OPNSense: Protect Your Home LAN With a Transparent Filtering Bridge with Step by Step Instructions

Dave details how to set up OPNSense on a miniPC and how to configure it as a transparent filtering bridge. He also sets up IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) via Suricata and deploys the ClamAV antivirus solution on the router. For my book on life on the Spectrum: amzn.to/49sCbbJ
Any requests to contact me on Telegram, etc, are scams...
Errata: OPNSense is FreeBSD, not Linux!
If you do not have a management interface (third port), don't set the LAN interface IP4 config to None - set a static IP for it so you can still reach it later. Sorry for this oversight!
Follow me on Facebook at davepl for daily shenanigans!
Follow me on Twitter at ‪@davepl1968‬
Great pfSense tutorial by Network Chuck: • your home router SUCKS...
How virtualize a firewall by Techno Tim: • How to Virtualize Your...
Protectli Valut: protectli.com/
Dual NIC Mini PC: amzn.to/3xkgM6q
Elite MiniPC: shop.azulle.co...
$65 Mini PC: www.aliexpress...
Recipe for Configuring OPNSense as a Transparent Filtering Bridge:
www.zenarmor.c...
Download OPNSense: opnsense.org/d...

[@mithubopensourcelab482]

In my professional life I must have done setup of OPNsense / pfSense more than 300 + times. But, I swear, never heard or imagined transparent filtering bridge. Thank you Dave for enlightening me and the world about it. Will surely put in to practice.

[@DavesGarage]

Glad I could bring something new to the table!

[@perwestermark8920]

Have had it on my todo to figure out how to set up transparent filtering on a naked Linux system. But too many other tasks taking time. In my case, I want an existing firewall to believe an external box with modem should look like a local interface so the firewall sees (and thinks it owns) the public IP.

[@abdulsalamshar5601]

yeah he reach Saudi Arabia also , i will do as he advice, thanks dave

[@SpriGgEx]

Me neither and i still dont rly see what the Point of it is. It doesnt come clear to me in this video.

[@perwestermark8920]

@@SpriGgEx Transparent here means it looks like a layer 2 switch. No changes to any IP numbers. So it isn't visible. Until one of the firewall rules decides to block something. Then it's just a magic cable that blocks the bad connections. So the computer on the inside can still believe that it owns the public IP number and runs without firewall.

[@takakazushi6703]

Love the fact that I could follow your step-by-step without getting lost. Yes! Do more OPNsense stuff. Add a segment on using a machine with built-in Wi-Fi so I don’t have to go down the add a separate access point gadget to complicate matters.

[@Texan1048]

My Arris router is a cable + wifi router, pretty rare nowadays tp find one of those

[@drewlarson65]

pf/opnsense suck at wifi, don't do this, that's not what they're for. look into openwrt

[@eDoc2020]

Built-in Wi-Fi won't work as well as a dedicated AP but more importantly very few chipsets work properly in FreeBSD in AP mode.

[@takakazushi6703]

Sadly, I COMPLETELY agree with you. THAT is why I’m hoping that people MUCH SMARTER than me (like Dave here) can suggest solutions so we can get that “built into the router” AP without needing that “extra/separate” AP gadget, it’s software and another layer of complexity.

[@Texan1048]

@@eDoc2020 it works from 300' feet away, thats good enough for me

[@funknick]

Hey Dave, I just finished setting up a transparent filtering bridge following your steps laid out here. Thank you so much, this was a lot of help! I have a small hiccup (with a solution) I wanted to mention. In your setup steps, you have connected to the LAN port/interface while configuring OPNsense. Prior to setting up the IPS/IDS services, you have us turn off the DHCP and static IP for the LAN port interface. Once this is applied as a configuration, you will lose the ability to access the administration pages. When this happens, you're locked out and can't complete the rest of the steps in your video (turning on IPS/IDS/ClamAV). I think the reason you didn't have this problem is that you have more than 2 ethernet ports on your device (2 SPF, 4 ethernet) and you're using one of the ethernet ports as your management interface. The way I got around this, is the system I'm using has two ethernet ports for LAN/WAN on an Intel NIC and I use the motherboard's built in third ethernet port as a management interface. Before I followed your steps, I configured an interface, static IP, and DHCPv4 service for that 3rd ethernet port that I aptly named `MANAGEMENT`. Then I used that port instead of the LAN port to perform all my configurations. Anywho, that made for a fun little challenge. I had to re-install OPNsense to regain access and do some tinkering to hook up that 3rd port, but it was fun and now I've got a fully working transparent bridge for my ever-growing home network. Cheers and thanks for making this video!

