OPNsense Virtualization Installation Notes on Proxmox VE

Preface

• Replaced the soft router hardware and updated my notes accordingly.
• This post is a continuation of Proxmox VE + PfSense 安裝.
  • The network installation architecture within Proxmox VE remains similar, utilizing the paravirtualized network interface controller (Virtio Net).
  • Testing showed that the Intel J4125 paired with the Intel i225v network card can achieve the full 300M / 100M speeds without configuring PCIe passthrough.
• The switch to OPNsense was made with the following considerations:
  • PfSense requires a subscription (PfSense Plus) for more aggressive updates. Although it's currently free for home users, future charges cannot be ruled out.
  • OPNsense has a more proactive update strategy and a shorter security update cycle.
  • Zenarmor and other third-party packages can be installed, though I ended up removing Zenarmor later on.
  • The OPNsense UI is more user-friendly, allowing quick navigation to desired settings via search.

Installation

• Assign the Port vmbr0 to WAN and vmbr1 to LAN (Refer to the images in the PfSense notes)
• Skip the lagg and vlan configuration
• Default account and password for enter installation
  • account: installer
  • pass: opnsense
• VM settings in Proxmox VE
  • machine type: Q35
  • processors type: host
  • OS type: other
  • Adjust other CPU and memory settings according to needs.

Configuration

PPPoE settings with IPv6 (Applicable for Hinet)

• Fill out PPPoE info to establish connection
• Tick "Use IPv4 connectivity option"
• at LAN IPv6 section, IPv6 configuration type -> Track Interface, and the options below interface select "WAN"
• In the Firewall options, Tick "allow IPv6"
• Add IPv6 ICMP allow rule in WAN firewall rule
• If you want to use a self-hosted DNS (Adguard Home or Pi-Hole) and apply it to IPv6:
  • Tick the "Manual Router announcement management"
  • Fill the DNS IPv4 settings in the "Router announcement"
  • Hinet IPv6 is Stateless (Stateless DHCPv6 + SLAAC)
  • Disable the DHCPv6 service in the LAN
  • The logic here is that IPv6 DNS requests can simply be sent to the IPv4 address DNS server, which will still return IPv6 resolution addresses.

Security

System

• Disable the listen service including WebUI, ssh, Unbound on WAN surface
• Install the CrowdSec, and enable Intrusion Detection
  • Disable hardware net acceleration related "Interfaces" > "Settings"
• Configure the SSH Key, disable the password login

Intrusion Detection (Suricata) (IPS/IDS)

• Download rule sets based on service used
• Rule set with using sites name (p2p, Facebook, Youtube) do not apply
• ET Pro rule set need suscription

Crowdesc

• Connected to the cloud database to detect the attackers IPs and block
• Collection for different scenarios (windows, nginx, ...)can only be added through shell command
• The hub for adding the scenario rule Hub |

Firehol IP list subscription

• FireHOL Block List ( Botnets, Attacks, Malware....)
• Follow the guide to add alias of Firehol level 2
• Add the Cron tab to update the Firewall alias

VLAN Configuration (For creating a guest network or dedicated IoT network)

• Add VLAN, assign Tag, and make Proxmox VE vtnet aware vlan
• Assign DHCP server
• Add Firewall rule to make the VLAN network unable to access the LAN

GeoIP and Ailases for Firewall Block (If you want to block specific countries/regions)

• Register the Maxmind GeoIP database
• Follow the guide to add Firewall aliases
• Configure to block the specific countries

Cron (Remember to set up updates for each list after security configuration)

• System and packages update
• Suricata blocklist update
• Firewall aliases updates (FireHol, GeoIP)

Others Packages

• Netdata: Another monitoring service
• Wake-On-LAN: For waking up machines remotely
• UPNP: Use with caution if you have security concerns; used for punching holes for services within the LAN
• Tailscale OPNsense安装配置Tailscale | 鐵血男兒的BLOG
• Wireguard [How to Set Up WireGuard in OPNsense in 2023 - WunderTech](https://www.wundertech.net/