You don’t have to be an ICT security professional these days to know that your Internet access device at home has not the best security reputation. Just look for home router vulnerabilities in your favorite search engine and you’ll discover plenty of information:

• The Hacker News
• Threat Post
• Security Evaluators
• ReadWrite

The list goes on. I don’t see things getting better in the future. Your Internet provider (cable, xDSL, EDGE/G3/LTE) wants to provide network access and functionality (WLAN, IP-VOICE) all packed in a small device (which is more often than not free) at a competitive price to as many customers as possible. Now think about your small box you have at home: do you think there is room for security? I mean real security. Well, make an educated guess. If you care about your digital properties at home, you should start securing your fences right after your provider gives you router access. Setting an open-source firewall on an old PC would do the trick, but the majority of us have to deal with installation in the living room near the TV or in rooms were we cannot afford to have big and noisy devices. And don’t forget the power consumption.

Dedicated Home Firewall Project

Let’s start a small project on building our personal firewall appliance. To make it work our security design has to fullfil following requirements:

• Fanless design (almost no sound emissions)
• Small form factor (to fit everywhere)
• Power efficient (on hot summer days we don’t want to melt down)
• Enough CPU and network performance
• Include two to four Network interfaces on board

It’s just like the Internet provider’s device but with one difference: the device will cost a bit more. Security will always have a higher cost on our budget but for this project we’ll set a limit of 200 $/CHF.

Let’s implement following simple network design:

I’ve found a custom made appliance that fulfills all requirements and it’s made by a nice and small Swiss company called PC Engines. They have several models that fits for a number of use cases and in our case we’ll take the so called APU for this firewall project. The APU appliance has the size of a small chocolate box and fits almost everywhere and here are the technical specs:

• CPU: AMD G series T40E, 1 GHz dual Bobcat core with 64 bit support, 32K data + 32K instruction + 512K L2 cache per core
• DRAM: 2 or 4 GB DDR3-1066 DRAM
• Storage: Boot from SD card (connected through USB), external USB or m-SATA SSD. 1 SATA + power connector
• 12V DC, about 6 to 12W depending on CPU load
• Connectivity: 3 Gigabit Ethernet channels (Realtek RTL8111E)
• I/O: DB9 serial port, 2 USB external + 2 internal, three front panel LEDs, pushbutton
• Expansion: 2 miniPCI express (one with SIM socket), LPC bus, GPIO header, I2C bus, COM2 (3.3V RXD / TXD)
• Board size: 6 × 6 inch (152.4 × 152.4 mm)
• Cooling: Conductive cooling from the CPU and south bridge to the enclosure using a 3 mm alu heat spreader (included)

More detailed documentation is available here

Those specs are rather amazing. We could use the same hardware for a number of other interesting projects like home automation, NMS, Network Analysis and much more. This time we’ll create a Firewall that has all features for our home security but it could easily secure small to medium business. Here are the needed components:

4GB RAM Appliance

Optional parts

Alternative 2GB RAM Appliance

The hardware appliance is just like a normal x64 PC without video card, so you could install various operating systems on it like Linux, FreeBSD, OpenBSD but they need to redirect the console output to the serial port.

Firewall Software

I recommend a FreeBSD-based open-source firewall distribution called OPNsense. Feel free to find out more about the distribution’s features and architecture on their website. Here are my personal views on why OPNsense is the way to go:

• It is FreeBSD based and very efficient on this kind of hardware solutions.
• Firewall is based on OpenBSD Packet Filter(http://www.openbsd.org/faq/pf/) and belongs to the best security architectures
• BSD style license
• Project’s mission statement
• Clean and polished user interface
• Powerful featured
• Easy to configure

Prepare the Appliance

Once we get the Hardware, we need to assemble it. I highly recommend following the guides on PCEngine’s website

For the setup process we need following:

• USB Stick or SDcard (at least 1GB of size)
• Serial terminal program
• Null Modem serial cable (DB9 connector)
• PC/Laptop with serial port or an USB to Serial converter

Prepare The Installation Media

The following steps were done on Linux. Feel free to use your preferred environment:

• Get the OPNsense installation binaries:

wget http://sourceforge.net/projects/opnsense/files/15.1.7/OPNsense-15.1.7-serial-amd64.img.bz2
wget http://sourceforge.net/projects/opnsense/files/15.1.7/OPNsense-15.1.7-checksums-amd64.sha256

• Verify the integrity of the downloaded binaries (remember NSA?)

