OPNsense Firewall Rule "Cheat Sheet"

Introduction

When looking up information on how to write firewall rules in OPNsense, you may be looking for specific examples on how to block or allow certain types of network traffic rather than how to write firewall rules in general. This is especially true once you become more experienced and comfortable with writing rules. I thought it would be a good idea to consolidate a variety of scenarios into a single how-to that could be used as a quick reference guide.

It is worth noting that any IP addresses used in the examples could be substituted with aliases. If you plan to create several rules for a particular device or want to combine multiple IP/network addresses into a single rule, you may want to use aliases. Aliases allow for multiple values and you can quickly change the values for several rules at the same time. It also helps make the rules more readable since you do not have to remember that 192.168.10.10 is your laptop, PC, Raspberry Pi, etc.

To add new firewall rules for your various network interfaces, go to the “Firewall > Rules” page. You will see a list of interfaces in which you may add firewall rules.

LAN/VLAN Rules

By default, the LAN network in OPNsense has anti-lockout rules (to prevent you from locking yourself out of the web interface) and an “allow any” rule which allows access to all local and remote networks. When you create a new VLAN or a network on another physical interface, access to all other networks are blocked by default since there are no firewall rules defined for the new network (besides hidden auto-generated ones required for DHCP to function, for instance). Many of these examples assume you have multiple local networks and you want to allow communication between devices in the different networks.

Below are some scenarios for creating firewall rules for your LAN/VLAN interface(s):

Allow a single device on VLAN 10 to access any port of single device on VLAN 20

This rule allows a device with the IP address of 192.168.10.10 on VLAN 10 to access any open service that is running on a device with the IP address of 192.168.20.10 that resides on VLAN 20:

Option	Value
Action	Pass
Interface	VLAN10
Protocol	any
Source	192.168.10.10
Source Port	any
Destination	192.168.20.10
Destination Port	any
Description	Allow device to device access

Allow any device on VLAN 10 to access any port of single device on VLAN 20

This rule allows every device on VLAN 10 to access any open service that is running on a device with the IP address of 192.168.20.10 that resides on VLAN 20:

Option	Value
Action	Pass
Interface	VLAN10
Protocol	any
Source	VLAN10
Source Port	any
Destination	192.168.20.10
Destination Port	any
Description	Allow VLAN 10 access to device

Allow any device to access any network or device (local networks and Internet)

This is the default “allow all” rule created by OPNsense on the LAN interface when you install OPNsense.

Option	Value
Action	Pass
Interface	LAN
Protocol	any
Source	any
Source Port	any
Destination	any
Destination Port	any
Description	Allow access to any network/device

If you use this rule, I would recommend restricting as much network traffic as possible above this rule to minimize unwanted traffic. When you have more restrictive rules above this rule, it essentially becomes a “allow all other” rule to allow any traffic you have not explicitly blocked to pass through. This is probably more useful in a home network environment so you do not have to constantly tweak your firewall rules to allow every different type of traffic through the firewall (unless you enjoy that sort of thing). Companies and the government may want to default to “deny all other” to be more restrictive in which case you would simply not include this “allow all” rule at the bottom of the rule list.

Block a single device on VLAN 10 from accessing the Internet

If you need to block access to the Internet and to other local networks (such as VLAN 20) for a particular device with the IP address 192.168.10.10 on VLAN 10:

Option	Value
Action	Block
Interface	VLAN10
Protocol	any
Source	192.168.10.10
Source Port	any
Destination	any
Destination Port	any
Description	Block access to Internet

If you already have your VLANs isolated from one other, access to other local networks is already blocked so this rule essentially adds the block for the Internet.

Note: This rule does not block access for that device for anything inside VLAN 10 because any traffic from one device to another within the same VLAN is considered local traffic and does not go through the router which means none of the firewall rules for VLAN 10 are processed for such traffic.

