OPNsense · Operational reference
Toolkit
Operational artefacts for OPNsense: checklists for cadences, runbooks for incidents, hands-on labs for skills, and break/fix scenarios for troubleshooting reflexes. None of this replaces reading the corresponding lessons — these are the artefacts you keep open in a second tab during real work.
- Runbooks
- 30
- Checklists
- 15
- Labs
- 21
- Break/Fix
- 20
- Assessments
- 1
Operational checklists
Repetitive tasks performed on a schedule.
Before deployment
Runbooks
Step-by-step procedures. Treat the rollback as part of the procedure — never skip it.
Critical risk
- criticalcluster affectingRunbook: Recover a Failed Appliance~120 min · 8 steps · verified 2026-08-15→
- criticalcluster affectingRunbook: Respond to Compromised Credentials~90 min · 10 steps · verified 2026-08-15→
- criticalcluster affectingRunbook: Respond to Lockout~45 min · 9 steps · verified 2026-08-15→
- criticalcluster affectingRunbook: Restore Firewall Configuration~60 min · 9 steps · verified 2026-08-15→
High risk
- highcluster affectingRunbook: Build an HA Pair~120 min · 12 steps · verified 2026-08-15→
- highservice affectingRunbook: Configure an IPsec Site-to-Site Tunnel~60 min · 11 steps · verified 2026-08-15→
- highservice affectingRunbook: Configure Multi-WAN~90 min · 16 steps · verified 2026-08-14→
- highservice affectingRunbook: Configure WireGuard~90 min · 21 steps · verified 2026-08-14→
- highcluster affectingRunbook: Roll Back a Bad Change~30 min · 8 steps · verified 2026-08-15→
- highcluster affectingRunbook: Upgrade an HA Pair~120 min · 11 steps · verified 2026-08-15→
Medium risk
- mediumservice affectingRunbook: Add an Interface~45 min · 10 steps · verified 2026-08-14→
- mediumservice affectingRunbook: Add a VLAN~45 min · 16 steps · verified 2026-08-14→
- mediumservice affectingRunbook: Deploy a New OPNsense Firewall~90 min · 12 steps · verified 2026-08-14→
- mediumservice affectingRunbook: Investigate State Table Exhaustion~45 min · 10 steps · verified 2026-08-15→
- mediumcluster affectingRunbook: Perform HA Maintenance~90 min · 8 steps · verified 2026-08-15→
- mediumservice affectingRunbook: Rotate Certificates~60 min · 8 steps · verified 2026-08-15→
- mediumcluster affectingRunbook: Troubleshoot CARP~45 min · 13 steps · verified 2026-08-15→
- mediumservice affectingRunbook: Troubleshoot IPsec~60 min · 10 steps · verified 2026-08-15→
- mediumcluster affectingRunbook: Troubleshoot pfsync~45 min · 9 steps · verified 2026-08-15→
- mediumservice affectingRunbook: Troubleshoot WireGuard~45 min · 9 steps · verified 2026-08-15→
Low risk
- lowinformationalRunbook: Backup Firewall Configuration~20 min · 8 steps · verified 2026-08-15→
- lowservice affectingRunbook: Create a Firewall Rule~30 min · 13 steps · verified 2026-08-14→
- lowinformationalRunbook: Investigate CPU Saturation~45 min · 10 steps · verified 2026-08-15→
- lowinformationalRunbook: Investigate an IDS Block~30 min · 9 steps · verified 2026-08-15→
- lowinformationalRunbook: Packet Capture Investigation~30 min · 10 steps · verified 2026-08-15→
- lowinformationalRunbook: Troubleshoot Blocked Traffic~30 min · 11 steps · verified 2026-08-14→
- lowinformationalRunbook: Troubleshoot Outbound NAT~30 min · 10 steps · verified 2026-08-14→
- lowinformationalRunbook: Troubleshoot Port Forwarding~45 min · 11 steps · verified 2026-08-14→
- lowinformationalRunbook: Troubleshoot VLAN Connectivity~30 min · 12 steps · verified 2026-08-14→
- lowinformationalRunbook: Troubleshoot WAN Failover~45 min · 13 steps · verified 2026-08-14→
Hands-on labs
Time-boxed exercises.
B · Nested virtualisation
- Lab: Push an OPNsense configuration with Ansible~90 min · 6 objectives→
- Lab: Create an alias via the OPNsense API, safely~75 min · 5 objectives→
- Lab: Configure OPNsense backup and restore to a disposable VM~90 min · 5 objectives→
- Lab: Build a baseline LAN/WAN firewall ruleset~60 min · 4 objectives→
- Lab: Configure a DHCPv4 scope and a DHCP relay across VLANs~60 min · 5 objectives→
- Lab: Build a DMZ and configure port forwarding~75 min · 5 objectives→
- Lab: Build an OPNsense HA pair with CARP and pfsync~120 min · 6 objectives→
- Lab: Rolling upgrade of an OPNsense HA pair~90 min · 6 objectives→
- Lab: Hairpin NAT vs split-horizon DNS — measure both, pick one~60 min · 5 objectives→
- Lab: Install OPNsense and walk the initial wizard~60 min · 4 objectives→
- Lab: Build an IPsec site-to-site tunnel between two OPNsense routers~120 min · 5 objectives→
- Lab: Multi-WAN with gateway groups and failover validation~90 min · 6 objectives→
- Lab: Configure outbound NAT and a port forward, end-to-end~60 min · 5 objectives→
- Lab: Capture packets on OPNsense and troubleshoot a broken connection~75 min · 5 objectives→
- Lab: Audit the ruleset — find shadowed, redundant, and dead rules~60 min · 6 objectives→
- Lab: Inspect, kill, and expire PF state~45 min · 5 objectives→
- Lab: Install Suricata in IDS mode and validate an alert~90 min · 5 objectives→
- Lab: Configure OPNsense Unbound as a validating recursive resolver~60 min · 5 objectives→
- Lab: VLAN segmentation and inter-VLAN firewalling~75 min · 5 objectives→
- Lab: Build a WireGuard remote-access tunnel on OPNsense~90 min · 6 objectives→
- Lab: WireGuard site-to-site tunnel between two OPNsense firewalls~90 min · 6 objectives→
Break/Fix scenarios
Troubleshooting drills. Each scenario gives symptoms and evidence, then hides the solution behind a reveal.
ha
certificate-expiry
performance
security
network
- intermediateBreak/Fix: Interface Packet Loss From Driver or Duplex Mismatch~25 min · 3 symptoms→
- advancedBreak/Fix: IPsec Tunnel Will Not Establish~35 min · 3 symptoms→
- intermediateBreak/Fix: A new VLAN gets an address and resolves DNS but cannot reach the internet~30 min · 6 symptoms→
- advancedBreak/Fix: Multi-WAN failover does not occur when one WAN goes down~35 min · 4 symptoms→
- intermediateBreak/Fix: VPN Tunnel Up But DNS Resolution Fails~25 min · 3 symptoms→
- intermediateBreak/Fix: WireGuard Tunnel Up But No Traffic Flows~25 min · 3 symptoms→
Assessments
Production-readiness examinations. Each combines auto-scored questions with scenario-based rubrics you can use to grade yourself.