OPNsense Beginner to Professional E-Book

Julio Cesar Bueno de Camargo

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 452

Veröffentlichungsjahr: 2022

Beschreibung

OPNsense is one of the most powerful open source firewalls and routing platforms available. With OPNsense, you can now protect networks using features that were only previously available to closed source commercial firewalls.
This book is a practical guide to building a comprehensive network defense strategy using OPNsense. You’ll start with the basics, understanding how to install, configure, and protect network resources using native features and additional OPNsense plugins. Next, you’ll explore real-world examples to gain in-depth knowledge of firewalls and network defense. You’ll then focus on boosting your network defense, preventing cyber threats, and improving your knowledge of firewalling using this open source security platform.
By the end of this OPNsense book, you’ll be able to install, configure, and manage the OPNsense firewall by making the most of its features.

Leseprobe

OPNsense Beginner to Professional

Protect networks and build next-generation firewalls easily with OPNsense

Julio Cesar Bueno de Camargo

BIRMINGHAM—MUMBAI

OPNsense Beginner to Professional

Copyright © 2022 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Group Product Manager: Vijin Boricha

Publishing Product Manager: Mohd Riyan Khan

Senior Editor: Arun Nadar

Content Development Editor: Nihar Kapadia

Technical Editor: Nithik Cheruvakodan

Copy Editor: Safis Editing

Project Coordinator: Ashwin Kharwa

Proofreader: Safis Editing

Indexer: Hemangini Bari

Production Designer: Prashant Ghare

Marketing Coordinator: Hemangi Lotlikar

First published: June 2022

Production reference: 1180522

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

ISBN 978-1-80181-687-8

www.packt.com

To the memory of my father, Nivaldo B. de Camargo, my life's sensei. To my wife, who always encourages and supports me with her unconditional love and dedication, and our daughter, Maria Catarina, our little angel! To all friends (especially the Cloudfence team!) and family who supported me during this journey! To God, for keeping me standing to face life's challenges.

– Julio Cesar B. de Camargo

Contributors

About the author

Julio Cesar Bueno de Camargo is a cybersecurity professional with 15+ years of experience working with open source software. He started with Conectiva Linux and later became the official instructor helping dozens of students. As an aviation enthusiast and airplane pilot, he strives to bring all the aviation best practices to his professional routine.

Julio started working with OPNsense in 2016, contributing to the project with code, official forum moderation, articles, a Udemy course, and promotions in Brazil and Europe. He founded CloudFence in 2018, a cybersecurity start-up and a Luso-Brazilian-managed security services firm with an open source DNA. As its CTO, Julio aims to spread open source security as a service to companies from different parts of the world.

First, I want to thank my wife, the love of my life, Maria Eugenia, she always makes me believe! To our baby, Maria Catarina, daddy loves you! Also, I want to thank tech reviewers Franz Fabian and Nicolas Goralski ... and all the Packt team! To the OPNsense community that maintains this fantastic open source security project! To my teammates at Cloudfence. Last but not least, my friends and family were essential in motivating me to write this book!

About the reviewers

Fabian Franz BSc is a senior software developer (mainly working in the Jakarta EE / Spring and JavaScript environment nowadays) who has a strong security background. He was a pupil at HTL Dornbirn when his team won the Austrian Cyber Security Challenge national final. He continued studying for a bachelor's degree in Sichere Informationssysteme (secure information systems) at the University of Applied Sciences Upper Austria – Campus Hagenberg.

While Fabian was studying at the university, at some point, he read an article about a new firewall appliance on the internet. He was interested and started contributing quite quickly. Since then, he has written a few OPNsense plugins (such as the os-nginx plugin, covered in this book).

I have to thank all my teachers, who always taught me more than needed, which helped me to learn more to become an expert in specific areas. I also have to thank all those developers of open source software / free software out there whose software I use daily and which makes a firewall distribution such as OPNsense or a Linux distribution possible. A special thanks also to Ad and Franco for all the help I got when I learned how OPNsense works.

Nicolas Goralski is a Linux system engineer with over 24 years of experience in various companies.

Nicolas has a global vision of IT architectures to better understand business projects and propose the best economic and technical approach to achieve customer satisfaction.

Motivated by the leitmotiv Keep It Simple, Stupid (KISS) and what can be automated must be automated, Nicolas uses open source technology as much as he can to fulfill his duty.

To my wife, Isabelle, who has believed in me for years and who supports me, I love you.

To my kids, who try to understand what I do, and the fact that I'm not always playing on my computer.

To my family and friends, thank you for everything you have given me.

To Packt Publishing, thank you for giving me the opportunity to review this book.

To all the network packets that I've blocked, it's not personal, it's business.

