username: root password: opnsense
6\. Once logged in you will be prompted with the configuration wizard. You could go through this, but I prefer to abort it and setup everything manually (Especially for static WAN IP addresses, and if ports are not yet correctly configured). In this way you also directly learn where all the options are located. Hence, click on Abort 7\. Then the first thing I like to do is to go to Interfaces > Assignments where you can assign the right LAN and WAN port. We will focus first on the **LAN** port hence you can delete the WAN port for now as we will add it later. [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/Ef2lQVZr6pX0EeZm-screenshot-from-2026-06-30-18-04-10-png.png) 8\. Now, if you want to switch your LAN physical port you can do that here by simply clicking on the Device drop down menu behind the LAN connection. Choose the right interface and hit save and apply. If that's done you can then now switch the cable to the right physical port and reconnect to the WebGui. # 4. Initial System Settings Next we will have a look at the system settings of your OPNSense box and configure it to your local needs ;). 1\. Go to System > Settings > General 2\. In here we will choose a hostname and a domain name. You can call your OPNSense router whatever you want but I like to call it CR1 for core router 1 and the domain name I would choose something related to the location your OPNSense router is running. 3\. Set your time zone, language and theme. One of the themes I personally like is the cicada theme, but it is up to you of course. 4\. Then if you have a nice picture of your whole setup then you can also add it here, which then later can be added to your home screen. 5\. Then the DNS information you can leave blank for now 6\. Finally, make sure the following are unchecked - [ ] Allow DNS server list to be overridden by DHCP/PPP on WAN - [ ] Do not use the local DNS service as a nameserver for this system - [ ] Allow default gateway switching 7\. That's it for now, but we will come back to this later ;) # 2. WAN Setup In this chapter we will discuss the different ways you can setup a WAN connection or also known as how will your OPNSense router connect to the internet ;) We will discuss DCHP, PPPoE, dynamic, static and multiple WAN connections. So go ahead, check your WAN connection type --> Go to the right page --> get yourself connected to the internet. It is assumed you have already done the local setup s.t you are ready to make a WAN connection. # 1. Dynamic DHCP WAN uplink On this page we discuss how to connect your OPNSense router to the internet when you have a dynamic DHCP connection. # 2. Static DHCP WAN Uplink # 3. Dynamic DHCP PPPoE WAN Uplink # 4. Static PPPoE WAN Uplink Perfect, so you have obtained a set of static IP addresses from your ISP (Hopefully Deternet ISP ;)) and they have told you that you will have a Fiber PPPoE connection. This could be a /30 a /29 or bigger subnet, but the configuration will be the same for all of them. Now, in principle there are two ways your ISP could hand you over a set of static IPv4 addresses. Basically one static subnet or two static subnets ##### **One Static Subnet Configuration** In the case of your ISP only handing you one subnet the following steps should be followed to get your static PPPoE connection up and running. 1\. First check if your ISP requires you to be on a specific VLAN to make use of the PPPoE connection. 2\. If that's the case then you should first setup a VLAN for your PPPoE connection. If this is not the case then you can skip the following steps and move directly to point 8. 3\. To setup an ISP VLAN for your subnet go to Interfaces > Devices > VLAN > + Add 4\. Here you first give it a Device name. This should be "vlan" followed with the vlan tag your ISP has provided you 5\. Then choose the Parent interface you have the ISP fiber cable or Ethernet cable (with ISP router pass through) connected to 6\. Give it the right VLAN Tag the ISP provided you 7\. Finally give it a Description i.e name. Personally I like to call it ISPNAME\_PPPoE\_1. (In my case that is KPN) But it is up to you. If all is good it should look something like this [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/QC4qBJEdciJGZHMI-screenshot-from-2026-06-30-19-17-35-png.png) 8\. Sweet now we can focus on the Point to point connection by going to Interfaces -> Devices -> Point to Point -> + Add 9\. Then you can choose what kind of point to point connection you have i.e one cable directly from your home/building to the nearest POP in your neighborhood or even straight to the ISP's datacenter is possible as well. 10\. Then we need to Link the interface. In the case with VLAN you choose the vlan0.6 (in my case this is vlan0.6 but yours could be vlan0.99 for instance depending on your ISP) option and otherwise the physical interface name the ISP cable is connected to. 11\. Then fill in the subnet at local IP (vlan0.6) you obtained from your ISP 12\. Then if all is good it should look something like this (note that the IP address is randomly chosen here, but you should fill in your ISP static IPv4 subnet credentials here) [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/qneVpYN3nBllFnbJ-screenshot-from-2026-06-30-19-24-21-png.png) 12\. Then simply hit Save!!!! almost getting there. 