Wireless, loopback, and GIF tunnel interfaces

Beyond the standard physical and VLAN interfaces, OPNsense supports three specialised interface types that show up in specific deployments: wireless (turning the firewall into an 802.11 access point), loopback (virtual interfaces for management and services), and GIF tunnels (lightweight IP-in-IP tunnels for IPv6 transition and similar cases). This lesson covers what each does, when to use them, and the failure modes that surface in production.

Wireless interfaces

OPNsense can run as a wireless access point using hostapd (the host access point daemon). The firewall’s wireless NIC runs in master mode, broadcasting an SSID and accepting associations from clients. The firewall then bridges the wireless traffic to a wired interface (or routes it, depending on configuration).

This is a niche use case. Most production wireless is handled by dedicated access points (UniFi, Aruba, Cisco Meraki) or wireless routers, not by the firewall itself. But for small deployments, homelabs, or when the operator wants tight integration between firewall policy and wireless, hostapd on OPNsense is viable.

The configuration takes:

• Wireless interface: the physical NIC (e.g. run0 for a Ralink-based card, iwn0 for Intel).
• Mode: Access Point (hostapd master mode).
• SSID: the network name broadcast.
• Security: WPA2-PSK (CCMP) or WPA3-SAE.
• Channel: 2.4 GHz or 5 GHz; channel selection matters for performance.

The wireless interface is then assigned and configured like any other OPNsense interface. Firewall rules apply to wireless clients the same way they apply to wired clients.

Loopback interfaces

A loopback interface is a virtual interface with no physical NIC. The kernel routes traffic destined for the loopback address (127.0.0.1 / ::1) directly back to itself. Loopback is used for:

• Services that bind only to localhost (e.g. Unbound on 127.0.0.1 for local queries).
• Management IPs that should always be reachable regardless of physical interface state.
• IP aliases that are not tied to a specific physical interface.

OPNsense exposes additional loopback interfaces under Interfaces → Assignments → Loopback. The operator creates a loopback interface (e.g. lo1), assigns an IP address (e.g. 10.0.0.1/32), and uses it for management or services that should be reachable regardless of the state of the physical interfaces.

A common production pattern: the operator assigns a loopback address for the firewall’s management (e.g. 10.0.0.1/32) and ensures the management network has a route to that address. The firewall can be reached for management via the loopback even if a physical interface is down — the loopback is always up.

$ ifconfig lo1

lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
  options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
  ether 00:00:00:00:00:00
  inet 10.0.0.1 netmask 0xffffffff
  inet6 fe80::1%lo1 prefixlen 64 scopeid 0x5
  nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
  groups: lo

GIF tunnels

A GIF (Generic Interface) tunnel is a lightweight IP-in-IP tunnel. The firewall encapsulates one IP protocol inside another:

• IPv6-in-IPv4: an IPv6 packet inside an IPv4 packet. Used for IPv6 transition (when the upstream network is IPv4-only).
• IPv4-in-IPv6: an IPv4 packet inside an IPv6 packet. Used in reverse-transition scenarios.
• IPv4-in-IPv4: rarely used (similar to GRE).

GIF tunnels are stateless — the firewall does not run any tunneling protocol, it simply encapsulates one IP header in another. The remote end of the tunnel decapsulates.

OPNsense exposes GIF tunnels under Interfaces → Assignments → GIF. The operator configures:

• Outer (parent) interface: the physical interface carrying the encapsulated traffic (typically WAN).
• Outer source address: the firewall’s address on the outer interface.
• Outer destination address: the remote tunnel endpoint.
• Inner addresses: the firewall’s tunnel address and the remote endpoint’s tunnel address (the “inside” the tunnel).

The tunnel appears as a virtual interface (e.g. gif0) and can be assigned and configured like any other interface.

When to use each

For most production deployments, loopback is the most common of the three. Wireless is rare; GIF is mostly seen in IPv6 transition scenarios with specific ISPs or partner networks.

$ ifconfig gif0

gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1280
  options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
  tunnel inet 198.51.100.1 --> 203.0.113.1
  inet 192.0.2.50 --> 192.0.2.51 netmask 0xffffff00
  inet6 2001:db8::50 --> 2001:db8::51 prefixlen 64
  groups: gif

Common pitfalls

Three pitfalls appear repeatedly:

1. MTU on GIF tunnels. A GIF tunnel adds 20 bytes of IPv4 header overhead. If the underlying path has MTU 1500, the inner packet must fit in 1480 bytes. Path MTU discovery usually handles this, but with firewalls that drop ICMPv6 “packet too big” messages, the tunnel can hang at MTU 1280. Fix: configure the tunnel MTU explicitly to 1280 (or lower) to avoid fragmentation.

2. Firewall rules on the tunnel interface. GIF traffic arrives encapsulated in IPv4; PF sees the outer IPv4 header and matches rules based on that. The operator must allow the outer traffic (typically from the remote endpoint IP) on the parent interface, separately from any rules on the tunnel interface.

3. Loopback addresses leaking into routing protocols. A loopback address (e.g. 10.0.0.1/32) is a host route. If dynamic routing protocols (FRR / OSPF / BGP) are running, the operator must explicitly decide whether to advertise the loopback. Misconfiguration can leak internal addresses to neighbours.

Production patterns

Three patterns cover most cases:

1. Loopback for management: assign a loopback interface with a stable management IP; reach the firewall for management via the loopback even when physical interfaces are down.

2. GIF for IPv6 transition with ISP: configure a GIF tunnel from the firewall’s IPv4 WAN to the ISP’s IPv6 transition gateway; route the delegated IPv6 prefix via the GIF.

3. GIF inside IPsec for double encapsulation: rare; used when the path requires both transition (IPv6 over IPv4) and encryption.

Summary

• Wireless interfaces (hostapd) let OPNsense act as an access point; NIC support is uneven — verify chipset.
• Loopback interfaces (lo1, lo2) provide always-up virtual interfaces for management and services.
• GIF tunnels are stateless IP-in-IP encapsulation; use for IPv6 transition, not for security.
• GIF MTU must account for encapsulation overhead; tunnel interfaces often need MTU 1280 to avoid fragmentation.