Block all devices on VLAN 10 from accessing the Internet

To block all devices on the entire VLAN 10 network, simply do not add any firewall rules for the VLAN 10 interface. By default, all outgoing traffic is blocked to both the Internet and other VLANs so this rule would be redundant. However for the purposes of illustration and learning, the following rule would block all outgoing traffic:

Option	Value
Action	Block
Interface	VLAN10
Protocol	any
Source	VLAN10 net
Source Port	any
Destination	any
Destination Port	any
Description	Block access to Internet

Block all devices on VLAN 10 from accessing a single host/server on the Internet

If you want to block access for all devices on VLAN 10 from accessing one particular IP address such as 8.8.8.8 on the Internet:

Option	Value
Action	Block
Interface	VLAN10
Protocol	any
Source	VLAN10 net
Source Port	any
Destination	8.8.8.8
Destination Port	any
Description	Block access to the host/server 8.8.8.8

Allow ICMP messages on all internal networks to aid in troubleshooting

Many administrators disable all ICMP messages on the network both internal and external since they can be abused. However, allowing pings and destination unreachable messages on your internal network can be helpful with troubleshooting connectivity issues on your network.

If you have multiple VLANs, I recommend that you create a firewall rule group or use floating rules. For the firewall group or the float rules, you would select only the LAN/VLAN interfaces in which you wish to use ICMP. Then you can create the rules below. The example below is using the group name ICMPGroup as the interface (since the group already knows what interfaces to apply the rules). If you using floating rules instead, you can select the appropriate list of LAN/VLAN interfaces instead of using the group name as the interface. These are the most common and useful ICMP messages:

Option	Value
Action	Pass
Interface	ICMPGroup
Protocol	ICMP
ICMP type	Echo Request
Source	any
Destination	any
Description	Allow ICMP echo request messages

Option	Value
Action	Pass
Interface	ICMPGroup
Protocol	ICMP
ICMP type	Echo Reply
Source	any
Destination	any
Description	Allow ICMP echo reply messages

Option	Value
Action	Pass
Interface	ICMPGroup
Protocol	ICMP
ICMP type	Destination Unreachable
Source	any
Destination	any
Description	Allow ICMP destination unreachable messages

Option	Value
Action	Pass
Interface	ICMPGroup
Protocol	ICMP
ICMP type	Time Exceeded
Source	any
Destination	any
Description	Allow ICMP time exceeded messages

If you want to use ICMP but block using it for certain networks such as your management VLAN or other sensitive networks, you could add “block” rules above the “allow” rules. I do not want to repeat all of them but you would simply add rules such as this:

Option	Value
Action	Block
Interface	ICMPGroup
Protocol	ICMP
ICMP type	Echo Request
Source	any
Destination	MGMT net
Description	Block ICMP echo request messages to the management VLAN

Redirect DNS requests on LAN to Unbound DNS using NAT port forwarding

If you wish to redirect all outbound DNS requests on port 53 to your local Unbound DNS resolver, you may create a NAT port forward rule on your LAN network.

Option	Value
Action	Pass
Interface	LAN
Protocol	TCP/UDP
Source	any
Source Port	any
Destination / Invert	Checked
Destination	LAN net
Destination Port	53 (DNS)
Redirect target IP	127.0.0.1
Redirect target port	53 (DNS)
Description	Redirect external DNS requests to local DNS resolver
Filter rule association	Add associated filter rule (or Pass)

If you have multiple local networks which you wish to redirect DNS requests, you may create a firewall group by going to the “Firewall > Groups” page and adding all of the appropriate interfaces to the group. This allows you to create a single rule to redirect DNS requests for your entire network. You can reference the group called “MyGroup” like the example below:

Option	Value
Action	Pass
Interface	MyGroup
Protocol	TCP/UDP
Source	any
Source Port	any
Destination / Invert	Checked
Destination	MyGroup net
Destination Port	53 (DNS)
Redirect target IP	127.0.0.1
Redirect target port	53 (DNS)
Description	Redirect external DNS requests to local DNS resolver
Filter rule association	Add associated filter rule (or Pass)

Please note that redirecting unencrypted DNS requests on port 53 does not redirect any DNS requests which are encrypted. If you are not using DNS over TLS, you could block outgoing port 853 in case something is tunneling traffic on that port. Blocking DNS over HTTPS is more difficult because it blends in with other HTTPS traffic so you will have to resort to using less effective techniques such as block lists (unless you use some sort of man-in-the-middle software to decrypt, inspect, and encrypt that traffic but that may introduce potential vulnerabilities).

