Questions Before I Try OPNsense

[NORVIN]

I have a couple of questions before I try OPNsense.  Presently, we use a FortiNet 200B firewall, but it is old and doesn't do a very good job of filtering HTTPS websites.  So I am thinking about trying OPNsense instead.  This is going to be in a school setting with about 1,000 users possibly.

1) Can users be added to where if a website is blocked by OPNsense, they can override the block and go to the website?  This is nice if a teacher needs to access something.  We allow them to use Facebook during breaks and lunch, but want students off of it.

2) Will the firewall block HTTPS sites like Facebook, Twitter, etc., but allow an override?

3) Do certificates need to be installed on computers for HTTPS filtering?

4) Are there categories of things to allow automatically, block but allow with override, and block?  FortiNet has categories in it I can allow or block.  We allow Facebook with an override, but not obviously bad websites.

5)  We do 10.0.0.X/16 and have 10.0.2.1-10.0.254.254 for DHCP.  Can I specify IP addresses to automatically bypass the firewall?  Specifically, block the DHCP addresses but allow static IP addresses like 10.0.0.25 or 10.0.1.55 and so on not in the DHCP range?

[NORVIN]

So it does none of those things?

[hbc]

1+2) The problem is your wish for overwrites.
3) Not for SNI only filtering, for content of course
4) With sensei plugin yes, overwrites not possible yet. Later with premium license

5) Really? Nearly a class B subnet for just 1000 users? Sure you can assign static ips outside the dhcp scope. You can even create several dhcp scopes.

I think you have a problem with your network design. You should separate into subnets and use different rule sets. Restricted for pupils, more open for teachers. Then no need for all these overwrites.

[NORVIN]

1,000 users?  No.  It should support 65,534 users.  Different subnets I think would be too much trouble since network resources need to be accessed by all.

I just need a firewall OS that allows users who have accounts (staff) to override if an override is allowed.

[hbc]

This is going to be in a school setting with about 1,000 users possibly.

Sounded like 1000 users.

65534 users in one flat network? Broadcast hell.

[mimugmail]

You really should spin up a VM and check the Proxy settings If it fits your needs.