Interface assignments and roles

Every OPNsense firewall has physical NICs (and VLANs and other sub-interfaces) and logical interfaces that the operator configures with addresses and rules. The mapping between the two is the assignment table, and getting it right is the foundation of every other configuration step. This lesson covers the assignment model, the WAN/LAN/OPT role convention, and the discipline of disabling interfaces that are not in use.

The three layers

OPNsense separates interface configuration into three layers:

1. Physical devices are the NICs the kernel sees — igb0, igb1, vtnet0, and so on. They are exposed by the FreeBSD driver and are listed under Interfaces → Assignments → Devices.
2. Logical interfaces are the named configuration objects the operator works with — WAN, LAN, OPT1, GUEST. Each has an IP address, a subnet mask, firewall rules, and services. They are listed under Interfaces → [name].
3. Assignments map a logical interface to a physical device (or VLAN, or bridge, or lagg). The assignment table is at Interfaces → Assignments.

A logical interface that is assigned to no physical device is unassigned; OPNsense will not configure an IP address on it and PF will not match rules against it. A physical device that has no assignment is unconfigured — the kernel has the device but the firewall treats it as inactive.

$ ifconfig -l

igb0 igb1 igb2 igb3 lo0 vtnet0 vtnet1

The WAN/LAN/OPT convention

OPNsense ships with two pre-named logical interfaces:

• WAN — the interface facing the upstream ISP. By convention the WAN interface has a default route pointing to the ISP gateway and applies NAT (outbound NAT to the WAN address). The default firewall rules on WAN block all inbound traffic unless explicitly permitted.
• LAN — the interface facing the trusted internal network. The default LAN rules permit all outbound traffic from the LAN subnet.

Additional interfaces are named OPT1, OPT2, OPT3, … by default. The operator should rename them to something meaningful: GUEST, SERVERS, DMZ, MGMT, IOT, WIRELESS. The name appears in every firewall rule and in every log line; OPT1 is a maintenance burden that future operators must decode.

$ pfctl -s labels

wan
lan
guest
servers
mgmt

Disabling unused interfaces

A physical NIC that is not in use — because the operator has fewer active networks than NICs — should be disabled, not left in default state. The default state allows some inbound traffic (depending on the implicit ruleset), and any service bound to “all interfaces” will listen on it.

Two ways to disable:

1. Do not assign the device. In Interfaces → Assignments, leave the device unassigned. The kernel has the device but no logical interface uses it. PF has no rules for it.
2. Mark the device disabled. In Interfaces → Assignments → Devices, mark the device as disabled. This prevents the kernel from bringing the interface up at boot.

The right answer is both: leave the device unassigned and mark it disabled. Belt and braces.

The assignment workflow

The standard workflow for a new firewall:

1. List the physical devices (ifconfig -l).
2. Document the intended assignment — which device is WAN, which is LAN, which are VLAN trunks, which are unused.
3. In Interfaces → Assignments, assign WAN to the device facing the ISP, LAN to the device facing the internal network, and OPT interfaces as needed.
4. For each assigned interface, configure the IP address and the type (static, DHCP, PPPoE, etc. — Lesson 39).
5. Disable every unused device (Interfaces → Assignments → Devices).
6. Verify with ifconfig and pfctl -s labels.

Renaming interfaces

OPNsense allows the operator to rename OPT interfaces to meaningful names. After rename, every rule reference, every log line, and every diagnostic command uses the new name. This is a low-risk change; the assignment itself does not change.

A naming convention that scales:

• By network role: WAN, LAN, GUEST, SERVERS, MGMT, IOT, DMZ.
• By location: WAN_PRIMARY, WAN_FAILOVER, LAN_FLOOR1, LAN_FLOOR2.
• By VLAN ID: LAN_VLAN10, LAN_VLAN20, LAN_VLAN30 — useful when the operator wants the VLAN to be obvious in every log line.

The convention matters less than the discipline. Pick one and document it in the firewall’s runbook.

The failure mode of misassignment

The single most common operator error at deployment time is swapping WAN and LAN: the NIC facing the ISP is configured as LAN, and the internal NIC is configured as WAN. The consequences are immediate and severe:

1. The firewall’s outbound NAT rules do not match (because the LAN subnet is not being NATted on the way out — outbound traffic has an internal source IP and the ISP drops it).
2. The “block all inbound on WAN” default rule is now on the internal interface, blocking legitimate internal traffic.
3. The DHCP server is now serving addresses on the WAN side, which the ISP almost certainly rejects.

The fix is to verify the assignment before applying the configuration. A test ping from the firewall’s diagnostic page (Interfaces → Diagnostics → Ping) to a known external IP confirms the assignment is correct.

Summary

• OPNsense separates physical devices, logical interfaces, and the assignment table between them.
• WAN/LAN/OPT are the default names; rename OPT interfaces to meaningful names (GUEST, SERVERS, MGMT, IOT, …).
• Disable unused interfaces — both unassign and mark disabled.
• A misassigned WAN/LAN is the most common deployment error; verify before going live.