Ultimate Beginner's Guide to OpnSense - Installation - Part 1 

Thanks 👍

Thanks, you too!

Thanks. I cover that in the second video, it's pretty straightforward.

Thanks, appreciate the feedback.

Thanks 👍

Thanks. I've provided examples of those in the next video (out soon). You can then replicate the process for all of your services.

You're welcome 😁

@@joblow3638 ok, thanks for clarifying. I'll have a read.

Thanks 👍 on rare occasions the mirrors go down. More likely it's DNS. In system settings, change DNS to 1.1.1.1 and 8.8.8.8 to rule anything out.

Good morning ,thank you for the reply.I will change DNS as mentioned. Thank you very much.

Thanks, and good to know!

Thanks, I'll look into that for performance tweaks

@@Jims-Garage I think that's only necessary for router VMs though, not sure

Yes, you'll like this one I think

Thanks 👍

You're welcome

Thanks 👍

What if you are just using 2.5 gb nice found in Beelink EQ12 with 16gb ram?

@@thestreamreader 2.5 and 5gig works fines. The 10gig nics are for the business environment which I configured for the company I work for. I currently have similar setup at home and use 2.5gb. Sorry if I didn't state that upfront

@@thestreamreader 2.5 Gb is absolutely fine.

*major

Hey, thanks for the compliments and the membership - much appreciated. If you want to run RoaS with 1 physical NIC you can do, nothing wrong with that. I simply prefer having my firewall doing both the WAN and the LAN.

Thanks 👍 it will help with the realtek support issue (provided the host also can use it properly)

I believe it's randomly assigned on boot (might be PCIe order). You do have the option to change during installation iirc. VM makes life easier as you can flip the virtual mac addresses.

@@Jims-Garage Interestingly, I have installed it few times following your great video (don't ask :D), and it always got it right. Yes, later I have experimented and relocated, but it is interesting (at least to me) how it get it right. Probably by accident.

I'll take a look at it. I personally use Kubernetes for WireGuard.

@@Jims-Garage ok thanks

Oops! Good spot, I'll have to rectify that in the next video. At least functionally it won't matter as we're setting the Lan interfaces separately.

I don't like doing passthrough if I can help it, it prevents many of the benefits of being a VM. I'm able to saturate a 10GB NIC using a virtual adapter, there will be some slight overhead but it's extremely efficient and worth the tradeoff for flexibility. Installing QEMU agent could be useful for monitoring and better shutdown but it's not essential. It's not the same as VirtIO drivers.

Thanks. Purely for demonstration (it's how my network is setup, I use Sophos XG. I didn't want to have to replace it just for the video). It should go to ISP -> Opnsense

Hey great video, I’m confused about the physical connections. ISP -> OPNsense makes sense to me however how do we maintain internet/GUI access to Proxmox @@Jims-Garage

Wan to router, and Lan to switch (typically).

Hey, thanks. I don't actually have one, all my devices are 1Gb or 10Gb (i350 and connectx-3). My understanding is that i225 is bad, i226 is good, but I've no real world experience.

Thanks 👍 feel free to become a RU-vid member on my channel if you'd like. Hit the join button on my channel homepage

The beauty of a VM is you can scale to your needs. Try 2 and up if necessary.

Thanks didn't want to waste my time if 2 were going to not work from the start. Comment on ballooning was nice. Looking forward to the second video

Thanks. You'll need to add another PCIe card for more network interfaces. That should open up plenty of options.

@@Jims-Garagethanks for the patient response. Rewatching this and realize you clarify this in the video lol

Just for clarification, if have two ports only. One would be used as the WAN port for OPNsense and the other would be the Lan port for OPNsense and all of proxmox?@@Jims-Garage

Pretty much because OpnSense was more popular with my subs, plus there is still some lingering negative sentiment around what pfSense did. I'll likely cover it in the near future.

@@Jims-Garage Thanks. I have been running pfSense since 2017. I am in my 60's now and have learned to be careful from the extra offerings, as they always have a catch. Since I am running the CE edition and I have so much time and knowledge invested, switching is not suitable option. I can understand the frustration. Several years back I switched from Cisco SMB managed switches SG-2xx/3xx to the Unifi. After the learning curve was over, I had 6 months of stable network. Then, it was nothing but issues. Too much to write to explain all the issues. I had two friends who also switched to the Unifi and they had issues as well. Some the same and some different. After 2 months of trying to fix the issues, ripped it out and put back my Cisco switches and was back to stable and still rock solid stable network. The Unifi had some nice features, but between buggy firmware and system issues and their changes to the cloudkey stuff and security issues. I see a lot of people using that product, but I will never try Unifi again. Thanks for sharing your knowledge with us.

You don't, HA requires 2 OpnSense machines (I think I had a third leftover from testing). Ignore Sophos XG, that's simply the HA solution I use, and I didn't want to have to remove it for making the video (meant it was a little more fun to create ha).

another question: two Opnsense VM on Proxmox Dell. You don't use Opnsense separate Hardware? It 's better to use opnsense on VM or on physical hardware? on Proxmox is only for test, right? i have seen your video with traefik cloudflare to fix, but i have problem with macvlan and firerwall rule on sophos. with tunnel cloudflare, it work well. but after with macvlan, it ' s not work again. i think, because i don't have sophos to make the right rule .... can you help me, to make right. thanks

@@khanhthedag7269 this is purely for demonstration, you would want each VM on a separate physical machine (in most cases). I recommend a VM for all of the advantages it provides.

Is sophos XG better than opnsense firewall? which firewall should i use?

In a purist perspective having dedicated hardware is more secured. However, the cloud is all vietualised and so is most of the world's services. For a homelab a virtual firewall makes a lot of sense, cheaper, easier to migrate, and something to learn.