root@blacknovo:~/Downloads# cat OPNsense-15.1.7-checksums-amd64.sha256
SHA256 (OPNsense-15.1.7-cdrom-amd64.iso.bz2) = e46bb9acd010977d24d862bbe0a85ebfbdcc42dd633851056ad52402bec4b119
SHA256 (OPNsense-15.1.7-serial-amd64.img.bz2) = 869e985fc21d083e2530a81e96eb274caf753b4b9db33d04bda86d4e427a240a
SHA256 (OPNsense-15.1.7-vga-amd64.img.bz2) = b9c71b431cf2ffa399da6a7b11f50d971f7c1747512e794bb7e930dde6d5daeb

root@blacknovo:~/Downloads# sha256sum OPNsense-15.1.7-serial-amd64.img.bz2
869e985fc21d083e2530a81e96eb274caf753b4b9db33d04bda86d4e427a240a  OPNsense-15.1.7-serial-amd64.img.bz2

• Unzip the compressed binary

root@blacknovo:~/Downloads# bunzip2 OPNsense-15.1.7-serial-amd64.img.bz2

• Insert the destination device (USB Stick or SDcard). Excerpt from dmesg:

...
[1777015.998438] sd 6:0:0:0: [sdb] 1984000 512-byte logical blocks: (1.01 GB/968 MiB)
[1777016.007803]  sdb: sdb1
[1777016.425180] FAT-fs (sdb1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[1777016.429920] FAT-fs (sdb1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
...

• Verify the device is recognized with fdisk -l

Disk /dev/sdb: 1015 MB, 1015808000 bytes
255 heads, 63 sectors/track, 123 cylinders, total 1984000 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           2     1983999      991999    b  W95 FAT32

• Now write the image to the installation medium (Be careful: Verify the destination device twice. You’ve been warned!)

root@blacknovo:~/Downloads#  dd if=./OPNsense-15.1.7-serial-amd64.img of=/dev/sdb bs=16K
39069+0 records in
39069+0 records out
640106496 bytes (640 MB) copied, 86.1828 s, 7.4 MB/s

• Check the result with fdisk -l:

Disk /dev/sdb: 1015 MB, 1015808000 bytes
255 heads, 63 sectors/track, 123 cylinders, total 1984000 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x90909090

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb4   *           0       49999       25000   a5  FreeBSD

• Ensure there is a FreeBSD partition on installation media.

Configure The Terminal Console Environment

When configuring the terminal console environment you need a PC/Laptop with a serial port or a USB to Serial adapter. Use your preferred terminal console program and set it to 115200,8,N,1 meaning: 115200 baud, 8 bit, parity None, stop-bit 1. I use minicom in a privileged Linux terminal session. Here are the configuration steps:

• Type minicom -s to enter setup mode
• Chose serial port setup
• Type e
• Type e for 115200 baud, leave the rest as default

   +-----------------+---------[Comm Parameters]----------+----------------+
    | A -    Serial De|                                    |                |
    | B - Lockfile Loc|     Current: 115200 8N1            |                |
    | C -   Callin Pro| Speed            Parity      Data  |                |
    | D -  Callout Pro| A: <next>        L: None     S: 5  |                |
    | E -    Bps/Par/B| B: <prev>        M: Even     T: 6  |                |
    | F - Hardware Flo| C:   9600        N: Odd      U: 7  |                |
    | G - Software Flo| D:  38400        O: Mark     V: 8  |                |
    |                 | E: 115200        P: Space          |                |
    |    Change which |                                    |                |
    +-----------------| Stopbits                           |----------------+
            | Screen a| W: 1             Q: 8-N-1          |
            | Save set| X: 2             R: 7-E-1          |
            | Save set|                                    |
            | Exit    |                                    |
            | Exit fro| Choice, or <Enter> to exit?        |
            +---------+------------------------------------+

• Hit enter
• Now select your serial device, type a
• If you use a USB converter your device would be /dev/ttyUSB0 or /dev/ttyUSB1 (check with dmesg if unsure) otherwise you should select the serial device (probably /dev/ttyS0 or /dev/ttyS1)

    +-----------------------------------------------------------------------+
    | A -    Serial Device      : /dev/ttyUSB0                              |
    | B - Lockfile Location     : /var/lock                                 |
    | C -   Callin Program      :                                           |
    | D -  Callout Program      :                                           |
    | E -    Bps/Par/Bits       : 115200 8N1                                |
    | F - Hardware Flow Control : Yes                                       |
    | G - Software Flow Control : No                                        |
    |                                                                       |
    |    Change which setting?                                              |
    +-----------------------------------------------------------------------+

