Complete Guide: Installing and Configuring OPNsense Firewall on Proxmox VE

Audience: IT administrators, network engineers, and virtualization enthusiasts
Environment: Proxmox VE + OPNsense (FreeBSD-based firewall)

📘 1. Why Choose OPNsense?

OPNsense is a FreeBSD-based open-source firewall maintained by Deciso.
It offers enterprise-grade features — IDS/IPS, traffic shaping, VPN, proxy, and QoS — in a modern web interface with active updates.

When running Proxmox VE, OPNsense is one of the best virtual firewall solutions for isolating, routing, and protecting your virtual networks.

⚙️ 2. Installing OPNsense on Proxmox VE

🧩 System Requirements

Component	Minimum	Recommended
CPU	2 Cores	2–4 Cores (VT-x / AMD-V enabled)
RAM	2 GB	4–8 GB (more for IDS/IPS)
Disk	10 GB	20 GB+
NICs	2	One for WAN, one for LAN (add DMZ if needed)

🖧 Network Bridge Layout

Purpose	Bridge	Description
WAN	`vmbr0`	External Internet connection
LAN	`vmbr1`	Internal virtual network

💿 Upload the OPNsense ISO

Download the latest ISO from
👉 https://opnsense.org/download/

Then upload it to your Proxmox node:

scp OPNsense-*.iso root@<pve_ip>:/var/lib/vz/template/iso/

⚙️ Create the VM via CLI

qm create 101 \
  --name opnsense \
  --memory 4096 \
  --cores 2 \
  --cpu host \
  --machine q35 \
  --bios ovmf \
  --ostype l26 \
  --scsihw virtio-scsi-pci \
  --bootdisk scsi0 \
  --boot order=scsi0;ide2;net0 \
  --agent 1 \
  --rng0 source=/dev/urandom

Add disk and network interfaces:

qm set 101 --scsi0 local-lvm:20
qm set 101 --ide2 local:iso/OPNsense-25.1.iso,media=cdrom
qm set 101 --net0 virtio,bridge=vmbr0     # WAN
qm set 101 --net1 virtio,bridge=vmbr1     # LAN
qm set 101 --vga serial0 --serial0 socket

Start the VM:

qm start 101

💻 Install OPNsense

At the console:

Login: installer
Password: opnsense

Select Install, choose Auto (UFS) for partitioning, and set a root password.
After reboot:

LAN IP: 192.168.1.1/24
User: root
Pass: opnsense

🌐 3. Accessing the Web GUI

Open your browser and go to:

https://192.168.1.1

Hostname, DNS, NTP
WAN configuration (DHCP / PPPoE / Static)
LAN IP setup

🧩 4. Configure WAN Gateway (Static IP)

If your WAN uses a static IP:

System → Routing → Gateways → +Add

Example:

Interface: WAN
Gateway IP: 203.66.123.1
Default Gateway: ✅

🧠 5. If the Web GUI Fails to Start

At the console:

service configd start
service nginx start

Or from the text menu:

12) Restore the web GUI configuration

🔐 6. Setting Up OpenVPN

🪪 Step 1 — Create a Certificate Authority (CA)

System → Trust → Authorities → +Add
Choose “Create an internal Certificate Authority”

🧾 Step 2 — Create a Server Certificate

System → Trust → Certificates → +Add

Certificate authority: VPN_CA
Type: Server Certificate

🧱 Step 3 — Create an OpenVPN Server

VPN → OpenVPN → Servers → +Add

Recommended settings:

Server Mode: Remote Access (SSL/TLS + User Auth)
Protocol: UDP
Device Mode: tun
Interface: WAN
Tunnel Network: 10.8.0.0/24
Local Network: 192.168.1.0/24
Redirect Gateway: ✅

👤 Step 4 — Create VPN Users

System → Access → Users → +Add
Enable “Create Certificate” for each user.

📦 Step 5 — Export the Client Configuration

VPN → OpenVPN → Client Export → Select user → Download .ovpn file

🧰 7. Allow VPN Clients to Access Multiple Internal Networks

If you have multiple LANs:

LAN1: 192.168.1.0/24
LAN2: 192.168.2.0/24

Add both in OpenVPN → Server → Routing → Local Network:

192.168.1.0/24,192.168.2.0/24

Then open Firewall → Rules → OpenVPN:

Action: Pass
Source: 10.8.0.0/24
Destination: any

Clients will automatically get routes to both LANs.

🧠 8. Layer-7 (L7) Application Control

By default, pf (the firewall engine) supports Layer-3/4 filtering only.
To implement L7 (application-level) control, OPNsense uses add-ons:

Module	Purpose	L7 Capabilities
Zenarmor (Sensei)	Deep packet inspection, app blocking	✅ App-based filtering (YouTube, VPNs, etc.)
Suricata	IDS/IPS with signature-based DPI	✅ Protocol recognition, threat detection
Squid Proxy	Web filtering & caching	⚠️ HTTP/HTTPS only

💡 Recommended combo: Zenarmor + Suricata → visibility + protection.

🧩 9. Troubleshooting Quick Reference

Problem	Solution
Web GUI not loading	`service nginx restart`
VPN connection fails	Ensure UDP/1194 allowed on WAN
Certificate error	Recreate CA and re-issue server cert
VPN client can’t reach LAN	Add routes in Local Network and firewall rules
Gateway shows “Offline”	Change monitor IP or check upstream connectivity

✅ 10. Conclusion

Deploying OPNsense on Proxmox VE gives you a flexible, secure, and cost-effective virtual firewall solution.
It can handle multi-WAN routing, VLAN segmentation, VPN connectivity, Layer-7 controls, and IDS/IPS — all without license fees.

For small and mid-sized enterprises, it’s a robust, open-source platform that brings security, visibility, and control directly into your virtual infrastructure.