Thanks for the question, what do you mean "beyond" opnsense? I assume from the internet? If so, I recommend a VPN to connect back into your network, and then access via the local network. If you mean internally, you should be able to access via the IP as long as the correct firewall rules are in place. Happy to discuss more on Discord, it's a lot easier to converse.

In this setup I'm double natted because it's behind Sophos XG, but without that it would be bridged (it was purely for demonstration as I didn't want to rip out Sophos XG). Yes, you're right. I missed the option at 24:08, should be unchecked.

Just by liking it, confuses me to the fact if I m right or wrong to my comments though (haahah) New edit: Oh ok there was an answer after all.

Thanks. That's been on the list to try, I've heard that it's good.

@@Jims-Garage I've enjoyed it so far! My only pain point is I kind of suck at knowing what firewall rules to put up, and it's not a default deny

@@Montagic rule of thumb, if the service doesn't work check the ports and add a rule

ethtool -p eth0 120

No, OpnSense and Sophos XG are next Gen (traffic inspection, ids IPS etc). Proxmox is simply rules.

@@Jims-Garage thanks for quick response. but it can replace the VLAN, DHCP, DNS, Firewall (Allow,Block) part only? I am currently having opnsense with few ovs switches and VLANs. and thinking if this can be replaced. for IPS/IDS I use zeek(bro) in separate VM. and Wazuh as SIEM.

@@Sulaimanzai yes, that could work

Thanks

They're similar, OpnSense was a fork of pfsense due to their licensing/open source fiasco. Since, OpnSense has remained fully open source and I believe has a few more features. Generally more favoured in the homelab community from what I've seen.

What do you want to achieve? In my video I show how to route a subnet over the VPN.

yes i want to route all my ARR suite and qbittorrent trought vpn. can you please indicate name of the video or on link where i can achive this. Thanks. And BTW amazing job! I realy like to watch and learn from you @@Jims-Garage

oh, you men by using opensense? but is there a way to use nordvpn on nordlynx to have better speed and then to route lxc container trought that vm ? i kno i can create openwrt router and do this, but then i will only use openvpn connection, and that one is slow @@Jims-Garage

@@petrut_u3137 it all goes through the firewall anyway so on the firewall is likely the most performant. Openvpn with UDP will saturate the NordVPN connection anyway. You can use WireGuard (nordlynx) but I find it temperamental, check my instructions for how to obtain your key.

It's homelab, give them both a spin. I'm using Sophos XG - that's another solid, and free option.

Hey, thanks 👍 whilst it won't be possible to use DHCP from an upstream router, in my next video I'll show how to reserve IP addresses. That way you can clone your existing IPs behind OpnSense.

@@Jims-Garage Jim, I‘ve rectified my initial posting, as I‘m aware that I cannot use my router‘s DHCP anymore, I only want to maintain the 10.x.x.x range I now have. Looking forward to the next videos. Thanks a lot 🙏

I prefer to have the flexibility of a bridge. Simple migration and upgrades.

I'm not saying that I will, I'm just giving it a whirl.

Could be a few things. Is DHCP enabled on the Lan interface? Can you change the interface type to wan for the ISP router link?

@@Jims-Garage Would that be in proxmox, opnsense, or my ISP router? From what I can see in the ISP router it is enabled.

@@halfthehalfer in OPNSense. Might be worth hopping in the Discord with some screenshots.

@@Jims-Garage That would be very helpful. Do you have a Discord channel? Edit: Found it. Thank you

Nope, that's not necessary. Makes life a lot easier.

No, that setup should work fine. It's very similar to pfSense.

@@Jims-Garage I just read in pfsense there are settings to block bogon addresses or something like that and I was worried it will block this setup... So wasnt sure. Trying to learn this stuff and its not easy!!!

@@neccros007 Shouldn't be an issue. At wors it'll require some configuration on the firewall rules

@@Jims-Garage Which currently I have no clue how to do!! :) I'm just starting on this journey

@@neccros007 I'll cover rules in part 2

Thanks 👍 typically I don't bridge the Lan and WiFi, I put them on separate networks. However, it's something I can cover for those who wish to have a single subnet over both technologies.

Yes. I350v2t4 has 4

Thanks, it's for performance. Everything is backed up to raidz2 on TrueNAS with Proxmox Backup Server (an earlier video).

@@Jims-Garage When you say 'performance' what exactly do you mean?

@@NetBandit70 when testing I had better iops and writes in raid10 vs raidz2 (writes are limited to single drive speed in raidz2 is my understanding).

Hey, start with understanding the basics. The wan is a wide area network, in most cases the internet, this is an untrusted network. Typically you want to put your ISP router into modem only mode, this allows your firewall (in this case OPNSense) to handle the connection and routing. If you're unable to do that, you'll need to plug the ISP router as is into your firewall wan port. This will be double natted but it should be fine. It simply means you would have to port forward on both devices. The reason you have a wan and Lan port is to separate traffic between local and outside. All your local devices connect to the Lan, internet to the wan. This way you control what can enter and leave your network. Hope that helps.

OPNSense is more popular and there's generally bad sentiments around what happened. I might cover it in the future.

Thanks for commenting, honoured to be recommended 😁

Thanks, I'll take a look at that. One of my videos is on restoration, so I can use that as an opportunity to address it.

UFS is fine. Netflix uses it for their CDN to delivery series and movies.

Hmm, I can read it on my phone fine. Ignore that it's in a VM, it was simply to show the installation process which is pretty simple and the same regardless. I do recommend using it Virtually though for all of the benefits it provides.

Are you on crack?

It's beginner I guess