• confirm device with enter
• exit submenu with enter
• save setup as default (dfl)
• select exit

On the bottom line of the terminal windows you should see this line:

[CTRL-A Z for help |115200 8N1 | NOR | Minicom 2.6.1  | VT102 |      Offline ]

Install OPNsense

Now power-on the APU board using this procedure:

• Connect the APU serial port to your PC/Laptop Serial port via Null-Modem Cable
• Insert the OPNsense installation medium (SDcard or USB stick)
• Plug the power cord to the board connector
• Insert the Power Adapter to the power source

You should see the BIOS POST messages on your terminal console:

PC Engines APU BIOS build date: Apr  5 2014
Reading data from file [bootorder]
SeaBIOS (version ?-20140405_120742-frink)
SeaBIOS (version ?-20140405_120742-frink)
Found coreboot cbmem console @ df150400
Found mainboard PC Engines APU
Relocating init from 0x000e8e71 to 0xdf1065e0 (size 39259)
Found CBFS header at 0xfffffb90
found file "bootorder" in cbmem
CPU Mhz=1001
Found 27 PCI devices (max PCI bus is 05)
Copying PIR from 0xdf160400 to 0x000f27a0
Copying MPTABLE from 0xdf161400/df161410 to 0x000f25b0 with length 1ec
Copying ACPI RSDP from 0xdf162400 to 0x000f2590
Copying SMBIOS entry point from 0xdf16d800 to 0x000f2570
Using pmtimer, ioport 0x808
Scan for VGA option rom
EHCI init on dev 00:12.2 (regs=0xf7f08420)
Found 1 lpt ports
Found 2 serial ports
AHCI controller at 11.0, iobase f7f08000, irq 11
EHCI init on dev 00:13.2 (regs=0xf7f08520)
EHCI init on dev 00:16.2 (regs=0xf7f08620)
Searching bootorder for: /pci@i0cf8/*@11/drive@0/disk@0
AHCI/0: registering: "AHCI/0: SATA SSD ATA-10 Hard-Disk (15272 MiBytes)"
Searching bootorder for: /rom@img/setup
Searching bootorder for: /rom@img/memtest
OHCI init on dev 00:12.0 (regs=0xf7f04000)
OHCI init on dev 00:13.0 (regs=0xf7f05000)
OHCI init on dev 00:14.5 (regs=0xf7f06000)
OHCI init on dev 00:16.0 (regs=0xf7f07000)
Searching bootorder for: /pci@i0cf8/usb@16,2/storage@1/*@0/*@0,0
Searching bootorder for: /pci@i0cf8/usb@16,2/usb-*@1
USB MSC vendor='Multiple' product='Card  Reader' rev='1.00' type=0 removable=1
USB MSC blksize=512 sectors=1984000
All threads complete.
Scan for option roms
Running option rom at c000:0003

iPXE (http://ipxe.org) 00:00.0 C000 PCI2.10 PnP PMMpmm call arg1=1
pmm call arg1=0
+DF0E94B0pmm call arg1=1
pmm call arg1=0
+DF0494B0 C000

Searching bootorder for: /rom@genroms/pxeboot.rom

Build date: Apr  5 2014
System memory size: 4592 MB

Press F12 for boot menu.

• If the installation medium is recognized you should see following FreeBSD welcome screen:

  ______               ____   _____ _____
 |  ____|             |  _ \ / ____|  __ \
 | |___ _ __ ___  ___ | |_) | (___ | |  | |
 |  ___| '__/ _ \/ _ \|  _ < \___ \| |  | |
 | |   | | |  __/  __/| |_) |____) | |__| |
 | |   | | |    |    ||     |      |      |
 |_|   |_|  \___|\___||____/|_____/|_____/    ```                        `
                                             s` `.....---.......--.```   -/
 +------------Welcome to FreeBSD-----------+ +o   .--`         /y:`      +.
 |                                         |  yo`:.            :o      `+-
 |  1. Boot Multi User [Enter]             |   y/               -/`   -o/
 |  2. Boot [S]ingle User                  |  .-                  ::/sy+:.
 |  3. [Esc]ape to loader prompt           |  /                     `--  /
 |  4. Reboot                              | `:                          :`
 |                                         | `:                          :`
 |  Options:                               |  /                          /
 |  5. [K]ernel: kernel (1 of 2)           |  .-                        -.
 |  6. Configure Boot [O]ptions...         |   --                      -.
 |                                         |    `:`                  `:`
 |                                         |      .--             `--.
 |                                         |         .---.....----.
 +-----------------------------------------+

• After few seconds the system will boot to the installation menu:

/boot/kernel/kernel text=0x11ae738 data=0x6d65b0+0x215440 syms=[0x8+0x1720b0+0x
Booting...
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2014 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 10.1-RELEASE-p6 #0 5aa5ada(master): Thu Feb 26 16:26:03 CET 2015
    root@sensey64:/usr/obj/usr/src/sys/SMP amd64
FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
....

