To set up a new OPNsense firewall with minimal configuration while ensuring DNS access for protected devices, configure the LAN interface to use DHCP with static reservations and enable local DNS resolution via Unbound. This approach bypasses external DNS dependencies during initial setup, allowing you to manage the router and test connectivity without complex routing rules or third-party resolvers.
Initial Network Configuration
When you first boot a fresh installation of OPNsense, the system assigns default IP addresses to its interfaces. The WAN port typically receives an IP address via DHCP from your upstream modem or internet service provider, while the LAN port is statically assigned 192.168.1.1/24. To begin, connect a laptop directly to one of the LAN ports using an Ethernet cable. Ensure your laptop’s network adapter is set to obtain an IP address automatically via DHCP.
Open a web browser on the laptop and navigate to http://192.168.1.1. You will be prompted to log in using the default credentials, which are usually user and password. Upon successful login, the system may ask you to change the password immediately. It is critical to create a strong, unique password at this stage to secure the management interface from unauthorized access. Once authenticated, you can proceed to adjust the network settings to ensure stable communication between the firewall and your local devices.
Configuring DHCP and Local DNS
The core of having "almost default" yet functional configuration lies in how the firewall handles name resolution for clients on the local network. By default, OPNsense uses the Unbound DNS resolver. To allow your protected laptop and other devices to resolve domain names without relying on potentially blocked or slow external servers, you must ensure that the DHCP server on the LAN interface offers the firewall itself as the primary DNS server.
Navigate to DHCP Server under the DHCP menu in the left-hand sidebar. Verify that the Enable checkbox is selected for the LAN interface. In the DNS Servers field, ensure that 192.168.1.1 is listed. If the field is empty, type it in manually. This setting tells every device that requests an IP address from the OPNsense box to use the firewall for all DNS queries. This is particularly useful when you want to implement ad-blocking or parental controls later, as all traffic passes through Unbound first.
If you need to assign a fixed IP address to your protected laptop so that it always appears with the same hostname or MAC address, scroll down to the Static Leases section. Click the plus icon to add a new entry. Enter the MAC address of the laptop’s network card and assign a specific IP address within the subnet range, such as 192.168.1.50. This ensures that even if the DHCP lease expires, the device will consistently receive the same address, simplifying future firewall rule creation.
Verifying Connectivity and Resolution
After saving the changes, disconnect and reconnect the Ethernet cable on your laptop to force a renewal of the DHCP lease. You can verify the configuration by opening a command prompt or terminal on the laptop and running nslookup google.com. The response should show that the query was handled by 192.168.1.1. If you encounter issues here, refer to resources on Troubleshooting: Cannot Connect to the Internet to diagnose basic connectivity failures before diving deeper into DNS specifics.
Firewall Rules and Access Control
With DNS resolution working, the next step is to ensure that the laptop can actually reach the internet. OPNsense comes with default firewall rules that generally allow outbound traffic from the LAN to the WAN. However, it is good practice to explicitly define these rules to maintain clarity and security. Go to Firewall > Rules > LAN.
You should see a default rule that allows all IPv4 and IPv6 traffic from the LAN network to any destination. If this rule is missing or disabled, create a new rule. Set the action to Pass, the protocol to any, and the source to the LAN net. The destination should be any. Save and apply the changes. This configuration permits your protected laptop to browse the web, download updates, and communicate with services over the internet.
If you wish to restrict access further, you can add additional rules above the pass-all rule to block specific domains or IPs. For most initial setups, however, keeping the default allow-all rule for outbound traffic is sufficient to get the system operational. Remember that inbound traffic from the internet to your LAN is blocked by default, which provides a layer of security for your protected devices.
Advanced DNS Options with Unbound
OPNsense includes Unbound, a recursive DNS resolver that can perform DNSSEC validation. This feature enhances security by ensuring that the DNS responses you receive are authentic and have not been tampered with. To enable this, go to DNS Resolver under the Services menu. Check the box for Enable and also check DNSSEC. Save the settings and restart the resolver.
This setup ensures that even if your ISP’s DNS servers are compromised or misconfigured, your local network remains secure against certain types of DNS spoofing attacks. It also allows you to view detailed logs of DNS queries in the Status > DNS Resolver section, which can be invaluable for troubleshooting. For more complex scenarios involving multiple VLANs or conflicting hostnames, consider reviewing How to Configure a Gateway's DHCP and DNS to Resolve Hosts with the Same Hostname but Different VLAN Domains for advanced routing strategies.
Frequently Asked Questions
Why can my laptop ping the gateway but not resolve websites?
This indicates that basic IP connectivity is working, but DNS is failing. Check the DHCP settings on the OPNsense LAN interface to ensure that 192.168.1.1 is provided as the DNS server. Additionally, verify that the Unbound service is running under Services > DNS Resolver.
Can I use Google DNS instead of the local Unbound resolver?
Yes, you can override the local resolver by specifying external DNS servers like 8.8.8.8 in the DHCP server settings. However, this bypasses local filtering and DNSSEC validation features provided by Unbound, reducing some security benefits.
What happens if I lose access to the OPNsense web interface?
If you misconfigure the LAN IP or disable the DHCP server, you can still access the console via serial connection or SSH if enabled. Resetting the network configuration requires physical access to the router to reboot into recovery mode or restore a backup config file.
How do I block specific websites for the protected laptop?
You can use the Unbound Domain Blocklist feature under Services > DNS Resolver. Add the domains you wish to block to the list, and Unbound will return a null response for those queries, effectively blocking access without needing complex firewall rules.
Is it safe to leave the default admin password unchanged?
No, leaving the default password is a significant security risk. Always change the password upon first login. Additionally, consider disabling remote access to the web interface and restricting management to the LAN subnet only.