[@TDawgBR]

I appreciate the straight forward approach Dave, and I've noticed quite a few experts nit-picking, I haven't seen anything significant enough to disregard the video. Thanks for this.

[@alexatkin]

If you Google for Suricata there's plenty of people talking about how often it blocks things due to false positives and it wont see most malware as its delivered over SSL. The best you can really do is region and IP blocklists which require much less CPU power.

[@stephensalex]

Experts who needlessly nit-pick are just being difficult. Source, I work in the industry and listen to it daily. From a big-picture standpoint the video is great.

[@ICEMANZIDANE]

a grown up man advocating for a youtuber. You dont need to defend him, he is old enough and probably accepts his mistakes. Gotta love Fans of youtubers, DONT BE a fan of a youtuber.

[@MrCalldean]

@@ICEMANZIDANEYawn. I got bored after grown up.

[@ltlking]

⁠​⁠@@ICEMANZIDANEAssumption much? Maybe he’s just offering a fellow human being some kindness and support. Even grownups appreciate an attaboy from time to time. If you think that’s only for kids, then I’m sorry for you.

[@ragtop63]

For anyone interested in pfSense vs OPNsense, one of the biggest reasons to go with OPNsense is because of its advanced hardware support. It’s a fork of pfSense but the developers build support for newer hardware themselves instead of waiting for the BSD community to do so. This means that you typically aren’t waiting years for the OS to support a new NIC (or something else) like you do with pfSense. They’re both really good choices but OPNsense wins it for me because of the hardware support.

[@MartinStrazynski]

This is exactly the sort of opnsense configuration I was looking for to implement for home clients. Beautiful, clear and concise video. Much appreciated. Looking forward to more content!

[@bryonnevis2187]

Love the one-liners. @0:57 "The order in which you do things doesn't really matter," said with a completely straight face. CCNA dig pretty funny too!

[@DavesGarage]

Technically, the order DOESN'T matter if you perform them as a single atomic operation, right? :-)

[@ingchatboy]

Critical Care Nursing Assistant 😆

[@TheFNGee]

@@ingchatboy @davesgarage Uhh...Yeah. I didn't realize it could have so many definitions. 😆

[@thepcenthusiastchannel2300]

I've been running pfsense since 2018 with version 2.4.3. Currently running 23.09.1. It's been very solid for me. I have the AV, IPS, IDS, etc all enabled and route at 10Gbps over Multimode Fiber and SFP+. I went with an AMD Ryzen 7 5700GE as the CPU for it with 16GB of RAM. It's enough for my 10Gbps FTTH Internet connection and multiple users as well as a VPN. To me, it's a solid system and I don't know how I ever did before by buying proprietary Cisco Meraki stuff that cost an arm and a leg in licensing. I really like pfsense and I recommend it.

[@bdlii]

Cool man. What do you use for your VPN client? I tried setting up a native W10 client but didn’t have much luck. Planning to try again and do more searching on best options.

[@jondonnelly4831]

That is one fat pipe!

[@jondonnelly4831]

I used to do the UniFi stack and ripped it all out. I went for microtek, cheap 2.5G switch and a NAS using an amd 4600GE and a stack of cheap nvmes. SMB 3 can combine 2.5G so NAS has 5G and so does my main PC. I have a WiFi 6E ap 2.5G uplink that covers the whole house with 2.4GHz switched off for everything else except my media pc which is on 2.5. It's works ok. Sometimes the microtek router crashes so i added a fan to it and set it to reboot once a week (2 different issues). The NAS uses no raiding and backs up to a pair of 10Tb WD gold on external caddy. I can literrally grab them and have everything. Photos and docs sync to Google drive. 1G symmetric ftth is the fastest i csn get.

[@StephenMcGregor1986]

pfSense is epic

[@thepcenthusiastchannel2300]

@@bdlii I use OpenVPN still. Old habbit. There is WireGuard now also available but haven't configured it yet.

[@HugoDahl]

Something that might be worth covering, or mentioning with a friendly link to another content creator, is that most people also use their ISP-provided device as their WiFi access point. I know you mentioned being a Ubiquiti fanboy, however, the cost of entry can be a bit steep for some of we mere mortals! The reason I mention possibly another content creator, or maybe a collaboration, is that this may also be a proverbial "bridge too far". There is a lot to cover with WiFi hardware selection, such as multiple networks for guests, IoT, security, protocols (more than "WiFi6") and the likes. But I figured it's at least worth a mention, since the solution covered here wouldn't do anything for those using the ISP's gear for WiFi, and wasn't explicitly mentioned! Thanks, and I'll keep subbing and liking as you keep providing awesome value and insight!