• After some time you’ll see the (ASCII) installation menu:

Waiting for backend...


                   =========== Configure Console ===========
                   |                                       |
                   | Your selected environment uses the    |
                   | following console settings, shown in  |
                   | parentheses. Select any that you wish |
                   | to change.                            |
                   |                                       |
                   | < Accept these Settings >             |
                   | < Change Video Font (default) >       |
                   | < Change Screenmap (default) >        |
                   | < Change Keymap (default) >           |
                   =========================================

• Accept default settings and select

                       < Quick/Easy Install >


                  ============== Are you SURE? ==============
                  |                                         |
                  | Easy Install will automatically install |
                  | without asking any questions.           |
                  |                                         |
                  | WARNING: This will erase all contents   |
                  | in your first hard disk! This action is |
                  | irreversible. Do you really want to     |
                  | continue?                               |
                  |                                         |
                  | If you wish to have more control on     |
                  | your setup, choose Custom Installation  |
                  | from the Main Menu.                     |
                  |                                         |
                  |           < OK >  < Cancel >            |
                  ===========================================

• Go ahead, an installation bar will appear and you’ll see the LED near the mSATA card flickering as the data is being written on it.

• Once the installation is done you’ll see this message:

                   ================= Reboot ================
                   |                                       |
                   | This machine is about to be shut down.|
                   | After the machine has reached its     |
                   | shutdown state, you may remove the CD |
                   | from the CD-ROM drive tray and press  |
                   | Enter to reboot from the HDD.         |
                   |                                       |
                   | < Reboot >  < Return to Select Task > |
                   =========================================

• Select reboot and remove the installation media
• The following message will be then displayed:

After the reboot is complete, open a web browser and
enter https://192.168.1.1 (or the LAN IP Address) in the
location bar.

You might need to acknowledge the HTTPS certificate if
your browser reports it as untrusted. This is normal
as a self-signed certificate is used by default.

*DEFAULT Username*: root
*DEFAULT Password*: opnsense

Rebooting in 5 seconds. CTRL-C to abort.

• After the reboot you should see the initial configuration script:

F1  FreeBSD

F6 PXE
Boot:  F1

...
...
...

Loading configuration...done.

Default interfaces not found -- Running interface assignment option.

Valid interfaces are:

re0    00:0d:b9:37:12:bc   (up) RealTek 8168/8111 B/C/CP/D/D/F/G PCIe Gigabit Ethernet
re1    00:0d:b9:37:12:bd   (up) RealTek 8168/8111 B/C/CP/D/D/F/G PCIe Gigabit Ethernet
re2    00:0d:b9:37:12:be   (up) RealTek 8168/8111 B/C/CP/D/D/F/G PCIe Gigabit Ethernet

Do you want to set up VLANs first?

If you are not going to use VLANs, or only for optional interfaces, you should
say no here and use the webConfigurator to configure VLANs later, if required.

Do you want to set up VLANs now [y|n]?

• Type n for no VLAN configuration (unless you have to) and continue
• Select (type) re2 as your WAN interface, this would be the one near the USB hub.

If you do not know the names of your interfaces, you may choose to use
auto-detection. In that case, disconnect all interfaces now before
hitting @a@ to initiate auto detection.