Table of Contents

Preface

Section 1: Initial Configuration

Chapter 1: An OPNsense Overview

About the OPNsense project

Project history

A new project with a lot of improvements on old code

Rock-solid FreeBSD – HardenedBSD

FreeBSD

Why OPNsense?

My personal experience

Features and common deployments

Core features

Common deployments

Where to get help?

Some facts

Summary

Chapter 2: Installing OPNsense

Technical requirements

Versions and requirements

Versioning

Hardware

Downloading and installing OPNsense

Configuring VirtualBox to install OPNsense

Mounting the OPNsense ISO file

Installing OPNsense

Unmounting the ISO installation file

Setting up a LAN network

Configuring network interfaces

Updating firmware

Checking for system updates in WebGUI

Checking system updates using the CLI

Installing plugins

Advanced – Accessing the CLI through SSH

FreeBSD packages

PKG basic operations

Summary

Chapter 3: Configuring an OPNsense Network

Technical requirements

Hardware considerations

FreeBSD NIC names

The ifconfig command

Basic network configuration

WebGUI – network interface configuration

Assigning network interfaces

Overview of the network interface

Types of interfaces

Bridge

GIF

GRE

LAGG

Loopback

VLAN

VXLAN

Proposed exercise – creating another type of network interface

Exploring virtual IPs

IP alias

CARP

Proxy ARP

Proposed exercise – creating a virtual IP address

Network diagnostics and troubleshooting

True story – how to use ARP Table diagnostics

Common issue – local network hosts can't open websites

Summary

Chapter 4: System Configuration

Technical requirements

Managing users and groups

Creating users and groups

External authentication

Certificates – a brief introduction

General settings

The administration page

The General page

About OPNsense logging

Advanced settings

Cryptography settings

Configuration backup

Summary

Section 2: Securing the Network

Chapter 5: Firewall

Technical requirements

Understanding firewalling concepts

A stateful firewall

The Packet Filter

Firewall aliases

Importing and exporting aliases

The firewall rules

The rule processing order

Rule actions

Firewall settings

Diagnostics and troubleshooting

Troubleshooting

Summary

Chapter 6: Network Address Translation (NAT)

Technical requirements

NAT concepts

Port forwarding

Caveats

Creating a port forwarding rule

Outbound NAT

NAT outbound modes

Adding an outbound NAT rule

One-to-one NAT

Adding a one-to-one NAT rule

Summary

Chapter 7: Traffic Shaping

Technical requirements

Introduction to traffic shaping

dummynet and ipfw – a brief introduction

Possible scenarios

Controlling hosts' and users' bandwidth usage

Protocol prioritization

Creating rules

Monitoring

Summary

Chapter 8: Virtual Private Networking

Technical requirements

OPNsense core VPN types

IPSec

OpenVPN

IPsec versus OpenVPN

Site-to-site deployments using IPsec

Phase 1 configuration

Phase 2 configuration

IPSec BINAT

IPSec diagnostics

VPN deployments using OpenVPN

Site-to-site deployment

Remote user deployment

OpenVPN diagnostics

OpenVPN is connected but the traffic is not reaching the tunnel's destinations

OpenVPN client is not connecting to the server/a site-to-site tunnel doesn't become up

A single user cannot connect

Summary

Chapter 9: Multi-WAN – Failover and Load Balancing

Technical requirements

Failover and load balancing

Failover

Creating gateway groups

Policy-based routing

Creating a firewall rule to enable the failover configuration

Load balance

Troubleshooting

Summary

Chapter 10: Reporting

Technical requirements

System health graphs

RRDtool and health graphs

Understanding Netflow and how to use it

Configuring Netflow in OPNsense

Exploring real-time traffic

Troubleshooting common problems in the network using Netflow and graphs

Summary

Section 3: Going beyond the Firewall

Chapter 11: Deploying DHCP in OPNsense

Technical requirements

DHCP concepts

DHCP server

DHCP relay

Diagnostics

Summary

Chapter 12: DNS Services

Technical requirements

Core DNS services

Default DNS resolvers on OPNsense

DNS plugins

DDNS

Troubleshooting

Making a DNS lookup using the CLI

Summary

Chapter 13: Web Proxy

Technical requirements

Web proxy fundamentals

The explicit method

The transparent method

Why use a web proxy?

