Confirming that the method described, System -> Settings -> Administration worked where I was using Pangolin to create tunnels to access OPNSense host in my network for testing purposes. I just wanted to note you can in fact add multiple hostnames that the OPNSense server will be willing to accept as a space delimited list in the Alternate Hostnames text box.
The info box if you click it on this setting says as much:
The info box if you click it on this setting says as much:
QuoteAlternate Hostnames for DNS Rebinding and HTTP_REFERER Checks
Here you can specify alternate hostnames by which the router may be queried, to bypass the DNS Rebinding Attack checks. Separate hostnames with spaces.