Skip to content

OPNsense router setup

Step-by-step guide to configure OPNsense for the isolated LAN segment. Assumes OPNsense sits on your main private network with an upstream internet router, and a dedicated LAN port connects isolated VMs.

See also: topology, firewall rules, access & ports.

Prerequisites

  • OPNsense installed (tested on 26.1.x)
  • WAN connected to main private LAN (example: 172.22.0.127/24, gateway 172.22.0.1)
  • LAN connected to isolated segment (example: 192.168.1.1/24)
  • At least one VM on the LAN with a static IP (example: 192.168.1.10)

1. Backup before changes

From OPNsense shell (console menu option 8) or via an existing admin session:

cp /conf/config.xml /conf/config.xml.pre-isolated-lan

You can also download a backup from System → Configuration → Backups.

2. Interface configuration

WAN (em0 / wan)

Setting Example value
IPv4 type Static
Address 172.22.0.127/24
Gateway 172.22.0.1

Interfaces → WAN: enable, block private networks off (WAN is itself on a private network in this topology).

LAN (em1 / lan)

Setting Example value
IPv4 type Static
Address 192.168.1.1/24

Interfaces → LAN: enable. DHCP is optional — isolated VMs should use static addresses so firewall rules stay stable.

3. DNS (Unbound on the router)

Isolated VMs must not use public DNS directly. The router is the only resolver they can reach.

  1. Services → Unbound DNS → General
  2. Enable Unbound
  3. Listen on LAN (and WAN if you prefer; LAN is sufficient)
  4. Register DHCP leases: optional

  5. Services → Unbound DNS → Query Forwarding (if needed)

  6. Forward upstream to your preferred resolvers, or use root hints

  7. Confirm Unbound listens on port 53:

sh sockstat -l4 | grep :53

No change is required on Fedora if Unbound was already running — only firewall rules and VM DNS settings matter.

4. Firewall alias (private networks)

The “internet only” pass rule uses the existing Private_IPv4 alias (RFC1918 ranges). Confirm it exists:

Firewall → Aliases → Private_IPv4

Typical contents:

  • 192.168.0.0/16
  • 172.16.0.0/12
  • 10.0.0.0/8

If missing, create it before adding isolation rules.

5. LAN firewall rules (per isolated host)

Rules go on Firewall → Rules → LAN, above the default “allow LAN to any” rule. Order matters.

For source 192.168.1.10/32 (replace with your VM IP), create:

# Action Proto Source Destination Port Description
1 Pass UDP 192.168.1.10/32 192.168.1.1 53 Isolated: allow DNS (UDP/53)
2 Pass TCP 192.168.1.10/32 192.168.1.1 53 Isolated: allow DNS (TCP/53)
3 Block UDP 192.168.1.10/32 !192.168.1.1 53 Isolated: block DNS except router (UDP)
4 Block TCP 192.168.1.10/32 !192.168.1.1 53 Isolated: block DNS except router (TCP)
5 Pass any 192.168.1.10/32 !Private_IPv4 Isolated: allow internet only
6 Block any 192.168.1.10/32 any Isolated: block all other

Web UI tips

  • Destination “invert” (!): check “Invert match” when blocking DNS to everywhere except the router, and when allowing non-private destinations.
  • DNS block port: set port 53 inside the destination box, not as a separate broken “destination port” field that blocks all traffic. See firewall-rules.md.

Apply via automation (optional)

From a host that can SSH to OPNsense on the LAN (e.g. the first isolated VM), run the numbered scripts in scripts/opnsense/ in order (see README). Scripts currently target 192.168.1.10; edit the IP or use add-isolated-vm.md for additional hosts.

After any rule change: Apply changes on the firewall page, or run /usr/local/etc/rc.filter_configure on the router.

6. WAN NAT port forwards

Firewall → NAT → Port Forward

External port Protocol Destination Local port Description
22 TCP 192.168.1.10 22 SSH to first isolated VM
3389 TCP 192.168.1.10 3389 RDP to first isolated VM
2222 TCP 127.0.0.1 22 OPNsense SSH (see step 7)

Add a linked WAN pass rule for each forward if OPNsense does not create one automatically.

For a second VM, use different external ports (e.g. 2223 → VM2:22, 3390 → VM2:3389). Details in add-isolated-vm.md.

7. WAN admin (Web UI + SSH)

Goal: manage the router from the WAN IP (172.22.0.127), while isolated VMs on the LAN cannot open SSH or HTTPS to 192.168.1.1.

Web UI

  1. System → Settings → Administration
  2. Secure Shell Server: enable, listen interfaces = WAN only
  3. Web GUI: HTTPS, listen interfaces = WAN only

  4. Firewall → Rules → WAN

  5. Pass TCP 443 to This firewall (destination (self))

SSH on port 2222

WAN port 22 is used for the first VM. Expose router SSH on 2222:

  1. NAT: WAN 2222127.0.0.1:22 (not 192.168.1.1:22 — sshd does not listen on LAN after WAN-only restriction)
  2. WAN pass rule for TCP 2222 to (self) if needed

Access: ssh -p 2222 root@172.22.0.127

Verify listen addresses

sockstat -l4 | grep -E ':443|:22'

Expected: HTTPS and SSH on the WAN address (172.22.0.127) and SSH on 127.0.0.1, not on 192.168.1.1.

8. Default LAN rule

Leave the bottom “Default allow LAN to any” rule in place for non-isolated hosts if you add more LAN clients later. Isolated VMs are matched by the specific rules above first.

9. Verification

From the isolated VM:

bash scripts/fedora/verify-connectivity.sh

From Windows (with config/env.local):

.\scripts\windows\Verify-Connectivity.ps1

Expected: internet and DNS via 192.168.1.1 work; main LAN (172.22.0.x) and direct DNS (8.8.8.8) fail; SSH/HTTPS to 192.168.1.1 time out.

Full matrix: verification.md.

10. Rollback

cp /conf/config.xml.pre-isolated-lan /conf/config.xml
/usr/local/etc/rc.filter_configure
configctl webgui restart
/etc/rc.d/sshd onerestart

Quick reference — current lab values

Item Value
OPNsense WAN 172.22.0.127
OPNsense LAN 192.168.1.1
First VM 192.168.1.10
Upstream router 172.22.0.1
WAN SSH (router) port 2222
WAN SSH (VM) port 22
WAN RDP (VM) port 3389