13\. Okey we will now go to Interfaces > Assignments > Device drop down menu. Now an option with pppoe0 should pop up. Don't worry if it still red (inactive) that's because we still need to activate it. [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/nUdl8KLbN5R6C3xM-screenshot-from-2026-06-30-19-35-51-png.png) 14.Then select the pppoe0 and give it a proper name. I like to call it WAN\_1 s.t it is clear that it is the first WAN uplink with room for more uplinks in the future. For instance if you want to have a wireless cellular backup link for instance. 15\. Then hit Save 16\. Once that is done we will enter the WAN\_1 connection to activate it by checking the box - [x] Enable Interface 17\. Then finally we also want to block private IP addresses and only allow public IP addresses to flow into the PPPoE uplink. You do this by checking these boxes - [x] Block private networks - [x] Block bogon networks 18\. Now, the IPv4 configuration is already set to PPPoE. It is then up to your ISP if you also got a static IPv6 block or not. To configure this you should have a look at the IPv6 Configuration section ;) 19\. Then hit Save and if everything is well you should now be connected to the internet via a static PPPoE connection. 20\. You can check this by going to System > Gateways > Configuration. This should show you a public gateway your OPNsense router is connected to [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/PfOfllWaPfCYSZSQ-screenshot-from-2026-06-30-19-47-21-png.png) 21\. Finally, I like to implement gateway monitoring for the WAN uplink as well. This is actually mostly handy if you have multiple uplinks, to check if one gateway fails that it then automatically switches to the backup WAN link. But how to do all of this you can find at theMultiple WAN section
# 5. Private DCHP WAN Uplink In the scenario where you don't have access to the main uplink of your ISP e.g you are in a flat where the internet uplink is shared via a centralised router. Or if you have a direct connection from a building to the datacenter then this could also be an internal network by using protocols like OSPF. However, that is discussed in another chapter ;) Focused on the home user in this scenario your uplink will be a private IPv4 address and not public. Note, that because of this you cannot host any applicaions to the public internet, however with tools like Netbird you will still be able to access your applications from outside of your home LAN. Now, the setup is almost the same as for setting up a Public WAN with a minor change, namely at the network WAN step you need to toggle off - Block RFC1918 Private Networks - Block bogon networks Otherwise it will block your private WAN DHCP uplink. All other settings will stay the same. # 6. IPv4 CGNAT Setup CGNAT is basically the worst setup you can possible have. This means the ISP simply does not have enough IPv4 addresses to give everyone an public IP address be it static or dynamic. In such a case your services will never be publicly accessible because you get a private IP address inside the internal network of the ISP instead of a publicly accessible IPv4 address. However, you can still host all your services by using technologies such as Netbird ;) Often ISP's require you to be on a specific VLAN for static or dynamic IPv4 addresses. Some ISP's for instance don't have enough IPv4 addresses and place their customers behind CGNAT to safe IPv4 addresses for people that actually want them. In that case you could call them and see if they can change your CGNAT connection to a dynamic DHCP connection. # 3. VPN Setup (Wireguard) Source: [Home Network Guy](https://homenetworkguy.com/how-to/configure-wireguard-opnsense/) In this tutorial we will setup a wireguard VPN connection on top of the OPNsense home network that we just created. This is most often what I do straight away after an installation. Since, this makes sure you can connect to the network remotely. It is extremely simple, since OPNsense already comes with three different VPN integrations that can be used straight away. Note here! You can only use a VPN if you have a public facing IP address. If you do not have this (behind CGNAT) then have a look at Mesh VPN's! Do know that if you don't have a public facing IP address you cannot host any public available services. Therefore, always try to get a public IP address from your ISP. # 1. Wireguard Instance Creation [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/jXrjir1mjGJzmUji-logo-wireguard-2751692653-jpg.jpeg) In this tutorial we will setup a Wireguard VPN Instance which will allow you to connect to your local network remotely. That means you can connect to it from any place in this world as if you were at home. This is extremely secure as well since it will use public private key cryptography. The mathematics does not matter here now, but the point is that you can only access your home network if you have a key that nobody else has. This is different if you would expose your home network or services to the public internet since then anyone could access your public facing services (at least the login screens, which is a security vulnerability) 1\. First we will create a new Wireguard instance. Go to your OPNsense Dashboard and go to VPN > Wireguard > Instances > + Add 2\. Provide it a name that is related to the VLAN you want to connect your Wireguard. In the case of root access I would leave it to VPN\_ROOT. 3\. Generate a Public and Private key by hitting the wheel button 4\. Choose a listen port: Make sure you give each instance a different listening port. I would recommend to choose a port different from the default port 51820 since this port is often blocked by other networks you connect to. 5\. Tunnel address: This will be a virtual network address given to your Wireguard instance. Its function exist for encryption, authentication and routing purposes. You and other peers will connect to this network. Hence, this is not the VLAN you want to connect to. We will do that later. I would recommend to choose the same 4 numbers that are in the port number. For instance if the port is 45891 then you could choose the IP address 10.45.89.1/24. 