Redirect NTP requests on LAN to local NTP service using NAT port forwarding

If you wish to redirect all outbound NTP (Network Time Protocol) requests on port 123 to your local Unbound DNS resolver, you may create a NAT port forward rule on your LAN network in the same manner as the DNS redirection:

Option	Value
Action	Pass
Interface	LAN
Protocol	TCP/UDP
Source	any
Source Port	any
Destination / Invert	Checked
Destination	LAN net
Destination Port	123 (NTP)
Redirect target IP	127.0.0.1
Redirect target port	123 (NTP)
Description	Redirect external NTP requests to local NTP service
Filter rule association	Add associated filter rule (or Pass)

WAN Rules

Below are some scenarios for creating firewall rules for your WAN interface:

Allow remote access on WAN to VPN server on OPNsense

Since the OpenVPN service is hosted on the OPNsense router, you can add the following rule to the WAN interface. This holds true for any service running on your router since you do not need to forward any ports to a device inside your network:

Option	Value
Action	Pass
Interface	WAN
Protocol	UDP
Source	any
Source Port	any
Destination	WAN address
Destination Port	1194
Description	Allow remote access to OpenVPN

Allow remote access to web server on VLAN 10 using NAT port forwarding

To forward ports in OPNsense, you need to go to the “Firewall > NAT > Port Forward” page. Creating the rule follows a similar process to other LAN/WAN rules except that you need to also specify the IP/alias and port number of the internal device on your network. This means you need to enter values for the “Redirect target IP/port” data fields.

Important: When you create a NAT port forward rule, you need to go to the “Filter rule association” at the bottom of the page. By default, it will be set to “None” which means you will not be able to reach your internal server from outside your network. Select “Pass” if you are not using a multi-WAN configuration or “Add associated filter rule” if you are using a multi-WAN configuration or prefer to have a corresponding WAN rule automatically created on the WAN interface. The nice thing about using the “Pass” option is that your WAN rules do not get cluttered with your NAT port forward rules. However, if you prefer to see the rule on the WAN interface, you need to select “Add associated filter rule” so it is visible. You may be used to seeing the rule if you have used other firewalls or perhaps you prefer the convenience of having the rule visible when you are reviewing your WAN rules. I like the idea of having the rule visible because at a glance I can see everything that is open on the WAN interface without also needing to visit the “NAT Port Forward” page.

I have noticed that many users are confused about how to configure port forwarding in OPNsense, but creating the NAT rules are similar to creating other firewall rules for your interfaces. The biggest difference is that you need to enter values for two additional “redirect target” data fields and to select the appropriate “Filter rule association”.

Option	Value
Action	Pass
Interface	WAN
Protocol	TCP
Source	any
Source Port	any
Destination	WAN address
Destination Port	443 (HTTPS)
Redirect target IP	192.168.10.10
Redirect target port	443 (HTTPS)
Description	Allow remote access to web server
Filter rule association	Add associated filter rule (or Pass)

The external port and the port on the internal device hosting the service do not have to be identical. You could externally map any port to the port on the host device. You may actually want to use a different external port for certain services such as SSH so that your SSH service does not get as much spam from automated scans or attacks that occur most frequently on the default port.

Suggestions/Feedback

If you have any suggestions for other basic firewall examples, please let me know in the comments below or on Twitter/Facebook/email so that I may include them. Keep in mind that I prefer not to include example rules where the only difference in the rules is changing a port number because I cannot include an example for every possible service in existence. I am striving to include scenario-based examples that are straightforward to configure since this is meant to be more of a quick guide than a detailed walkthrough of a specific scenario.

---