OPNsense router setup
Step-by-step guide to configure OPNsense for the isolated LAN segment. Assumes OPNsense sits on your main private network with an upstream internet router, and a dedicated LAN port connects isolated VMs.
See also: topology, firewall rules, access & ports.
Prerequisites
- OPNsense installed (tested on 26.1.x)
- WAN connected to main private LAN (example:
172.22.0.127/24, gateway172.22.0.1) - LAN connected to isolated segment (example:
192.168.1.1/24) - At least one VM on the LAN with a static IP (example:
192.168.1.10)
1. Backup before changes
From OPNsense shell (console menu option 8) or via an existing admin session:
cp /conf/config.xml /conf/config.xml.pre-isolated-lan
You can also download a backup from System → Configuration → Backups.
2. Interface configuration
WAN (em0 / wan)
| Setting | Example value |
|---|---|
| IPv4 type | Static |
| Address | 172.22.0.127/24 |
| Gateway | 172.22.0.1 |
Interfaces → WAN: enable, block private networks off (WAN is itself on a private network in this topology).
LAN (em1 / lan)
| Setting | Example value |
|---|---|
| IPv4 type | Static |
| Address | 192.168.1.1/24 |
Interfaces → LAN: enable. DHCP is optional — isolated VMs should use static addresses so firewall rules stay stable.
3. DNS (Unbound on the router)
Isolated VMs must not use public DNS directly. The router is the only resolver they can reach.
- Services → Unbound DNS → General
- Enable Unbound
- Listen on LAN (and WAN if you prefer; LAN is sufficient)
-
Register DHCP leases: optional
-
Services → Unbound DNS → Query Forwarding (if needed)
-
Forward upstream to your preferred resolvers, or use root hints
-
Confirm Unbound listens on port 53:
sh
sockstat -l4 | grep :53
No change is required on Fedora if Unbound was already running — only firewall rules and VM DNS settings matter.
4. Firewall alias (private networks)
The “internet only” pass rule uses the existing Private_IPv4 alias (RFC1918 ranges). Confirm it exists:
Firewall → Aliases → Private_IPv4
Typical contents:
192.168.0.0/16172.16.0.0/1210.0.0.0/8
If missing, create it before adding isolation rules.
5. LAN firewall rules (per isolated host)
Rules go on Firewall → Rules → LAN, above the default “allow LAN to any” rule. Order matters.
For source 192.168.1.10/32 (replace with your VM IP), create:
| # | Action | Proto | Source | Destination | Port | Description |
|---|---|---|---|---|---|---|
| 1 | Pass | UDP | 192.168.1.10/32 |
192.168.1.1 |
53 | Isolated: allow DNS (UDP/53) |
| 2 | Pass | TCP | 192.168.1.10/32 |
192.168.1.1 |
53 | Isolated: allow DNS (TCP/53) |
| 3 | Block | UDP | 192.168.1.10/32 |
!192.168.1.1 |
53 | Isolated: block DNS except router (UDP) |
| 4 | Block | TCP | 192.168.1.10/32 |
!192.168.1.1 |
53 | Isolated: block DNS except router (TCP) |
| 5 | Pass | any | 192.168.1.10/32 |
!Private_IPv4 |
— | Isolated: allow internet only |
| 6 | Block | any | 192.168.1.10/32 |
any | — | Isolated: block all other |
Web UI tips
- Destination “invert” (
!): check “Invert match” when blocking DNS to everywhere except the router, and when allowing non-private destinations. - DNS block port: set port 53 inside the destination box, not as a separate broken “destination port” field that blocks all traffic. See firewall-rules.md.
Apply via automation (optional)
From a host that can SSH to OPNsense on the LAN (e.g. the first isolated VM), run the numbered scripts in scripts/opnsense/ in order (see README). Scripts currently target 192.168.1.10; edit the IP or use add-isolated-vm.md for additional hosts.
After any rule change: Apply changes on the firewall page, or run /usr/local/etc/rc.filter_configure on the router.
6. WAN NAT port forwards
Firewall → NAT → Port Forward
| External port | Protocol | Destination | Local port | Description |
|---|---|---|---|---|
| 22 | TCP | 192.168.1.10 |
22 | SSH to first isolated VM |
| 3389 | TCP | 192.168.1.10 |
3389 | RDP to first isolated VM |
| 2222 | TCP | 127.0.0.1 |
22 | OPNsense SSH (see step 7) |
Add a linked WAN pass rule for each forward if OPNsense does not create one automatically.
For a second VM, use different external ports (e.g. 2223 → VM2:22, 3390 → VM2:3389). Details in add-isolated-vm.md.
7. WAN admin (Web UI + SSH)
Goal: manage the router from the WAN IP (172.22.0.127), while isolated VMs on the LAN cannot open SSH or HTTPS to 192.168.1.1.
Web UI
- System → Settings → Administration
- Secure Shell Server: enable, listen interfaces = WAN only
-
Web GUI: HTTPS, listen interfaces = WAN only
-
Firewall → Rules → WAN
- Pass TCP 443 to This firewall (destination
(self))
SSH on port 2222
WAN port 22 is used for the first VM. Expose router SSH on 2222:
- NAT: WAN
2222→127.0.0.1:22(not192.168.1.1:22— sshd does not listen on LAN after WAN-only restriction) - WAN pass rule for TCP 2222 to
(self)if needed
Access: ssh -p 2222 root@172.22.0.127
Verify listen addresses
sockstat -l4 | grep -E ':443|:22'
Expected: HTTPS and SSH on the WAN address (172.22.0.127) and SSH on 127.0.0.1, not on 192.168.1.1.
8. Default LAN rule
Leave the bottom “Default allow LAN to any” rule in place for non-isolated hosts if you add more LAN clients later. Isolated VMs are matched by the specific rules above first.
9. Verification
From the isolated VM:
bash scripts/fedora/verify-connectivity.sh
From Windows (with config/env.local):
.\scripts\windows\Verify-Connectivity.ps1
Expected: internet and DNS via 192.168.1.1 work; main LAN (172.22.0.x) and direct DNS (8.8.8.8) fail; SSH/HTTPS to 192.168.1.1 time out.
Full matrix: verification.md.
10. Rollback
cp /conf/config.xml.pre-isolated-lan /conf/config.xml
/usr/local/etc/rc.filter_configure
configctl webgui restart
/etc/rc.d/sshd onerestart
Quick reference — current lab values
| Item | Value |
|---|---|
| OPNsense WAN | 172.22.0.127 |
| OPNsense LAN | 192.168.1.1 |
| First VM | 192.168.1.10 |
| Upstream router | 172.22.0.1 |
| WAN SSH (router) | port 2222 |
| WAN SSH (VM) | port 22 |
| WAN RDP (VM) | port 3389 |