2.3 OPNsense platform

OPNsense will serve as the secure entry point to the C2 environment. As an open-source firewall and router, it sits at the edge of the network and manages how traffic enters, leaves, and moves between internal segments. This makes it a key control point for enforcing network segmentation, restricting communication between systems, and reducing unnecessary exposure across the environment. Where needed, OPNsense can also provide core network services such as DNS and DHCP, helping centralize basic infrastructure functions.

When combined with OpenVPN, OPNsense also enables encrypted remote access, allowing authorized users to connect to the environment securely from outside the network. In this section, you will deploy OPNsense and begin its initial configuration. Later in this module, you will finalize the configuration and set up services like OpenVPN.

2.3.1 Deploy OPNsense server

In this step, you’ll install the OPNsense VM on Proxmox VE.

1. Download the OPNsense ISO (image type: dvd) and unpack the file (e.g. with 7-Zip). In the course version 26.1.2 is used.

   
   

2. Upload the ISO in PVE: Datacenter ➜ pve ➜ local(pve) ➜ ISO Images, click Upload, select the OPNsense ISO and click Upload.

   
   

3. Create a new VM (click Create VM in the top-right) with these specs:

   • General ➜ Name: OPNsense

   • General ➜ VM ID: 100

   • OS ➜ Storage: local

   • OS ➜ ISO image: (select the OPNsense ISO)

   • OS ➜ Type: Other

   • System ➜ Graphic card: Default

   • System ➜ Machine: q35

   • System ➜ BIOS: SeaBIOS

   • System ➜ SCSI Controller: VirtlO SCSI single

   • Disk ➜ Bus/Device: SCSI

   • Disk ➜ Storage: local-lvm

   • Disk ➜ Disk size (GiB): 40

   • Disk ➜ Cache: Write back

   • Disk ➜ Discard: enable if youre using SSD/NVMe

   • CPU ➜ Sockets: 1

   • CPU ➜ Cores: 2

   • Memory ➜ Memory (MiB): 4096

   • Network ➜ Bridge: vmbr0

   • Network ➜ Model: VirtIO (paravirtualized).

   • Network ➜ Firewall: enabled

   • Confirm ➜ Finish

   
   

4. Add the other three NICs to the OPNsense VM. Go to Datacenter ➜ pve ➜ 100 OPNsense ➜ Hardware ➜ Add ➜ Network Device, add the below bridges and select VirtIO (paravirtualized) as the model (if prompt, click Apply Configuration to activate the added NICs).

   • vmbr10

   • vmbr20

   • vmbr30

5. Start OPNsense VM and log in with the default credentials: root : opnsense.

   
   

6. To ensure the VM boots from the installed disk (not the live ISO), choose option 8) Shell and run: opnsense-installer.

   
   

7. In the installation wizard, select: Continue with default keymap ➜ Install (ZFS) ➜ select Stripe ➜ tick disk and confirm (installation starts) ➜ Confirm and exit ➜ Reboot.

   OPNsense should now boot from the hard drive and not from the ISO.

2.3.2 Configure OPNsense part 1

In this step, you’ll complete the baseline OPNsense configuration.

1. Open the OPNsense VM console in PVE and log in with the default credentials: root : opnsense

   
   

2. Select option 3 Reset the root password and set a new, strong password for the root account.

   
   

3. Select option 1 Assign interfaces ➜ N (no LAGGs) ➜ N (no VLANs) ➜ assign interfaces as below ➜ y (proceed):

   • WAN: vtnet0

   • LAN: vtnet1

   • Optional interface 1 (OPT1): vtnet2

   • Optional interface 2 (OPT2): vtnet3

   
   

4. Select option 2 Set interface IP address and configure each of the following interfaces:

   • LAN (vtnet1 - interface 1) (CLIENTS): 10.10.10.1

   • OPT1 (vtnet2 - interface 2) (SENSITIVE): 10.10.20.1

   • OPT2 (vtnet3 - interface 3) (MGMT): 10.10.99.1

   For LAN, OPT1, and OPT2 follow this sequence:

   1. Select the interface number: 1 (LAN), 2 (OPT1), or 3(OPT2)

   2. Configure IPv4 via DHCP: N (No)

   3. Enter the IPv4 address for the selected interface (see the list above). For example, for interface 1, enter 10.10.10.1.

   4. Enter the CIDR prefix length: 24

   5. Enter the IPv4 upstream gateway for this interface: leave blank (no IPv4 gateway for LAN).

   6. Configure IPv6 via WAN tracking: n (No)

   7. Enable DHCPv6 server on this interface: N (No)

   8. Enter an IPv6 address: leave blank (no IPv6).

   9. Enable the DHCP server on this interface: y (Yes)

   10. Provide the DHCP range, for example:

       • LAN (vtnet1) (CLIENTS): 10.10.10.10 - 10.10.10.100

       • OPT1 (vtnet2) (SENSITIVE): 10.10.20.10 - 10.10.20.250

       • OPT2 (vtnet3) (MGMT): 10.10.99.10 - 10.10.99.100

   11. Revert to HTTP as the web GUI protocol: N (No)

   12. Generate a self-signed web GUI certificate: y (Yes — do this only once) / N

   13. Restore the web GUI access defaults: N (No).

   Note: Repeat this step for LAN, OPT1 and OPT2 interfaces. The WAN interface receives its IP address via the (corporate) edge router (either through external DHCP or a static assignment).