Lock the Firewall Admin Page

A fresh OPNsense install is built to be reachable so you can set it up: the web interface listens on every interface, an anti-lockout rule keeps the LAN side open to it no matter what you configure, and you log in as root with a password. Most people never revisit any of that. The result is a firewall whose own admin page is one of the most exposed services in the house.

The book opens its hardening chapter with this exact scenario. Every zone you create gives the firewall another address, and by default its web interface and any other service it runs answer on all of them. A smart plug on the IoT network should not be able to load the login page of the device that decides what it is allowed to do.

The trap: the default open door

The trap is that the default configuration assumes you are in the same room as the firewall. It assumes you are on the LAN, and it assumes you will remember to lock the door later. The book points out that until you create VLANs (Chapter 3), the existing LAN interface plays the role of the management network. This means the firewall listens on the LAN interface by default, and the anti-lockout rule allows access from anywhere on the LAN.

This setup is convenient for setup, but it is a security risk. The anti-lockout rule is designed to prevent you from locking yourself out of the firewall by mistake, but it is a blanket permission. It allows the web interface from anywhere on the LAN, which means any device on your LAN can attempt to log in. The book warns that a fresh install is built to be reachable, and the result is a firewall whose own admin page is one of the most exposed services in the house.

The fix: move the web interface

The solution is to move the web interface to a dedicated management network and force HTTPS. The book recommends creating an alias for the machines that may administer the network, so every rule can refer to it by name. This makes it easier to manage who has access to the firewall.

Create an alias for the machines that may administer the network, so every rule can refer to it by name. Firewall, then Aliases, add:

Name: ADMIN_HOSTS Type: Host(s) Content: 192.168.10.21 192.168.10.22 Description: Machines allowed to manage network gear

Give those machines fixed DHCP reservations so their addresses never change underneath the alias.

Next, move the web interface. System, then Settings, then Administration. The settings that matter:

• Protocol: HTTPS, with a certificate you trust. The self-signed one works; a certificate from your own CA (System, then Trust) or from the ACME plugin for a hostname like fw.example.com removes the browser warning, which matters because people who click through warnings stop noticing the one that is real. • HTTP Strict Transport Security: on, once HTTPS is working. • Listen interfaces: choose the management interface only (and the LAN while you migrate). The default, all interfaces, is what you are fixing. • Session timeout: a short value such as 30 minutes, so an unattended browser tab does not stay logged in.

Then add an explicit rule that lets your admin machines in, before you remove the anti-lockout rule. On the management interface (or LAN for now), Firewall, then Rules:

Action: Pass Source: ADMIN_HOSTS Destination: This Firewall Port: HTTPS (443), and SSH (22) if you use it Description: Admin access to firewall

Test it from an admin machine. Only then tick Disable anti-lockout on the Administration page. The anti-lockout rule allows the web interface from anywhere on the LAN; with your own rule in place, it has done its job.

A password alone is one phishing page away from gone. OPNsense has time-based one-time passwords (TOTP) built in, the same six-digit codes as any authenticator app. The book recommends enabling this for any admin user.

System, then Access, then Servers: add a server of type Local + Timebased One Time Password. The defaults (6 digits, 30 seconds) suit standard authenticator apps.
System, then Access, then Users: edit your admin user, tick to generate an OTP seed, save, and scan the QR code it shows with your authenticator app.

Open the web interface in a private browser window and test the login before you change anything else. With the default token order, you type the six-digit code followed by your password in the password field, with no space; the server's "reverse token order" option flips that.
System, then Settings, then Administration: set the authentication server to the new TOTP server.

Keep a second way in. Save the OTP seed in your password manager, and remember that the console login is separate and does not use the web interface's authentication server.

The fix: named admin and SSH

Create your own user in the admins group and use it day to day, so the logs show who changed what. Keep the root account with a long random password stored in your password manager, and use it only at the console.

If you do not use SSH on the firewall, leave it off; it is off by default. If you do, System, then Settings, then Administration, Secure Shell section:

• Root login: off. Log in as your named admin user. • Password login: off. Paste your public key into your user's Authorized keys field first, and test a key login in a second terminal before you turn passwords off. • Listen interfaces: management only.

The fix: close unused doors

The book also advises closing what you are not using. This includes the console menu, UPnP, and the WAN interface.

• Console menu password. On the Administration page, protect the console menu with a password. Anyone with physical or hypervisor access to the console otherwise gets a root menu. • UPnP. OPNsense does not ship UPnP enabled; it is a plugin (os-upnp). Leave it uninstalled unless a game console truly needs it, and if it does, limit it to that one device's address with the plugin's access rules. • WAN. Check that the WAN interface keeps Block private networks and Block bogon networks ticked (the defaults), that no rule on WAN passes traffic to "This Firewall" except the WireGuard port you will add in Chapter 6, and that nothing in the services list listens on WAN. • Unused services. Look through Services and turn off anything you set up to try once.

Checklist: the front door

☐ ADMIN_HOSTS alias created, with DHCP reservations for those machines ☐ Web interface on HTTPS, listening on management (and LAN while migrating) ☐ Explicit admin rule tested, then the anti-lockout rule disabled ☐ TOTP login tested in a private window, seed saved in the password manager ☐ Named admin user in use; root for the console only; SSH off or key-only ☐ Console menu password set; UPnP not installed (or limited to one device) ☐ WAN blocks private and bogon networks; nothing administrative on WAN