Firewall Security with OPNsense
OPNsense started as a fork of pfSense® and m0n0wall in 2014, with its first official release in January 2015. The project has evolved very quickly while still retaining familiar aspects of both m0n0wall and pfSense. A strong focus on security and code quality drives the development of the project.
OPNsense offers weekly security updates with small increments to react to new emerging threats within a fashionable time. A fixed release cycle of 2 major releases each year offers businesses the opportunity to plan upgrades. For each major release, a roadmap is put in place to guide development and set out clear goals.
OPNsense is an open-source, easy-to-use, and easy-to-build FreeBSD based firewall and routing platform. OPNsense includes most of the features available in expensive commercial firewalls and more in many cases. It brings the rich feature set of commercial offerings with the benefits of open and verifiable sources. Local development, local setup, local support by WEbSoftPC for the greater Sacramento, California area. Please call (916)300-6333 for details.
The feature set of OPNsense includes high-end features such as forward caching proxy, traffic shaping, intrusion detection, and easy OpenVPN client setup. The latest release is based upon FreeBSD 11 for long-term support and uses a newly developed MVC-framework based on Phalcon.
OPNsense’s focus on security brings unique features such as using LibreSSL instead of OpenSSL (selectable in the GUI) and a custom version based on HardenedBSD.
The robust and reliable update mechanism gives OPNsense the ability to provide important security updates quickly.
OPNsense Core Features
- Traffic Shaper
- Two-factor Authentication throughout the system
- Captive portal
- Forward Caching Proxy (transparent) with Blacklist support
- Virtual Private Network (site to site & road warrior, IPsec, OpenVPN & legacy PPTP support)
- High Availability & Hardware Failover ( with configuration synchronization & synchronized state tables)
- Intrusion Detection and Prevention
- Build-in reporting and monitoring tools including RRD Graphs
- Netflow Exporter
- Network Flow Monitoring
- Support for plugins
- DNS Server & DNS Forwarder
- DHCP Server and Relay
- Dynamic DNS
- Encrypted configuration backup to Google Drive
- Stateful inspection firewall
- Granular control over state table
- 802.1Q VLAN support
OPNsense offers a dashboard feature to check the status of your OPNsense Firewall quickly. Shown is the latest version with drag and drop multi-column support.
Modern User Interface
The modern user interface offers a great user experience with multi-language support, built-in help, and quick navigation with the search-box.
Shown is the fast search navigation option.
A stateful firewall is a firewall that keeps track of the state of network connections (such as TCP streams, UDP communication) traveling across it. OPNsense offers a grouping of Firewall Rules by Category, a great feature for more demanding network setups.
Aliases & GeoLite Country Database
Managing firewall rules have never been this easy. By using Aliases, you can group multiple IPs or Host into one list, to be used in firewall rules. Additionally, IP or Hostnames can be fetched from external URLs; examples are DROP (Do Not Route Or Peer), Abuse.ch’s Ransomware tracker, and the build-in Maxmind GeoLite2 Country database.
Traffic shaping within OPNsense is very flexible and is organized around pipes, queues, and corresponding rules. The pipes define the allowed bandwidth; the queues can be used to set a weight within the pipe, and finally, the rules are used to apply the shaping to a certain package flow. The shaping rules are handled independently from the firewall rules and other settings.
Two-factor authentication, also known as 2FA or 2-Step Verification, is an authentication method that requires two components, such as a pin/password + a token. OPNsense offers full support for Two-factor authentication ( 2FA ) throughout the entire system utilizing Google Authenticator.
Supported 2FA services include:
- OPNsense Graphical User Interface
- Captive Portal
- Virtual Private Networking – OpenVPN & IPsec
- Caching Proxy
Captive Portal allows you to force authentication or redirection to a click-through page for network access. This is commonly used on hot spot networks but is also widely used in corporate networks for an additional layer of security on wireless or Internet access.OPNsense offers most enterprise features, including Radius and voucher support.
Virtual Private Network – IPsec & OpenVPN GUI
OPNsense offers a wide range of VPN technologies ranging from modern SSL VPN’s to well known IPsec as well as older (now considered insecure) legacy options such as L2TP and PPTP. Site-to-Site and road warrior setups are possible, and with the integrated OpenVPN client exporter, the client can be configured within minutes. Looking for an IPsec or OpenVPN GUI? You just found something better!
High Availability / Hardware Failover (CARP)
OPNsense utilizes the Common Address Redundancy Protocol or CARP for hardware failover. Two or more firewalls can be configured as a failover group. If one interface fails on the primary or the primary goes offline entirely, the secondary becomes active. Utilizing this powerful feature of OPNsense creates a fully redundant firewall with automatic and seamless fail-over. While switching to the backup network connections will stay active with minimal interruption for the users.
The caching proxy offered by OPNsense is fully featured and includes category-based web-filtering, extensive Access Control Lists, and can run in transparent mode. The proxy can be combined with the traffic shaper to enhance the user experience. Integration with most professional Anti-Virus solutions is possible through the ICAP interface.
Intrusion Detection & Prevention
The inline IPS system of OPNsense is based on Suricate and utilizes Net-map to enhance performance and minimize CPU utilization. This deep packet inspection system is compelling and can be used to mitigate security threats at wire speed.
Integrated support for ET Open rules.
The ETOpen Ruleset is an excellent anti-malware IDS/IPS ruleset that significantly enhances users with cost constraints to enhance their existing network-based malware detection.
Integrated SSL Blacklist (SSLBL)
A project maintained by abuse.ch. The goal is to provide a list of “bad” SSL certificates identified by abuse.ch to be associated with malware or botnet activities. SSLBL relies on SHA1 fingerprints of malicious SSL certificates and offers various blacklists.
Integrated Feodo Tracker
Feodo (also known as Cridex or Bugat) is a Trojan used to commit e-banking fraud and steal sensitive information from the victim’s computer, such as credit card details or credentials. At the moment, Feodo Tracker is tracking four versions of Feodo.
SSL Finger Printing
The IPS option to allow user-defined rules include the option for SSL fingerprinting. With this option, SSL communication can be blocked at the initial connection attempt by dropping the SSL key exchange.
Backup & Restore
Better safe than sorry, always keep an up to date backup of your configuration. It’s easy with OPNsense.
Automatic backups of configuration changes make it possible to review history and restore previous settings.
Easily download a backup from within the GUI and store it in a safe place.
Encrypt the backup with a strong password and make the plain text unreadable for unauthorized persons.
Upload your configuration backup file and restore it with ease.
OPNsense supports encrypted cloud backup of your configuration with the option to keep backups of older files (history). For this purpose, Google drive support has been integrated into the user interface.
Reporting & Monitoring
OPNsense offers many options for reporting and monitoring the system. These include:
A modern take on RRD graphs with the option to zoom in and export data.
Use your favorite net-flow analyzer to see the most active users, interfaces, ports & applications.
Insight – Integrated Netflow Analyzer
OPNsense also offers an integrated Netflow analyzer without the need for additional plugins or tools, similar to what you may find in high-end commercial products.
Firmware & Plugins
Offering a robust firmware upgrade path to react to emerging threats in a fashionable time, OPNsense is equipped with a reliable and secure update mechanism to provide weekly security updates. A plugin mechanism can be used to install additional packages and customizations.