There are a lot of options available for firewall software. You can build from scratch using a Linux or BSD base, hand setting the firewall rules. You can use pre-built FOSS packages on top of a Linux/BSD base. There are many complete firewall distros that you can run off a thumb drive and/or install.There are commercial offerings, as well.

I went with OPNsense, which is based on FreeBSD. It is available in a FOSS community version and a commercial subscription offering. This was mainly due the collectively higher ranking it has on various review sites, and I had previously experimented with it. I settled on the community version, because this is for my home network and I didn’t need the support and additional options that the business edition offered (nor the added expense).

The installation follows the typical rules: Download the image you want. Burn it to a flash drive. Boot off the flash drive.

Once booted, you are running the firewall software. The console (serial or video) gives you some options for selecting the LAN and WAN ports (if the automatically selected ports don’t match your vision) and assigning other ports if immediately needed. After this very basic configuration, the firewall is active with only the LAN port given access thru the firewall to the internet and to the web interface. All other ports are put into a default deny state. You are then presented with a standard looking *nix login prompt with some simple instructions given for login options. Depending on the username used for login, you can either continue to run off the thumb drive, or you can install to hardware. I installed to hardware, after which I accessed the built in web server for configuration and monitoring.

I won’t bother going through the configuration steps in detail as there’s plenty of documentation available, but I will touch on some of the problems I had to overcome.

In my setup, I have the several networks I mentioned earlier:

• WAN
• LAN, my main, general use network where I have a local CA, DNS, pihole, and local web servers.
• IoT network with a further isolating wireless router that the IoT devices connect to.
• External services network for my web server and such.
• ADU network with isolating wireless router that the devices in the ADU will connect to.
• My test/lab/play network.
• Two spare ports for future fun.

Generically, I don’t want anything on the non-LAN networks being able to initiate communications to things on my LAN network, but I do want to be able to reach devices on the other networks from my LAN for maintenance and troubleshooting.

The reason for the isolation wireless routers is that I don’t want things I didn’t trust having direct access to my main firewall, whether or not the configuration web page could be access or not. Its mainly me being somewhat security paranoid about dubious IoT devices, and computers I don’t control. It’s not foolproof, but what is? And the WAN is connected to the internet with all types of dubious computers and actors behind them, then you add the LLM scrapping machines… Well, there’s only so much one can do with limited funds and knowledge,

Having the isolation routers means setting up gateways and routes to get to the devices behind them. This wasn’t quite as straight forward as I thought it could be: First you need to define your gateways by the next hop address. Then you define your static routes to the isolated networks using those gateways.

As for my external services, setting up the NATs and WAN ingress rules was different that I was used to. Here, the NAT is applied first, and the ingress rule works on the NAT’ed address. I was used to the opposite: first ingress rule then NAT. My previous router also handled the LAN to external services network seamlessly. Here, I had to add separate NAT rules for it.

The other major headache I had was getting DDNS working. OPNsense has a plugin for DDNS, but it didn’t have a predefined selection for my DNS vendor. This meant much experimenting with the “custom” vendor options, URIs, DDNS vendor tokens, etc. Add to the fact that passwords/tokens have to be re-entered every time the DDNS config is modified was a pain, but I eventually figured it out by trail and error, plus some API examples ran by hand to figure out what actually worked.

A minor issue I had was getting the ACME plugin to talk to my internal self hosted Certificate Authority, so it could issue certs to the firewall. It’s a multi-step process that wasn’t as obvious as I hoped, but I didn’t want to keep seeing the annoying “Your connection is not secure!” messages when connecting the firewall’s login page.

Also, the method of assigning firewall rules changed since the last time I used OPNsense, so I need to learn the new stuff.

The above would have probably been much easier if I has RTFM’d the manuals and other documentation beforehand. What can I say, I’m not the sharpest claw on the paw.

In any case, it’s in and working, so yay!!!

Next thing I want to do is add a MitM proxy for my IoT network, so I can intercept traffic to and from it. But that’s a later project.

Hope you enjoyed this little writeup!