Let's AI Opnsense!

[gmcfarling]

Hi,

I am a programmer, well soon to retire programmer, but I have an itch today.  I have been an advanced user of OPNsense for years and I have built from ground up many routers as well as used Protectli hardware.  I am currently running their latest and greatest.  I think tweakers like myself that make changes all the time and get into hot water and the wife comes in and asks "are you messing with my internet again!" then I pull out a "safe copy" of backup and presto problem gone we want to do this smarter.  Here is a new idea how about we make our own LLM?  We make a local AI that we can load a document of a backup configuration and it reads it and we can ask AI what we can do better?  No information about our LAN goes into the wild, but the wild comes to us and gets fresh updates from team OPNsense so we can have a safer network?

Gary M.

[meyergru]

I thought it was hot here in Germany, but you must live somewhere way hotter... ;-)

The day an AI can do that (i.e.: meaningfully, not: at all), I am going to retire. Speaking of my own experience, you could throw me an OpnSense configuration file without context and I could not even guess what you are up to. We see that all day with questions here: no context, just "It does not work". So, I guess you would at least need some more information, like network topology and some other stuff.

When I tried with ChatGPT, all it could do was to tell me how my sysctl settings were "safe"...

[Monviech (Cedrik)]

One way to do this is to use a local llm model and set up an mcp server that describes the API endpoints in a language the LLM understands.

If you search for opnsense mcp server you might find something.

[patlegu]

Hello,

I've done some experiment around AI and opnsense. I start last year by training a SLM with some opnsense functions, less than 12, to see how it goes. Two month later, my Lora was working well with the 102 functions and I decide to make a lab to check what it can do alone on a real opnsense connected directly to internet.

My lab was an Agentic SOC (Security Operation Center) with 3 kind of SLMs (1 opnsense, 1 SOC, 1 CERT). The purpose was to check what was possible to do with some small servers without GPU. You can find some informations on this here . It has worked pretty good and the opnsense agent was able to had or remove some rules to the firewall. It's not what you have in mind but can give some ideas. It worked well, in the sense that more specialized agents had to be created as the attacks occurred.

I've tried after that to go from the side-car version to the full opnsense integrated SLM. version. Still in French. It was working pretty good excepted that you have to have more CPU and RAM due to inference directly in the box.

I hope this information regarding the use of SLMs with OPNsense has been helpful.

I am currently looking into whether this operational approach using LoRAs (OPNsense, WireGuard, CrowdSec) is still relevant, given how much LLMs have evolved over the past eight months.
I have started a new project(English) addressing various issues related to managing sensitive information in cybersecurity, particularly concerning firewalls—specifically, how to use an LLM without compromising sovereignty or the confidentiality of configurations. With a small testing interface. Should have bug as it's under heavy dev for the moment.

I hope I haven't been too long-winded or boring.
Pat.

[meyergru]

1. I hope you are aware of one unsolvable trust problem once the models or # of tokens get too big to handle with a local LLM: Even if you limit the model to read-only access and implement user safeguards a.s.o.: the user must still trust big tech by using their AIs.

Keep in mind, that there are lots of sensitive data in the firewall configurations, ranging from VPN keys to potentially, CA private keys.
To see where I am going with this, just read this in a similarly sensitive context - the author of that tool does either not comprehend of what he is doing or he really is a sock-puppet (also, at the time he first presented his project, he had no verifiable history in the tech community). He even claims that his tool is "The Proxmox MCP you can hand the keys" - yet all of his attempts are futile in that he is neither an expert in Proxmox nor AI models and he cannot even program himself (all is done by Claude).

I sure hope you do not fall for the same misconceptions.

2. That being said, your links do not work at this time. I always get a 404, so I cannot verify or try out anything you have done - I would never do that on a production machine, BTW and urge others to apply the same caution. There have been attempts lately to lure unaware OpnSense users into installing tools on their boxes, up to creating a facade company website with a catchy name. So, I also hope the moderators are closely watching this.

By now, I would say: Let's not AI OpnSense if the MCP server is implemented in a way that makes non-local LLMs neccessary or needs anything installed on the box itself. I know that is a high hurdle, but hey!