[@Aint1S]

Like the no ads at the start... Easy to settle into the video. 👍🏼👍🏼

[@thaphreak]

get premium, seriously, it makes youtube everything you want it to be

[@pete3897]

@@thaphreak really? it will filter sponsor messages that creators include in their videos?! sign me up!

[@Alex-ii5pm]

​@@pete3897no it won't

[@R07ishere]

@@pete3897 There is an extension that does this called "SponsorBlock For KZbin". It's a game changer.

[@scottkuzma125]

@@pete3897 Almost really, however you can scrub past that stuff, so yeah…really is worth the cost of admission.

[@kstaxman2]

This looks like a simple way for most of us to add security and avoid the headaches of having to mess with the rest of our network. Every time I've looked at setting up something like this I've worried about just what you said, ending up with my network down and no understanding of how to get it back up. This set up doesn't leave you facing that prospect. Thanks so much for sharing this with us all. I'll be giving this a try.

[@Techintx]

In grade school my parents got me an Atari 2400, and it was so cool. That got me into electronics. Then I mowed a lot of lawns and bought a TI 99/4a, and that got me on a route towards computer science. Now I am a cofounder of a shop that makes software that has helped change the world. Don’t discount consoles, but understand the power of a fully customizable computer.

[@michaeldeloatch7461]

OK Dave -- show us an OPNSense install on a TI99 ! Definitely not comparable to the Intel Atom, so it should work pretty good, right?

[@IBM29]

As a 5th grader in 1967, I would occasionally help my father transcribe his handwritten FORTRAN programs into something an IBM 1130 could read, using, you guessed it, an IBM29 80 Column Card Puncher. (He was getting his BSEE via night classes compliments of his employer.)

[@Techintx]

@@IBM29 oh god, I remember once helping my dad and dropping a whole stack of punchcards. I don’t remember anything after that.

[@Techintx]

@@michaeldeloatch7461 lmao!!!

[@Techintx]

@@michaeldeloatch7461 It’d actually be really fun to see that happen. I’d imagine you’d get close to 309K baud, if not less.

[@DavidHuffTexas]

_"Errata: OPNSense is FreeBSD, not Linux!"_ I'm an old, grey-bearded Unix sys admin, and that makes me like it even more.

[@JeordieEH]

That is what I was wondering, I remember pfsense was unix and I thought maybe they ported it over to Linux? Thanks for the clarification.

[@imadam]

why do you hate linux?

[@esk103]

You mean there are other *nix based OSs than Linux? FreeBSD is one of the OG versions of Unix. It is horrible what AT&T (or whatever their name was at the time) did to this *nix branch!

[@weekendwarrior3420]

Which severely limits it in wifi support, for example. I'd love it to be based on Linux. I guess this "ex-MS" guy doesn't see the difference, because he said "Linux" at least twice. Geez...

[@DavidHuffTexas]

@@esk103 Well, since AT&T's Bell Labs _invented_ Unix, they did what they darn well pleased with it back in the day :) @imadam I don't "hate" Linux, I just like FreeBSD a bit better. It's dead stable and I'm used to the way you do sys admin tasks on it. I also like the license it's released with better vs. the GPL. And apparently so did MS back in the day. I understand that they used the BSD network stack to add networking to Windows. Don't have details, but I bet our erstwhile host might...

[@johanbtheman]

Back in the days we called it ”bump in the wire”. Have set up a few cisco ASA with transparent filtering. Love your videos ❤ / retired CCNP-R/S, CCNP-S 😅

[@jasonbryant2377]

Dave your dry humor is right up my ally. Thanks for all you do. I love your videos. Yours truly, fellow Techie/Gear Head.

[@RegularCupOfJoe]

Thank you, Dave. I'm the go to "network admin" for many in my family as well as a few business/organizations. I've used PiHoles, which are ok for light or low traffic networks, but i've found that I need a lot more power. Thank you for showing us this. I will start tinkering with it myself and then see if I can apply this to (especially) the businesses and organizations whose networks I help keep up to date. Please share more OPNSense stuff.

[@unicaller1]

The Unbound DNS plugin dose a good job for DNS filtering, Pi-Hole is hard to beat from an admin and stats standpoint though.

