics.

Summary

• The wizard’s six steps are deliberate. Each one sets a production value the operator should not leave at the default.
• Hostname and domain: pick deliberately; they propagate to certificates and logs.
• DNS: redundant upstream resolvers; never a single one.
• NTP: redundant NTP sources; clock drift breaks everything.
• WAN: pick the right interface and the right addressing type; PPPoE needs MSS clamping.
• LAN: pick an RFC 1918 subnet that fits the network.
• Admin password: 16+ characters, in a password manager, never the wizard’s default.