OPNsense web proxy core features

Basic configuration

Custom error pages

Configuring a web proxy with the explicit method

Testing the web proxy

Transparent web proxy configuration

Additional web proxy configurations

Web filtering

Web filtering practice

Web filtering – final thoughts

Reading logs and troubleshooting

Log files

Web proxy service issues

Summary

Chapter 14: Captive Portal

Technical requirements

Captive Portal concepts

OPNsense Captive Portal implementation

Setting up a guest network

Testing the configuration

Using voucher authentication

Web proxy integration

Common issues

HTTPS page redirection while using the Captive Portal

Summary

Chapter 15: Network Intrusion (Detection and Prevention) Systems

Technical requirements

IDS and IPS definition

Suricata and Netmap

Rulesets

Configuration

Testing

SSL fingerprint

Troubleshooting

Summary

Chapter 16: Next-Generation Firewall with Zenarmor

Technical requirements

Layer7 application control with Zenarmor

Choosing a Zenarmor edition

Hardware requirements

Paid subscriptions

Installing and setting up the Zenarmor plugin

Summary

Chapter 17: Firewall High Availability

Technical requirements

High availability concepts

Active-active and active-passive modes

CARP – how it works

The preempt behavior

Configuring high availability

Proposed scenario

Testing the HA configuration

Caveats

Summary

Chapter 18: Website Protection with OPNsense

Technical requirements

Publishing websites to the world

About the NGINX plugin

NGINX

Installing and configuring the NGINX plugin

Adding WAF rules

Troubleshooting

Testing for configuration issues

Logs reading

Summary

Chapter 19: Command-Line Interface

Technical requirements

Directory structure

Managing the backend daemons

Useful system commands

Advanced customization

Customizing the XML configuration file

Filtering log files

Filtering logs

Summary

Chapter 20: API – Application Programming Interface

Technical requirements

Concepts

Setting up API keys

API calls

GET method example

POST method example

Summary

Other Books You May Enjoy

Section 1: Initial Configuration

In this part, we will explore OPNsense's characteristics and features, install and configure it, take a look at some networking concepts, configuration, troubleshooting, and see how to configure and manage the system.

This part of the book comprises the following chapters:

Chapter 1, An OPNsense OverviewChapter 2, Installing OPNsenseChapter 3, Configuring an OPNsense NetworkChapter 4, System Configuration

Chapter 1: An OPNsense Overview

This chapter will introduce you to the OPNsense project, tell you about its history, license, and fork motivations, and where you can find help if you need it. Before installing and configuring your own OPNsense installation, it is essential to learn about some concepts and how the OPNsense project was started. We will also learn about FreeBSD, and its fork, HardenedBSD, exploring OPNsense features and the typical deployments scenarios that we can use it.

In this chapter, we're going to cover the following main topics:

About the OPNsense project Rock-solid FreeBSD – HardenedBSD Why OPNsense? Features and common deployments Getting help

About the OPNsense project

To introduce you to the OPNsense project, I'll first need to tell a bit of my story and how I fell in love with it.

Project history

To tell the OPNsense story, we need to go back to 2003, when the initial release of m0n0wall was released. The main goal of this project was to have FreeBSD-based firewall software with an easy-to-use web interface (based on PHP) that worked on embedded PCs and old hardware with a good performance but that was just focused on Layer 3 and Layer 4 firewalling. m0n0wall was a good achievement. Still, picky network and security admins were claiming for other features such as web proxying, intrusion detection and prevention systems, and some other features that commercial firewalls were delivering as a default Unified Threat Management Solution (UTM). So, in 2004 a new project began, a m0n0wall fork, with its first public released in 2006. The fork's name? pfSense, and, as the name suggests, it used Packet Filter (PF) as a firewall-based system instead of the ipfilter (another FreeBSD packet filter)of its predecessor. For a long time, pfSense was a unique open source firewall solution, with a big active community and constant improvements. Many network and security administrators that only accepted Linux-based firewalls (yes, I was one of them too!) started to migrate to this FreeBSD-based firewall. These two projects coexisted until 2015, when m0n0wall was discontinued. There were signs of discontent back then; part of the pfSense community was not happy with some things such as changes in licenses and the direction the project was heading in.

Back in 2014, a brave group of developers decided to fork from pfSense and m0n0wall and started the OPNsense project. The first official release was in January 2015, inheriting a lot of code from its predecessors. Still, with a very ambitious plan to change how a lot of things were being done, OPNsense quickly rose as a pfSense alternative and received an important recommendation from the m0n0wall founder, Manuel Kasper, encouraging users from his project to migrate to OPNsense. It was the start of one of the best open source firewall projects.