[@SpaceCadet4Jesus]

I jumped off the slow moving Ubiquiti ship and landed on a Firewalla Gold life raft. So impressed with this little setup after testing that I'm putting them in client offices now. Set it up takes less than two minutes and further desired segregation/isolation changes are so easy I don't have to bring my networking knowledge. So easy to setup a mess of these around the state and control them from one browser tab at home office.

[@VaticanTop]

Ubiquiti is for your average dummy

[@Notofsoundmind]

I had to replace my off the shelf router with a PC I converted into a router using OpenBSD. My ISP at the time would scan their network for devices that identified as routers, then check if the subscriber had their top tier residential service. If the subscriber was not using the top tier connection, then the ISP would throttle the connection, which is what they did to me. By using a PC as a router, I was able to trick my ISP's automated scanners into believing that I had only one machine attached to my modem. After that my connection speed was never throttled again. A home built, PC based router is the best way to go for many reasons.

[@Andreas-kp9pj]

14:33 Please more digging deeper into OPNsense! Thank you for your high quality content. Best regards

[@pc-fc9du]

This video was linked in a forum post so I watched out of curiosity especially regarding the transparent bridge since I already use OPNsense. Getting to the end, I decided I would subscribe (was watching it on the forum site) and arriving at KZbin discovered I already had, so changed my alerts to 'all' and tapped the like. Very well done video, clear and easy to follow, thank you.

[@lingfish1]

Critical Care Nursing Assistant... lol.

[@danman32]

I was wondering if he was joking or not. But, it 4/1 is it not?

[@xWaLeEdOoOx]

it went past me for a moment then i was wait a min... what?!

[@walter.66]

😂 brilliant.

[@mitya]

Still beats MCSA :)

[@thentil]

Made me actually laugh out loud 😂

[@jordanmelville5786]

Love everything you do Dave! As someone who will be doing the same thing when my new rack mount server arrives I do hope you make more videos on this and similar topics. You're experience and teaching style "works" for me - and I am thankful to have found your channel!

[@jp-ny2pd]

OPNSense is what I use for a lot of BGP edge routers. It works great for sub-10Gig networks. There's also a lot of ISP modem/router combos that mess up IPv6 in bridge mode. So there's a decent chance you may no longer have IPv6 when not using their router.

[@ipavemyownroad]

How do they "mess it up"? Can we work around this?

[@bradouellette1032]

Been running pfsense as my main router for 17 years. Love your videos. One thing I would add. If people are using the Internet Provider' box, they usually include WiFi, and your setup with the transparent filtering it won't see wifi packets.

[@johnnygolden7401]

I plan to disable the wifi from the ISP box and implement a much better managed wifi router behind the OPNSENSE bridge that has full capabilities compared to most ISP boxes these days that limit what you can and can't do

[@a9fc]

hmm this would be only if they're not using the ISP's box only as a bridge?

[@notaras1985]

​@@johnnygolden7401which did you order

[@JafiB]

Thank you for delving deeper into this subject, please keep this type of content coming! I'm also on the spectrum and as an AuDHDer I find your presentation suits me better than most KZbin creators as it's to the point! I need all go and low show to get through tutorials and can follow along with you without losing interest waiting for the next step! Keep up the great videos and thank you for all you have done for us geeks on the spectrum!

[@truckerallikatuk]

I use PFsense myself. An excellent product. Quick edit: gigabit only needs a reasonably new Atom, or a Sandy Bridge era pentium... Dave is right, faster needs more horsepower, especially with IDS/IPS. Also: PF and OPN sense are BSD based, not Linux. Not that it matters.

[@JohnPMiller]

It can matter for hardware support. Linux supported Intel i226 NICs before FreeBSD. I use pfSense CE, but I'm thinking of switching to OPNsense. I'm worried that pfSense CE could become paid software like pfSense Plus.

[@ChrisMilton-Miltron]

BSD\UNIX\LINUX same thing.

[@ralmslb]

Regarding being BSD based and not Linux, it does matter. The reason I stopped using PFSense, was essentially due to the extremely out of date Intel drivers. Switched to Linux (using VyOS), the exact same box, had a 4x performance improvement doing the same thing.

[@darkdelta]

Me too, got a Netgate 4100, mounts in my rack. pfsense, lots of packages to choose from.