Enter the WAN interface name or @a@ for auto-detection: re2

• Select (type) re0 as your LAN interface (near the serial console port)

Enter the LAN interface name or 'a' for auto-detection
NOTE: this enables full Firewalling/NAT mode.
(or nothing if finished): re0

• Select (type) re1 as your OPT1 interface, to use for your WLAN AP

Enter the Optional 1 interface name or 'a' for auto-detection
(or nothing if finished): re1

• Finish the network interface assignment by just entering nothing here:

Enter the Optional 2 interface name or 'a' for auto-detection
(or nothing if finished):

The interfaces will be assigned as follows:

WAN  -> re2
LAN  -> re0
OPT1 -> re1

• Confirm with y to proceed

Do you want to proceed [y|n]? y

Writing configuration...done.
Updating configuration...done.
Cleaning backup cache...done.
Setting up extended sysctls...done.
Setting timezone...done.
Configuring loopback interface...done.
Starting syslog...done.
Starting Secure Shell Services...done.
Setting up polling defaults...done.
Setting up interfaces microcode...done.
Configuring loopback interface...done.
Creating wireless clone interfaces...done.
Configuring LAGG interfaces...done.
Configuring VLAN interfaces...done.
Configuring QinQ interfaces...done.
Configuring WAN interface...done.
Configuring LAN interface...done.
Syncing OpenVPN settings...done.
Configuring firewall......done.
Starting PFLOG...done.
Setting up gateway monitors...done.
Synchronizing user settings...done.
Starting webConfigurator...done.
Configuring CRON...done.
Starting DNS forwarder...done.
Starting NTP time client...done.
Starting DHCP service...done.
Starting DHCPv6 service...done.
Configuring firewall......done.
Generating RRD graphs...done.
Starting syslog...done.
Starting CRON... done.

*** Welcome to OPNsense 15.1.7-78bdb9aef (amd64) on OPNsense ***

 WAN (re2)       -> v4/DHCP4: 192.168.169.155/24
 LAN (re0)       -> v4: 192.168.1.1/24
 OPT1 (re1)      ->

FreeBSD/amd64 (OPNsense.localdomain) (ttyu0)

login:

• Use the default credentials displayed before: root/opnsense

login: root
Password:
FreeBSD 10.1-RELEASE-p6 (SMP) #0 5aa5ada(master): Thu Feb 26 16:26:03 CET 2015

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories:   https://www.FreeBSD.org/security/
FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
FreeBSD FAQ:           https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums:        https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with:  pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed:  freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages:  man man
FreeBSD directory layout:      man hier

Edit /etc/motd to change this login announcement.
 0) Logout                             7) Ping host
 1) Assign Interfaces                  8) Shell
 2) Set interface(s) IP address        9) pfTop
 3) Reset the root password           10) Filter Logs
 4) Reset to factory defaults         11) Restart web interface
 5) Reboot system                     12) Upgrade from console
 6) Halt system                       13) Restore a configuration

Enter an option:

• Let’s now configure the WLAN Access network here before going to the web admin interface: type 2 and enter

Available interfaces:

1 - WAN (re2 - dhcp, dhcp6)
2 - LAN (re0 - static)
3 - OPT1 (re1 - static)

Enter the number of the interface you wish to configure:

• Select OPT1 typing 3 and enter the rest is self explanatory just look the protocol below:

Enter the new OPT1 IPv4 address.  Press <ENTER> for none:
> 192.168.168.254

Subnet masks are entered as bit counts (as in CIDR notation) in OPNsense.
e.g. 255.255.255.0 = 24
     255.255.0.0   = 16
     255.0.0.0     = 8

Enter the new OPT1 IPv4 subnet bit count (1 to 31):
> 24

For a WAN, enter the new OPT1 IPv4 upstream gateway address.
For a LAN, press <ENTER> for none:
>

Enter the new OPT1 IPv6 address.  Press <ENTER> for none:
>

Do you want to enable the DHCP server on OPT1? (y/n) n

Do you want to revert to HTTP as the webConfigurator protocol? (y/n) n

Please wait while the changes are saved to OPT1...
 Reloading filter...
 DHCPD...

The IPv4 OPT1 address has been set to 192.168.168.254/24

Press <ENTER> to continue.

Reboot the appliance

• Reboot the appliance by typing 5 and enter – confirm with y

OPNsense will reboot.
This may take a minute, depending on your hardware.

Do you want to proceed [y|n]? y

OPNsense is rebooting now.

*** FINAL System shutdown message from root@OPNsense.localdomain ***

System going down IMMEDIATELY

We’re finally done with the APU appliance installation.

Accessing The WebAdmin GUI

Wait for the appliance to be up again and access the Webadmin GUI on https://192.168.1.1

Enter the default credential to enter the admin console.

Without configuration your appliance will provide DHCP leases on LAN, respond on DNS requests and allow outgoing IP communication from LAN to WAN on all IP protocols. That’s why at first login you’ll be presented with the OPNsense Setup Wizard. Just go ahead and follow the wizard…

In our design we have to uncheck Block RFC1918 Private Networks otherwise the communication to our internet router/modem and WLAN AP is blocked.