A new project with a lot of improvements on old code

The following are some of the key features that OPNsense came with:

OPNsense came with many new concepts and features that the community could claim credit for, such as a Model View Controller (MVC)-based web interface, a fixed release cycle, and a genuinely open source aspiration. The release cycle is done in two major versions each year, one in January and another in July (the community version) – for example, in 2021, the first version was 21.1 (January 2021), and the second one was 21.7 (July 2021), with a predictable and well-written roadmap. For the business edition, the releases are launched in April and October. The business editions are targeted at businesses and enterprises, containing the improvements delivered to the community version users first. As a Chief Technology Officer (CTO) with dozens of managed OPNsense-based firewalls, it is strategic to use firewall firmware with a predictable roadmap and release life cycle. This way, we can plan things with companies whose business depends on our managed firewalls.

Talking about versions, we need to introduce you to the flavor available:

OpenSSL: The default one.

If you don't have any reason to choose LibreSSL, I'll advise you to pick the default one, OpenSSL. We will talk more about versions and installation media in the next chapter.

Talking about improvements, we must speak of the project architecture, starting with the frontend, the Phalcon PHP framework. This framework is used to implement webGUI and its APIs (another considerable improvement compared with its predecessors). It will do the work to render and control all that you can see and do using your web browser to manage your OPNsense.

The OPNsense framework also contains a backend, which is a Python-based service, also known as configd. This backend service will be in charge of controlling services, generating daemons and service config files from Jinja2 templates, and applying these configurations to an operating system.

With this architecture, OPNsense has a significant advantage – a secure way to manage and apply configurations to an operating system without executing root commands directly from the PHP web interface (as pfSense did, for example), reducing the risk of a flaw in webGUI compromising the whole firewall system.

So, now that we know how OPNsense evolved and its benefits, let's take a look at the operating system that serves as the base to this incredible firewall platform – FreeBSD's fork, HardenedBSD. It's essential to understand how the whole system and its components work to become a good OPNsense administrator. Let's go!

Rock-solid FreeBSD – HardenedBSD

Before exploring OPNsense, let's look at its kernel: the almighty FreeBSD, the operating system that has the power to serve!

FreeBSD

First, FreeBSD isn't Linux! If you are a long-time FreeBSD user, don't be mad with me, as you probably have heard this statement before! If not and you thought that FreeBSD and Linux were the same, no problem! That is a common mistake people make. Let's first find out what FreeBSD is in a short introduction.

FreeBSD is a free and open source operating system. It is a Unix-like system but different from Linux; it is a complete operating system, including the kernel, drivers, and other user utilities and applications. Linux only includes the kernel and drivers, and everything else is built as the distribution or just distro. The FreeBSD project has an outstanding security reputation, and it has a dedicated team taking care of this at the code level. This has built a well-known reputation for a very secure operating system!

If you have never installed FreeBSD before, you must be thinking that you will use it for the first time on OPNsense, right? Not necessarily! You have probably used FreeBSD a lot already. Don't believe me? One of the strong points of the FreeBSD project is its licensing model, which is considered permissive. Add to that the system liability, robust security, and good hardware support and you have a lot of reasons to choose FreeBSD as your new product base operating system. Many companies have – Apple's macOS, iOS, and other OSes are based on FreeBSD code, Sony PlayStations 3 and 4 use it, and many network appliances make use of it too! If you have an iPhone, that also runs a FreeBSD-based operating system!

Now that we are introduced to OPNsense's operating system, let's explore why we should consider it for our network firewall.

Why OPNsense?

To give a short answer – because it is the best genuinely open source firewall project currently available!

Not satisfied with this answer? Fair enough! Let's go to the long one!

My personal experience

Back in 2009, I was a pfSense user and enthusiast when I decided to move from Linux-based firewalls to FreeBSD. Back then, I created a managed firewall service for small and medium businesses using Linux firewall distros. At that time, I was using IPCop and SmoothWall Express, two Linux-based distros. I started this project with IPCop, but I decided to move to Smoothwall Express later, from which IPCop was forked. Both were good options to run in an embedded firewall appliance with limited resources. As a long-time Linux user, I was very comfortable using something based on this operating system. I am from a time when we built firewalls using ipchains and, later, iptables scripts, without any GUI help. I know – I'm getting old! Changes were happening and the service grew, with customers demanding bigger firewall appliances with high availability capability. At this point, Linux had a problem; there was no good support for this feature, so I needed to go back to the drawing board.

From research, I have found two possible alternatives – OpenBSD and FreeBSD. The first one was a well-known security-focused operating system with a strong reputation, which looked like a great option to run as a firewall solution. However, there were some hardware compatibility limitations and a lack of a GUI to manage it. It was a crucial need that customers were asking for. I couldn't find any firewall GUI option available back then, and developing a new one as a one-person development team was not a suitable option. It was time to look at the FreeBSD choices.

