{"id":818,"date":"2025-01-20T02:10:48","date_gmt":"2025-01-19T20:40:48","guid":{"rendered":"https:\/\/www.lguruprasad.in\/blog\/?p=818"},"modified":"2025-01-20T23:20:41","modified_gmt":"2025-01-20T17:50:41","slug":"how-i-replaced-my-home-firewall-with-an-x86-opnsense-setup","status":"publish","type":"post","link":"https:\/\/www.lguruprasad.in\/blog\/2025\/01\/20\/how-i-replaced-my-home-firewall-with-an-x86-opnsense-setup\/","title":{"rendered":"How I replaced my home firewall with an x86 OPNsense setup"},"content":{"rendered":"\n

I have been working remotely for the past 6+ years, and my wife has been working remotely for the past few years. So we have 2 internet connections at our home, with one configured as a primary and the other as a backup on the TP-Link ER605 load balancer. The load balancer is configured to fail over automatically to the backup connection when the primary connection goes down.<\/p>\n\n\n\n

In our home, we have run Ethernet cables through the walls and provided one port in each of the rooms and living rooms. All these cables terminate at a central location in the hub in a switch and then go through a firewall router to the load balancer and to the internet. The high-level view of this setup looks like the following diagram.<\/p>\n\n\n\n

\"A<\/a>
A high-level diagram of my home network and how it connects to the internet<\/figcaption><\/figure>\n\n\n\n

As shown in the above diagram, I also have a Pi-hole<\/a> instance that acts as the DHCP and DNS server for my home LAN. It works well to provide network-level ad-blocking services for all devices in the LAN. However, some devices, Android devices in particular, often ignore the DNS server provided by DHCP and use the hard-coded Google DNS instead, bypassing ad-blocking. Even that is okay in many cases, except a few. We have a Sony X90H smart television that runs the Android TV operating system. Without network-level ad-blocking, it shows a lot of non-dismissible advertisements for content from apps that we haven’t installed or used. So I have always used a firewall device of some sort to force the usage of Pi-hole as the DNS server in my LAN. I have done this in the past with a Netgear Nighthawk R7000 router running the FreshTomato firmware<\/a>, a Seeed Studio reRouter, and a GL.iNet Beryl AX travel router since last evening.<\/p>\n\n\n\n

Speaking of that, the reRouter device, which I have used for 2+ years now, has been crashing and boot-looping frequently in the past few months and causing internet disconnections. I have been planning to replace that with a more reliable and powerful x86 mini-PC with OPNsense<\/a> on it. I ordered the Skullsaints Onyx Intel 12th Gen N100 Mini PC <\/a>last night for this new project. This was an easy choice since I have been hearing good things about N100 mini PCs on the Late Night Linux<\/a> family of podcasts. While I waited for the delivery, I set up the GL.iNet Beryl AX travel router as a stop-gap replacement. <\/p>\n\n\n\n

\"\"<\/a>
Skullsaints Onyx Mini PC<\/figcaption><\/figure>\n\n\n\n

I bought this specific product because it has 4 2.5G Ethernet ports, which would allow me to do internet load balancing too in the future and simplify my networking setup. It came with a no-name brand 256 GB M.2 NVMe SSD preloaded with Windows 11 Pro and 8 GB of RAM. As I had read reviews about this device heating up due to lack of\/dried thermal paste, I checked and confirmed that the thermal paste was intact.<\/p>\n\n\n\n

Then I downloaded the latest OPNsense image, dd<\/code>‘ed it to a USB flash drive and installed it on this device. Then I opened up the OPNsense web interface and went through the setup wizard to configure the firewall. When I installed it in place of my previous firewall, nothing worked and I had no idea why. I took help from the friendly folks on the #OPNsense<\/code> IRC channel on libera.chat to correct my mistakes and get the configuration working the way I wanted it to. Below are the details of how I did it.<\/p>\n\n\n\n

\"OPNsense<\/a>
General System Information configuration<\/figcaption><\/figure>\n\n\n\n

In the above page, I configured the hostname, domain and the DNS servers used by OPNsense. I specified 192.168.2.3<\/code>, the IP address of my Pi-hole instance, as the primary DNS server and added the Google DNS address as the secondary. Even though it wasn’t necessary, I left the built-in Unbound resolver enabled.<\/p>\n\n\n\n

\"OPNsense<\/a>
Time Server configuration<\/figcaption><\/figure>\n\n\n\n

I configured my timezone in this page.<\/p>\n\n\n\n

\"OPNsense<\/a>
WAN interface configuration<\/figcaption><\/figure>\n\n\n\n

This page had a lot of options for configuring the WAN interface (I will need to revisit these when doing the multi-WAN load balancer setup in the future). I set up a static IP for the WAN interface in the 192.168.0.0\/24<\/code> subnet, since that is what I had used in the previous setup. I also disabled the blocks for accessing RFC1918 networks and bogon networks (this was not necessary) from the WAN-side, since this device doesn’t directly connect to the internet.<\/p>\n\n\n\n

\"OPNsense<\/a>
LAN interface configuration<\/figcaption><\/figure>\n\n\n\n

In this page, I configured the LAN interface address to be the same as what I had in the previous setup. In the following page, I configured the root password and completed the wizard to apply the configured changes. With this setup, I had a working router between my LAN and the load balancer. <\/p>\n\n\n\n

Since the metal top of the mini PC’s case acts as a passive heat sink, I could feel it getting very hot even though the OPNsense thermal sensors showed a low, static temperature. I will monitor this in the coming days to make sure that there are no thermal issues.<\/p>\n\n\n\n

I still had to configure the firewall to force redirect all outgoing DNS requests to the local Pi-hole server, the details of which I will share in the next blog post \u2014 Redirect all outgoing DNS requests to the local Pi-hole instance using OPNsense<\/a>.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

I have been working remotely for the past 6+ years, and my wife has been working remotely for the past few years. So we have 2 internet connections at our home, with one configured as a primary and the other as a backup on the TP-Link ER605 load balancer. The load balancer is configured to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[12,16,389,321,286],"tags":[387,388,386,390],"class_list":["post-818","post","type-post","status-publish","format-standard","hentry","category-foss","category-internet-2","category-opnsense","category-self-hosting","category-technology","tag-firewall","tag-intel-n100-mini-pc","tag-opnsense","tag-pi-hole"],"_links":{"self":[{"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/posts\/818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/comments?post=818"}],"version-history":[{"count":10,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/posts\/818\/revisions"}],"predecessor-version":[{"id":845,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/posts\/818\/revisions\/845"}],"wp:attachment":[{"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/media?parent=818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/categories?post=818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lguruprasad.in\/blog\/wp-json\/wp\/v2\/tags?post=818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}