Setting up an OPNsense Firewall

For the last several years, my home router was an older Asus router, that I had flashed Fresh Tomato firmware on. Fresh Tomato is a really good set of firmware for older Broadcom (802.11ac or older) based routers, giving you a lot of options for setting up different subnets on different ports, wireless, and isolating/being selective of traffic between them. I ran into one problem though: I ran out of ports.

You might be asking, “Beta, how did you run out of ports? Couldn’t you’ve just added a switch and chain that to a port?”

Well, I like to segregate my network: I have my main LAN network, which is for normal stuff. I have a different network for boxes that run my external services (like this blog). I have yet another network for my IoT devices that I don’t trust (webcams, weather station, etc., which is further isolated behind another Fresh Tomato router). And lastly, a network for play/lab stuff that I don’t really want interacting with anything else but the outside world. So all total, if I included the WAN port, that’s using all the ports on the Asus router. Enter the need for yet another isolated network.

My mother-in-law will be moving into a standalone Auxiliary Dwelling Unit (ADU) we’re having build (which is another tale to tell), and wanting to respect her privacy (and not knowing how sharp she is about clicking links), I wanted to her to have her own segment and access point. So now I need six ports.

I could’ve setup a managed switch I have with VLANs, and do a “router on a stick” setup, but that would have meant I wouldn’t have had an excuse to buy a new mini PC for a new firewall!

Next: The mini PC.