By doing a quick Google search, I found a good option – m0n0wall. So, I downloaded it and started the tests! It impressed me! It was a light operating system with a good WebGUI running on a solid operating system. But at the very beginning, I found a problem – reading the official documentation, specifically on the topic of what m0n0wall is not, I discovered that it wasn't a proxy server, an Intrusion Detection System (IDS), or an Intrusion Prevention System (IPS), and losing these features was not an option! So, it was back to square one!

Googling again, I found a m0n0wall fork – a project called pfSense. It looked like a promising one, with everything I needed to implement at that time – WebGUI, high availability, and some plugins such as Squid/SquidGuard for proxying and web filtering, Snort for IDS/IPS, pf as the packet filter. Bingo! I had found what I was looking for! My first impression when testing on the PC engine-based hardware was disappointing! The performance was too low compared with the Linux options and even with m0n0wall. There were too many features for a hardware platform with few resources. Another problem to solve was that even the more powerful hardware I was testing on used a compact flash disk as mass storage, and enabling a service such as Squid for proxying and web filtering with a lot of disk writing meant that the Compact Flash (CF) card got damaged very quickly. But there was another option – installing the NanoBSD flavor of pfSense made things easier for the embedded hardware to run more smoothly, and with some coding, I was able to bypass the CF card limitations. So, I ran this solution as a firewall to many customers until 2015. That was the year I became a little bit frustrated with how the project was being driven; a lot of ideas were popping into my head, but the project community was not the same anymore. It was time for a fresh start. I even talked with some project contributors about starting a new fork, but the idea was not accepted by most of them. It was time to go back to Google to look for a good open source firewall project.

On one of these rainy days, when your creativity is low and you have no intention to code or think of a new solution, I decided to google for some open source firewall alternatives, and the results surprised me! I found something, a project called OPNsense, and it was a pfSense fork! At that moment, the sun shined on my keyboard, and I thought, that's it!! The more I read about the project history, the more convinced I became that I had found the perfect solution backing!

So, I started the tests, and it was fascinating! It was pretty easy to convert pfSense's XML configuration file to OPNsense, so my first labs were based on production systems, and the results were very satisfying. It was time to migrate the first customers to this new firewall platform. However, it had a limitation – web filtering. We had developed a custom SquidGuard plugin for pfSense, but it wasn't easy to convert it, as the webGUI was different. Fortunately, our first customers didn't need this feature. The first migration to OPNsense was a success! So, it was decided that OPNsense was the new option for our firewall appliances! Later, I developed a SquidGuard-based plugin for OPNsense, and we were able to migrate all the customers. Since then, I have moved from this company to a new one, CloudFence, and we have decided to support the OPNsense project as much as possible.

Some of the key features that led me to dive into the OPNsense project were: genuine open source motivations with the freedom that an actual open-sourced project must have – an MVC-based webGUI without direct root access to the operating system (except for legacy components), IDS and IPS with netmap support, excellent available plugins, two-factor authentication for VPN, and cloud backups, to mention just a few! The list is increasing with each new version; later, we will see each feature in detail, so don't worry about it for now!

Okay, so this book isn't a novel, but I had to tell my personal history with OPNsense because choosing an open source project as a contributor and user isn't like buying a product. It is about personal life decisions; it's about what you want to support and are passionate about, and that project was right for me. I tried to help it! This is a little bit of my personal story with OPNsense; I hope it can inspire you somehow! The whole story might need an entire book, and it isn't the purpose of this one to tell stories but rather to improve your OPNsense skills, so let's move on to OPNsense's features!

Features and common deployments

Let's dive into OPNsense's core features and the most common scenarios to deploy it.

Core features

What are the core features? The OPNsense core features all come with the default OPNsense installation, without any additional plugins.

The core features are as follows:

802.1Q virtual LAN (VLAN) support: The IEEE's 802.1Q, also known as Dot1q, is a network standard for supporting VLANs. This allows us to set a lot of different networks, with logical divisions or broadcast domains, using a VLAN-capable network switch. This is very useful when we need to define different networks using a single physical network interface, with which we can separate packets from different networks sources, using VLAN tagging. We will explore this in more detail in Chapter 3, Configuring an OPNsense Network.Stateful inspection firewall: OpenBSD's PF firewall, or just pf, was ported to FreeBSD in version 5.3. This packet filter is very flexible and easy to use. As someone who comes from the Linux world, I must admit it's easier to understand than iptables. The OPNsense webGUI generates the pf rules that are used for packet filtering and Network Address Translation (NATs). If, like me, you're a curious person and have access to a running OPNsense firewall, you can sneak a peak at the /tmp/rules.debug file to see some of the pf rules. But be warned – don't touch anything there yet! In Chapter 5, Firewall, we will dive into the world of firewalls. If you are not running OPNsense yet, don't worry! In the next chapter, we'll install and configure it.Traffic shaper: OPNsense uses another firewall component, ipfw, the native packet filtering for FreeBSD, to classify and prioritize packets for the traffic shaping. With a traffic shaper, you'll be able to limit and reserve bandwidth and prioritize Quality of Service (QoS) traffic.DHCP server and relay: The Dynamic Host Configuration Protocol (DHCP), as the name suggests, is a protocol to lease IP addresses to hosts in a network. OPNsense has both server and relay capabilities; the most common one, the DHCP server, is used to set an address pool configured dynamically to hosts on the network. The second one is used when hosts can't access the DHCP server directly, such as if the DHCP server relies on another network segment.DNS forwarder: The Domain Name System (DNS) is the base of our modern internet; without it, we would need to know every website IP address to access it. The DNS server and forwarder do the job of resolving domains to IP addresses. OPNsense has more than one native service to do this job, Unbound and Dnsmasq; both are resolvers. To enable a DNS server, such as Bind, you will need to install the Bind plugin. We will talk about plugins in the next chapter. The default option in the core OPNsense installation is the Unbound service.Dynamic DNS (DDNS): OPNsense has a dynamic DNS client to update its hostname to an external DNS service. This is often used to access OPNsense externally while using a dynamic IP address; in this way, every time the ISP's IP address changes, the DDNS client will update the hostname in the external DNS service. Otherwise, you will only be able to access OPNsense by externally finding a way to discover which IP address your OPNsense machine is using at the moment.

Important Note

Dynamic DNS is a plugin installed by default on OPNsense.

Intrusion Prevention System (IPS): Also known as an IDS, an IPS, or an IDPS, this is one of the most significant improvements in OPNsense compared to pfSense. The service used for pfSense is Suricata. Unlike Snort, which was used in the pfSense versions back in 2015 (when OPNsense was forked from it), it runs multithreaded. The OPNsense team implemented support for netmap, a network framework for high-speed packet processing. Moreover, the OPNsense project has Proofpoint support, which allows its users to use a high-quality ruleset. Instead of blocking a source or destination IP after matching a rule (as pfSense's IPS implementation used to work), OPNsense now just blocks the connection that corresponds with a rule, if in IPS mode; otherwise, it is in IDS mode, it will just alert. How does this improve IPS filtering? Suppose that one host in your LAN matches with an IPS rule, and it's a false positive if the system blocks the source IP. The host will stop communicating with the internet, and the user will be calling your boss, complaining about you and the firewall. However, if the IPS blocks the single connection that is matching with a rule, maybe the user will notice that a single application or website has stopped working, which has to be better, right?Forwarding caching proxy: This is also known as a web proxy. This service is native to OPNsense; it can be used to cache websites components like JavaScript, Cascading Style Sheets (CSS), images, fonts, and so on. You can also use it to control access to the internet using authentication, block websites with blocklists, make some basic access control lists, and intercept HTTPS/SSL traffic in transparent mode. In Chapter 13, Web Proxy, we will talk about it in detail and present some alternatives maintained by third-party developers such as CloudFence, such as installing and using those alternative plugins. What really matters is the possibility of doing high-quality web filtering using OPNsense, and it is indeed very much possible because of this open source beauty!Virtual Private Network (VPN): The VPN options available in the OPNsense core are IPSec and OpenVPN. Both can be used as site-to-site and client-to-site (also known as roadwarrior) setups to connect a user securely over the internet.

Captive portal: Talking about guest networks and controlling users to join a network, this also applies to the captive portal in OPNsense. This feature can be used with the web proxy to authorize users to use the internet and has widespread usage in hotels, airports, shopping centers, and so on.

Built-in reporting and monitoring tools: These features can help a lot in troubleshooting scenarios. There are real-time and historical graphs, with a friendly user interface, packet capture (also known as tcpdump), and Netflow, and the list is increasing with each new version.

Here are some of the other great OPNsense features:

QoSTwo-Factor Authentication (2FA)OpenVPN IPSecHigh availability (CARP)A captive portalProxyA web filterIDPSNetflow

There are many other features that can be added in OPNsense through plugins, and we will see in detail each core function and some plugins later in this book.

Note

You can obtain a full list of features at https://opnsense.org/about/features//.