Guess what? Change the password!

Reload the configuration to be active:

You may need to refresh your browser or re-login, let me direct your attention to the nice and clean look of the dashboard:

The dashboard is fully customizable with several widgets that show aspects of the firewall appliance. Just click on add widget and select the information you want to see at glance, like interface statistics, latest logs, disk status, services status and more.

I’m not going to explain how to configure all the various OPNsense features as this is very intuitive and well documented on the project’s wiki. There are very powerful features equal to enterprise class firewalls such as cluster support (CARP), complete DNS server (DNS Resolver), full IPv6 support (DHCPv6 Server/RA), Captive Portal (similar to the WLAN portal you see in hotels and public access spots), Load Balancer, VPN Server and more. Showing all configurations would require a dedicated article and is out of scope here.

Basic Firewall Appliance Configuration

To finish the project let’s do the minimum configuration for our design to work. Let’s configure internet access for home network (LAN) and for the WLAN Access Point network (OPT1). We need following:

• Ensure NAT rules are active to masquerade the internal IP addresses to the WAN interface of the appliance
• Ensure IP access rules are present to allow communication as required by our needs

1. Select Firewall, click on NAT and select Outbound tab
2. Ensure that Automatic outbound NAT rule generation is selected (of course you can do all by yourself manually)
3. Now, click on Rules and select LAN tab
4. The defaults here are already fine for our basic configuration (feel free to change a your pleasure)
5. Let’s configure the OPT1 interface by clicking on OPT1 tab
6. Click the + button to add a rule (and remember by default all is denied; so, no rule = no access)

“

• The relevant settings to change in the new rule are:
  • in the Protocol select any
  • in the source select the OPT1 net object
  • in the destination select any

• Save the rule clicking on the orange Save button and Apply changes

Check For Updates and Upgrade

Finally, to close this project before going in production make sure to check your system for available updates: select system, firmware.

Select upgrade and you’ll see the progress window:

Reboot (if needed) and you’ll be all set.

Final Thoughts

This configuration is of course basic and you’ll need to finalize your firewall policy, but you can configure this firewall appliance to fit your needs. You can configure Dynamic DNS and use it as remote access with IPSEC or openVPN the features or you can enhance the appliance with a WLAN mPCI slot (and you have 2).

Just in case you like to play on Console, leave it attached to the provider router network; double NAT is not really fun if you play with your friends over the net, believe me: you’ll regret it otherwise.

Should you have concerns about your game data, then you better rethink. All your valuable data is already in the cloud (Microsoft, Sony, Nintendo and more) and we better don’t start this discussion here, do we? Games are fun, either take what you get or don’t, it’s that simple.

OPNsense is a fairly new project and will become more mature in the next few months, therefore some minor issues may need a fix. Still, I see no risk in day to day usage: the underlaying base is solid and started 12 years ago with m0n0wall.

Now, take it from here and make it better!

About the Author

Andrea Covello has been working in information security since the 1990s. His strengths are in engineering, specializing in Windows security, firewalling and advanced virtualization.

Links

• http://en.wikipedia.org/wiki/Common_Address_Redundancy_Protocol
• http://m0n0.ch/wall/
• http://opnsense.org
• http://pcengines.ch
• http://readwrite.com/2013/04/16/beware-the-wireless-router-security-threat
• http://thehackernews.com/2014/12/router-vulnerability-puts-12-million.html
• http://www.amazon.de/Trendnet-TU-S9-USB-Seriell-Konverter-wei%C3%9F/dp/B0007T27H8/ref=sr_1_7?ie=UTF8&qid=1426864646&sr=8-7
• http://www.pcengines.ch/ac12veur2.htm
• http://www.pcengines.ch/apu1d.htm
• http://www.pcengines.ch/apu1d4.htm
• http://www.pcengines.ch/apucool.htm
• http://www.pcengines.ch/case1d2bluu.htm
• http://www.pcengines.ch/db9cab1.htm
• http://www.pcengines.ch/msata16d.htm
• http://www.pcengines.ch/pdf/apu1.pdf
• https://opnsense.org/about/features/
• https://securityevaluators.com/knowledge/case_studies/routers/soho_router_hacks.php
• https://threatpost.com/12-million-home-routers-vulnerable-to-takeover/109970
• https://wiki.opnsense.org/index.php/Develop:Architecture#Architecture
• https://www.scip.ch/labs/images/dedicated_home_firewall_network_schematics_1200.png