6\. Then leave the other options untouched. This results then in something looking like this [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/CfpUw3t3RxCGDqg5-screenshot-from-2026-06-30-20-14-00-png.png) 7\. Sweet! Then hit save and your instance is setup ;) 8\. Then the most important step !! Don't forget to enable the Wireguard instance when you are done by hitting apply !! Check the box - [x] Enable Wireguard # 2. Peer Generator Okey now you have setup your Wireguard Instance. Then now it is time to create a peer that can connect to the created instance. OPNSense makes this extremely simple. 1\. Just go to VPN > Wireguard > Peer Generator 2\. Endpoint: This is the public IP address of your network. In the case of a static Subnet you can choose any of the IPv4 addresses in your subnet. However, if you have not configured all of them yet then I would recommend to use the first IP address hat defines your subnet. Finally, you make sure the Endpoint includes the listening port defined in your WIreguard Instance. [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/eD10nVCV9sNDrlEW-screenshot-from-2026-06-30-20-23-27-png.png) 3\. Now, what I would recommend if everything is correct before saving is to make a screenshot of the QR code s.t you can easily use it with the Wireguard app on your phone for instance. Next, also copy the config file details into a text document and save it as *name\_location.conf*. I specify here **name\_location** s.t you can distinguish between multiple VPN's. 4\. Perfect, if that is all done you can hit Save and your peer is saved ! 5\. Now, we are not done yet! Your instance and peer might be created but we still need to setup the VPN interface and configure the firewall rules to make this all work. This is what we will do in the next pages ;) # 3. Enable VPN Interface Now, that you have setup your Wireguard instance and peer it is time to enable the VPN interface. 1\. Go to Interfaces > Assignments > Device drop down menu > Select wgo (Wireguard - VPN\_ROOT) and add it as a new interface 2\. Then click on the newly created VPN interface and simply check the box - [x] Enable Interface 3\. Then Hit Save and Apply changes at the right top corner ! 4\. Let's go almost there. Now we still need to setup the firewall rules for this VPN connection # 4. Setup VPN Firewall Rules We are almost there! The last thing we need to do is setup the correct firewall rules. Now, since you will create a root VPN you want this user to have access to all the different networks. Hence, the rules will be pretty simple. 1. Go to Firewall > Rules \[New\] > +Add 2. Then make sure you give it a proper Description name such as VPN\_ROOT 3. Finally check that all passing rules are set to "any" [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/QGtNhJxXCsnsMQLr-screenshot-from-2026-06-30-22-01-31-png.png) 4\. Perfect then save your configuration and apply the changes. 5\. Now after setting up the allow all access to the VPN\_ROOT the final rule that you need to apply is to allow your WAN\_1 port to be accessible over the Wireguard PORT you have set in the Wireguard Instance creation. Wireguard only needs UPD access and hence in Protocols you can choose UDP instead of any. 6\. For the destination you will choose the WAN\_1 address and not the WAN\_1 network since that would provide permissions that are not necessary in this simple case. 7\. If all done right the firewall rules should look something like this [](https://docs.rfeyn.org/uploads/images/gallery/2026-07/scaled-1680-/Y2ZUsFOLU29JzZRB-screenshot-from-2026-06-30-22-10-33-png.png) 8. Now, your VPN should be working for your peer. Test it out by using the Wireguard app on your phone and or in Linux there is a VPN option where you can upload the name\_location.conf file saved in the Peer generation step. 9\. If for some reasons it does not work yet try to enable and disable Wireguard! 10\. Congratzzz you made it to the end and hopefully you can now access your home network from any place in the world like you would be home. # 7. Multiple WAN Setup # 4. Caddy Reverse Proxy # Caddy 1. Setup Caddy 2. Make sure administaration is set to port 8443 3. also set firewall rules on wan to allow incoming connections on ports 80 and 443. - Change the TCP Port to 8443 (example), do not forget to adjust the firewall rules to allow access to the WebGUI. On LAN there is a hidden anti-lockout rule that takes care of this automatically. On other interfaces, make sure to add explicit rules. - Enable the checkbox for HTTP Redirect - Disable web GUI redirect rule.