Common deployments

OPNsense is very powerful and versatile and can be used in many ways. I'll try to cover the most common deployments, as follows:

Network router: We can use OPNsense as a network router. It even has an option to completely turn off packet filtering, which improves the network throughput a lot, becoming just a network router without firewalling and NAT functions. Without additional plugins, the routing capabilities are minimal, straightforward, and serve well in a small network. Using OPNsense as a simple network router is the same as buying a Cirrus aircraft to fly in the same airdrome forever; you know that you can fly for hundreds of miles but prefer to stay just a mile away from the same runway. As a private pilot, I can't think of anything better than this comparison.Firewall with WAN failover: This is one of the most common deployments – OPNsense as a perimeter or an internal firewall. You can even use it as a cloud firewall, combined with some plugins such as the ZeroTier VPN, which we will explore in detail in Chapter 8, Virtual Private Networking. A firewall without additions will cover network Layer 3 and 4 packet filtering, and only that! In this scenario, it will probably be used to block untrusted packets from an external network. It can also be used to port forwarding (NAT and PAT) and block outgoing packets that aren't allowed to leave the LAN. When more than one WAN is available, it is possible to enable failover and outbound load balance to ensure good availability of internet access.I[DP]S: Whether combined or not with the firewall function, OPNsense can be used as a great network IDS or IPS, alerting and blocking (with the IPS turned on) packets from the monitored networks. The Suricata implementation in OPNsense is very well rounded, and with suitable hardware, you can achieve a few gigabits per second of throughput. Guest network wireless gateway (a guest network): With a captive portal enabled, you have a lot of control over a guest network. You can combine a firewall, WAN failover, an IPS, and a web proxy with the captive portal to build a robust solution.VPN server: OPNsense has excellent support for Certificate Authority (CAs) and certificates, users, and group management, locally and externally, and you can, for example, use it as a robust OpenVPN server solution for hundreds and maybe thousands of simultaneous users, using proper hardware. It will cover two-factor authentication and many features that can be enabled to work with a VPN, such as web filtering and DNS filtering.Web proxy and filtering: Using Squid as the web proxy server, OPNsense can act as a powerful web proxy and web filter. As a well-known and ubiquitous web proxy service, Squid allows you to do web proxying in transparent or explicit modes, HTTPS/SSL intercepting, web filtering with an external categories database, and so on.

There are other possible deployments, such as a web application firewall, a next-generation firewall, an advanced network router, a DNS filtering appliance, and Software Defined WAN (SD-WAN). It's not possible to cover all the possibilities in one book, but we will explore the most common ones in the following chapters.

Where to get help?

Have you had trouble or don't know how to use a feature? Didn't understand what the official documentation says? Take it easy! We are a big and strong community, and someone in it will try to help you for sure!

Some facts

While selling OPNsense-based firewall solutions in comparison to commercial firewall closed-source solutions, customers commonly ask us a question such as, "Okay! It seems that this open source solution you are offering in your service can do anything that other closed source commercials listed in the 'some magic geometrical guide' (which I will not mention the name of here) solution can do, but what about support? When we need support or an urgent security fix, who are we going to call?" Our answer? "Not the Ghostbusters!"

Okay, just kidding – but let me tell you about some of the myths that the closed source firewall vendors teach customers about open source support and how to answer them!

Open source has no professional support: So, let me tell my story – I've been paying my bills for almost the last 15 years by offering professional support! Deciso is the company that founded and maintained the OPNsense project, and it is a company, not just a couple of genius guys (although there are genius guys there too)! But they are doing an outstanding job as a company! They provide professional services, hardware, and so on. If we look at the open source world, we can see many companies providing support and, making money. Yes, you can make money with open source! Just search on Google for open source professional support, and you will see that it is not a rare service.Security fixes/software improvements: Some commercial vendors fail to perform quick security fixes – you can find some examples on Google; some took more than a year to fix a known vulnerability. However, if you repeat the search and use OPNsense as an example, you will see that security fixes are done quickly! Talking about the software improvements, let's suppose your customer asks you about custom features. Try to ask a big vendor to know if you even will be heard! Probably not! I know what I'm talking about, and I used to work with them a long time ago! With an excellent open source project such as the OPNsense project, you can ask (open an issue) or even write code and submit it on GitHub (a pull request). Most of the time, you will be heard, and sometimes after a lengthy discussion and code review, the community will probably accept it! Again, I know what I'm talking about!

So, after this introduction, let's see where else we can find help:

OPNsense docs: The OPNsense documentation is incredible! You will probably find there a lot of answers to your questions already. So, before you start typing questions anywhere, read the docs!Official forum: Always search first in the forums for questions like the one you intend to ask. Maintaining a helping platform, such as a forum, demands a lot of work, so please respect that and avoid duplicating questions. I'm not against WhatsApp or Telegram groups, but they aren't the best medium to get help. Think about it – if you just arrived in one of those groups, you can't see the message history, so all of the effort done before answering questions like yours is lost. Some of my OPNsense course students often ask me about those groups, and I always say, "No! And I wouldn't!" and discourage them from using those groups as a trusted source of information. Please prefer using the official forum!IRC: There is an OPNsense channel on IRC Libera (https://web.libera.chat/#opnsense), and you can chat about it there! Commercial support: Suppose you are in a hurry or have some critical issue and can't wait for the community to answer. In that case, you can count on the commercial support provided by several reliable companies that support the OPNsense project. As we discussed in this section, there are many ways to get help with OPNsense, maybe more than some of its commercial competitors; this is the advantage of an open source project. You can always count on the community and the companies that support it and are not left with just one option!

