I got to the point where I have opnsense setup well enough to be a workable modem for my needs.
I realize that opnsense wouldn't have so many options if it didn't tailor any need, but starting out,....
Is opnsense basically as secure as most mainstream routers with the default settings. I'm not asking for help here. I just want to know if the default settings are relatively safe until I continue to learn.
Thanks!
If you just installed OPNsense and you do nothing else with rules, it will out of the box:
- block all unsolicited incoming packets
- allow all outgoing (so you can use the internet freely with nothing being blocked for you or any devices in your LAN)
- allow replies (so that the internet servers you talk to can talk back and serve you data)
In other words, it keeps track of connection states in a state table and uses that information to make decisions about which incoming traffic is expected (pass) and which is not (deny).
The "Default deny / state violation" rule on WAN is what provides the protection and it's applied on all ports in OPNsense by default.
It's up to you to expose things if you decide to, but nothing is open by default and there's no UPnP out of the box to worry about. That also means there's no UPnP helping game consoles and other things to initiate p2p connections on their own, which you would need to configure yourself in OPNsense.
So it's at least as good, if not better, than consumer routers... maybe? The danger comes when you need to do something beyond the default configuration and then can easily make mistakes. OPNsense won't warn you about misconfigurations or unintended consequences because it assumes you already know and it stays out of your way.
You picked a good firewall. You can rest easy for now ;)
@OPNenthu
Great reply and just what i hoped. Thank you so much for the detailed answer and explanation!
Take your time, but do try to at least get an IoT network separate from your LAN. That's the big win, IMO.
Quote from: OPNenthu on Today at 11:35:57 AMTake your time, but do try to at least get an IoT network separate from your LAN. That's the big win, IMO.
YES. I do have a lot of smart devices of different brands. My plan is a general home network, a VPN network, and an IoT network. The SSIDs are already setup in the access point. I have some network housekeeping to do today to clean up all of the temporary cables and such. It makes me crazy working in a mess, but it will clean up quickly and then I can relax and add the vlans at a no rush pace.
Thanks again!