[@ramosel]

I run pfSense+ with Snort (inline)and pfBlockerNG on a Netgate SG-4860 appliance. I rarely see CPU usage over 20%... and that is only an Atom 4 core C2558. I really like having the ZFS Boot environments.

[@stucorbishley]

While I probably won’t go the transparent bridge route (pun intended), seeing OpnSense being run through like this makes me want to dive in. Been running MikroTik gear for over decade and have been curious about OpnSense but often ended up overwhelming myself with info and putting it on the back burner. Great video!

[@QualityDoggo]

MikroTik makes cool stuff too... there's always a trade off as things become more hardware-focused or software-defined. They seem to be a good mix in between.

[@priyanrajeevan]

cheap mikrotik router + their winbox ui is quick and simple , swiss knife for the network

[@stucorbishley]

What is (or is there) the equivalent for transparent filtering bridge for MikroTik, seems pretty CPU intensive so thinking it’s not something a 750 series would offer..

[@gregjones3952]

Appreciate the straight forward approach you use. Would love to see more content like this.

[@3rett115]

This is a great start, but unfortunately IDS/IPS is severely limited to being almost useless because of HTTPS/TLS. A PKI can help quite a bit but is more advanced configuration and introduces issues itself with certificate pinning. I would recommend a video on EDR or even something like Crowdsec, which is more effective than an IDS transparent bridge.

[@DaveGamesVT]

Yeah, I was wondering about that. Surely it wouldn't be able to inspect HTTPS/TLS packets...?

[@mattheww797]

is it possible to test downloading the test virus from antiviurs site and seeing if ids/ips catches it?

[@freespeech2007]

I asked AU - Certainly! Detecting viruses over HTTPS (encrypted) delivery is a crucial aspect of network security. Here’s how Intrusion Prevention Systems (IPS) handle this: Traffic Inspection: HTTPS traffic is encrypted using TLS/SSL protocols, making it challenging to inspect the payload directly. However, modern IPS solutions can perform deep packet inspection even on encrypted traffic. They achieve this by: Decrypting the encrypted traffic temporarily. Analyzing the decrypted content for malicious patterns. Re-encrypting the traffic before forwarding it to the destination. Challenges: Performance Impact: Decrypting and re-encrypting traffic adds computational overhead, affecting system performance. False Positives: Decrypting traffic may lead to false positives if the IPS misinterprets benign content as malicious. Privacy Concerns: Decrypting user data raises privacy concerns, especially in enterprise environments. TLS Inspection: Some IPS systems support Transport Layer Security (TLS) inspection. They maintain a database of trusted certificate authorities (CAs) and use it to validate server certificates during decryption. If a server certificate is not trusted or revoked, the IPS can block or alert on the traffic. Signature-Based Detection: IPS systems use signature-based detection to identify known malware patterns. They maintain a database of signatures for various threats. When inspecting decrypted traffic, they compare it against these signatures. Behavioral Analysis: Advanced IPS solutions employ behavioral analysis. They learn normal traffic patterns and detect anomalies. For example, if an encrypted connection suddenly transfers large files, it might raise suspicion. Heuristics and Machine Learning: Some IPS systems use heuristics and machine learning. They analyze traffic behavior and adaptively learn to identify new threats. Evasion Techniques: Malicious actors use evasion techniques to bypass IPS inspection. They split payloads across multiple packets or use obfuscation. Modern IPS solutions continuously evolve to counter these techniques. In summary, while detecting viruses over HTTPS is challenging due to encryption, modern IPS systems employ various techniques to inspect and protect against threats even within encrypted traffic

[@jroysdon]

@@DaveGamesVT - it can still tell domains/IPs and block known-bad or known-compromised sites. But, yes, to really inspect, it would need to MitM the HTTPS traffic to decrypt, inspect, and then encrypt it again. But it can still detect many types of traffic without decryption, just not payload inspection.

[@DaveGamesVT]

@@jroysdon I'm a newbie to this topic but wouldn't that make the virus scanning option for this completely useless?

[@rolandleyco573]

Thank you for getting me started on OPNsense! I'd like to see more OPNSense content to get more tips and trick on my whole system. I recently just started on my networking journey and I all self taught. Guides like this are so digestible, I wouldnt mind getting more information on specific detail and why things should be.

[@JohnPMiller]

14:57 Dave's book helps you understand autism, how to adapt, childhood, parenting, relationships. It's good for anyone who might be or might interact with those on the autism spectrum (and anyone working in tech). I recommend his book without hesitation. I had my local library buy a copy.