This brings us to the end of the chapter, which has provided an overview of OPNsense.

Summary

In this chapter, you were introduced to OPNsense, its project history, versions, and the improvements made by pfSense and m0n0wall. I also shared a little bit of my history with you and why I decided to use it, with some examples. We learned about FreeBSD and what it is and is not, and about its hardened fork, HardenedBSD. We explored the OPNsense core features and typical deployments, with some examples of how you can deploy them in your network environment. Finally, we dived into support options and how to use each of them. Now that we know how OPNsense works, we can find help if needed, which versions are available, and the most common scenarios to deploy it. We will now move on to the following chapters, which will help you better understand some of the concepts discussed in this chapter more practically. In the next chapter, we will see how to install OPNsense and explore some of its features!

Chapter 2: Installing OPNsense

This chapter will be more hands-on than the first one. We will see how to install OPNsense on VirtualBox, update it, install plugins, access it from Secure Shell (SSH) and a command-line interface (CLI), and explore FreeBSD packages.

In this chapter, we will cover the following topics:

Versions and requirementsDownloading and installing OPNsenseUpdates and pluginsSSH and CLI accessFreeBSD packages

Technical requirements

You will need VirtualBox, VMware, Parallels, Qemu, or another hypervisor installed and basic knowledge of a virtual machine installation to follow the instructions in this chapter. You also will need an SSH client installed on your host machine.

Versions and requirements

To start to talk about the installation process, we first need to know more about the OPNsense versions. First of all, it is important to know that in this book, we'll focus on the Community edition. The OPNsense Business edition has some advantages for those who want to be more selective in the upgrade path, as the official documentation defines it.

Versioning

As I briefly mentioned in the first chapter, the OPNsense versioning is very simple to understand. At the time of writing this chapter, the current version is 22.1, but what does it mean?

The first part, before the dot, is the Year of the version release: 2022.

The second part, after the dot, is the Month: January (1).

In the Community edition, the versions are always released in January (1) and July (7) every year. So, for example, the next version will be in January 2022: 22.1.

But what about the Business edition? Well, the first version released this year was the 22.4 version. The next one, according to Deciso, will be in October: 22.10.

In this way, it's easy and predictable to know and plan when you will need to upgrade your OPNsense firewall. While managing firewalls, it is important to have a plan to apply security fixes without compromising network availability.

As we discussed in the last chapter, this is the firmware flavor we have:

OpenSSL: The default and most used and supported flavor. This flavor uses the OpenSSL TLS/SSL toolkit.

As I mentioned in the last chapter, if you don't have any special reason to choose LibreSSL, maybe it's better to pick the default one, OpenSSL, which we'll use in this book.

Hardware

OPNsense will install on most modern x86-based hardware, but it is important to understand some concepts before installing your future firewall. We will explore the minimum requirements to install it, how to choose a good network card, and how to choose the right install image depending on the kind of disk you want to use.

Architecture

Since version 20.1, i386, also known as Intel 32 - bit architecture, was dropped, the only currently supported architecture is x86-64 or amd64 while choosing on the Download page.

Disk

If you are installing on a disk or media with limited write cycles, such as SD or CF memory cards, then it's better to choose the nano image. OPNsense will write a lot of logs on disk and it isn't a good idea to use media with limited write cycles, as it will very quickly damage disk media that wasn't designed for that. So, the nano image will by default mount the /var and /tmp directories to a RAM disk. The same can be done with other images, such as DVD, VGA, or Serial. Let's talk about them here:

nano: To install OPNsense using the nano image, you will need a USB stick and an SD or CF card with at least 4 GB capacity. The main console will output in the serial console port in 115.200 bps mode. If the hardware you are using doesn't have a serial port, you can still use the VGA console, but without the output of kernel messages. After being installed, it will expand the filesystem automatically to the disk capacity.DVD: This is the ISO burnable installer image that contains a live system and the installer; we must have hardware with a display card to install OPNsense using this image. We can use it to install in a virtual machine environment too – we'll use this one in this chapter to describe the installation process.VGA: This is almost the same as the DVD with the difference that it is intended to be used on USB media.Serial: This is