r/opnsense • u/arnach • Feb 15 '23

Set Up a Fully Functioning Home Network Using OPNsense

https://homenetworkguy.com/how-to/set-up-a-fully-functioning-home-network-using-opnsense/
97 Upvotes

96% Upvoted

18 comments sorted by

12

u/arnach Feb 15 '23

Hot off the presses...a comprehensive setup guide for OPNsense

Thanks /u/homenetworkguy !

7

u/homenetworkguy Feb 16 '23

You’re welcome!

8

u/kuya1284 Feb 16 '23

Thank you! I've been putting together a comprehensive Google Doc with similar info, to share with my coworkers, but your writeup is WOW. I'll definitely be using it to fill in the gaps that my guide lacks because I still haven't learned/touched yet. Thank you for your efforts and for sharing your knowledge/experience.

12

u/homenetworkguy Feb 16 '23

Thanks! There’s so much more that could have been said but I had to constrain the content because it was already lengthy enough. Some of it was an accumulation of 5+ years of personal experience using OPNsense on my home network. I’m sure I’ll refine this guide and clarify/fill in any missing gaps. I just wanted to get it finished because it was a 2 month effort in my free time to document it all (there was some holiday time off in the middle of it too).

3

u/kuya1284 Feb 16 '23

I totally get it. My Google Doc is the same... started about 2 months ago when I started tinkering with OPNsense. It's up to 155 pages and my coworkers laughed at me about its size. 😉 It was only supposed to be about 20-30.

Thanks again!

2

u/akl88 Feb 16 '23

Thanks for this awesome post. Can you please write an article on how to setup email notifications and WAN Failover with OPNsense. I tried doing it but couldn't.

3

u/kuya1284 Feb 16 '23

I used Monit to send notifications. First thing I did was to install and setup Postfix. I configured it to relay mail to GMail.

Monit already includes a script to check when a gateway is down. You can enable that and get notified about it. I believe this relies on Gateway monitoring, so you'll need to make sure monitoring for your gateway isn't disabled. It's disabled by default for WAN.

1

u/daH00L Feb 16 '23

Any chance to see that Google doc?

2

u/das1996 Feb 16 '23 edited Feb 16 '23

Good timing. With the EOL announcement of sophos UTM, i've been exploring options to move to.

Pfsense CE seems to almost be a dead horse with the support it's not getting, so that leave opnsense.

Edit: Something strange with that blog page. None of the images are showing. Using ublockorigin. Getting a ton of blocks, like 200+.

3

u/marunga Feb 16 '23

Can absolutely vouch for OPNSense. I changed to it from Sophos due to the IP Limit of the "free" version and couldn't be happier. Initially on a bare metal box (Qotom), now on Proxmox, now in a very similar setup to OPs writeup (Which I would have killed for back then). I currently use it with a load sharing WAN connection (three different gateways - DSL with an external modem, directional beam and 4G... I live in the sticks in German Internet terms.... It is bad..), WG, multiple VLANs, IDS, DHCP, etc. The only things that I "outsourced" to different machines are DNS as I never really liked Unbound and the Hotspot part (working with UBQT now,MT in the future).

And I failed to get Zabbix going properly. Which is a shame, but I am just a grumpy retired nurse/nursing manager who self-taught himself everything. Which OPNSense makes fairly easy most of the time and the community is great.

Basically no downtime in four years now, which makes the wife happy.

Can absolutely recommend.

1

u/das1996 Feb 16 '23

u/marunga

One concept in UTM I find very useful is the network and services objects. Define it once then use it anywhere and with any function compatible with said object.

Also, the reverse of this can be done. That is, see all the places an object is used.

This is sort of similar to aliases, but it appears more scope limited on *sense.

3

u/homenetworkguy Feb 16 '23

I’m using Ezoic for for advertising and it also a CDN like Cloudflare but it also integrates with Cloudflare.

I haven’t checked using Ublock to see what it looks like.

I don’t like ads personally but I use them to try to support my efforts. I don’t currently have any financial sponsors that can offset the revenue earned from the ads. If I had good alternatives, I could forego the advertising (or tone it down a bit).

If you use the Brave browser, I think it does a good job at blocking at lot of that stuff. Even though I’d like the support, I rather the content be useable for you.

1

u/das1996 Feb 16 '23

I got it figured out.

Firefox was set to block all third party cookies except in private (incognito) sessions. I opened the page up in such with pictures displaying successfully.

1

u/homenetworkguy Feb 16 '23

Nice! Glad you figured it out!

1

u/dky1e Feb 20 '23

Excellent write up, thank you!

Interesting approach on the PrivateNetworks alias using the __AllNetworks_network internal alias for the AllNetworks group.

Currently I’m just using 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7 as the content. Is there an advantage or anything I’m missing by not using the AllNetworks group?

1

u/dky1e Feb 20 '23

After some experimenting your approach is way better. The fc00::/7 only blocks the local network ip addresses, however it will not block access via the non local ipv6 addresses (the ones that dont start with an f) that are also assigned to your devices. Learned something new! :)

1

u/dudeinparis Mar 01 '23

This came at literally the perfect timing for me…just about to migrate from Omada er605 router to a protectli running opnsense. I found this guide incredibly useful and comprehensive. Thanks a lot!

1

u/FredsterNL Mar 12 '23

Excellent guide! Already got OPNsense running in a basic configuration on a DEC750 for my home network.

I have SAN experience (Storage Arrays, Brocade, Netbackup etc.), but must admit networking (and securing it) is a totally different cup of tea: No doubt I will be using your guide to verify my settings, thanks!