[@kevinsadowy5602]

I appreciate your no nonsense approach to narration. Then add just a bit of humour to fill the time as needed. 👍

[@BB-nn9en]

Same. I can't stand modern KZbin and their rewarding of crap filler content to meet a certain video length. Thanks Dave!

[@richziegler4194]

Upgraded from Subbed to "Notify All" This is EXCELLENT content!

[@JohnPMiller]

He's a "solid bell" for me too.

[@Ozz465]

the momment his stle sunk in , i did the same. Straight to the nitty gritt . love it

[@airsay]

Just upgraded to subscribe. Notify all loading

[@ummduhgmail]

Your opnsense box is several magnitudes more powerful than my desktop, lol.

[@CiscoWes]

I was thinking the same thing 😂 I’m overdue for an upgrade 😬

[@Tony-xc5sk]

That makes 3 of us.

[@TSPhotoAtlanta]

Oh no! Get new pants and shoes when they get worn!

[@kk0dj]

​@@Tony-xc5sk- up that 1 to 4 of us!

[@w0lfgm]

@@CiscoWes I have i3 10100 lol

[@FreedomDaddy]

Thank you Dave. I did the IPS / IDS part and the ClamAV. Everything is good but I cannot get VLANS to work on my OPNSense / TP-Link managed switch. So I just made each Proptectli box interface a separate network. It works fine as that is all I need. More OPNSense content would be good, probably things like rules to keep us safe would be a good topic.

[@jaredlozano1692]

This is my first hearing of a transparent filtering bridge, thanks for sharing. 👍

[@kahrhoshe]

me too and im in the internet biz lol

[@tolpacourt]

firsttime hearings

[@What_s_Neu]

Dive deeper! You make great videos explaining things so good.

[@airborneinferno]

You're tempting me into trying this out. I have a 1Gbps connection which my Unifi UDR can't pass fully when running the on board IDS & IPS so this transparent filter makes a lot of sense to me. Thanks for the guidance and will try this out soon when I have found a suitable box to load it onto.

[@thatcreole9913]

Yeah this is perfect. Would love a deeper episode digging into the experience.

[@joebelson7122]

Incredibly helpful. I'm typically over cautious whenever touching my OPNsense configuration, having caused some self inflicted outages - due to ignorance & an inherent rtfm aversion. Dave, thank you for vetting IDS & IPS and ClamAV and showing us how to implement. I am hopeful that you will decide to help us with more OPNsense configuration help. I'm using my implementation for: VLAN segregation (tv, cams, laptops, iot, printers, guests), DHCP, firewall (internet, no internet, and port filtering). How would I implement country filtering?

[@RaymondJohnsonM]

Installing OPNSense as a router greatly improved network performance especially when used with unbound DNS. Page loads are faster, and the Latency in games is about 20-30% better. Goodbye isp hardware. WoW latency was 56-64ms, and it now sits about 36-41ms. Love it!

[@stuartedwards6996]

What hardware are you using for OPNSense?

[@GeorgeMixalis]

This is like the worst video thumbnail in the history of youtube, but i cant help but love it 😊. Great video and content as always

[@alunhassall]

More opnsense videos please. You make it so easy!

[@WillieHowe]

Great video, Dave. Transparent bridging is a jewel that often gets overlooked. You can also do it with the Synology routers -- which IMO have the best parental and content filters available in their price class.

[@BaldrsFate]

Thanks Dave, we need more fun and exciting cyber security videos and other ways of protecting us and our families online

[@MompfDompf]

Love your videos, because it give me some ideas, what to do in the near future on my home network. I'm now so far, as having VLANS to seperate any kind of critical stuff, IoT(rash), Wifi etc. But your videos give an inspiration to my next further steps. Thank you so far.

[@stephanszarafinski9001]

Interesting video, nice to watch as well. I would 100% use a dedicated management interface (on a 3rd interface). That way you don’t pollute your wan traffic with local management traffic. You also don’t have the risk of making the box unmanagable. Anwyay, transparant bridges are cool ❤ I first used one 22 years ago, on redhat linux with iptables. Bridging was just new in the kernel, exciting times 😂

[@shanefeather-lopez5935]

Great video, and I almost considered switching from PFsense to OPNsense but I've spent too much time configuring my current setup to want to figure it all out again in another UI 😂

[@elenorsnow8970]

Clicked on this vid... read the description and thought "OOOH, gotta watch this!" Then I checked and it's DAVE!!! I've read his AMAZING and helpful (and fun!) book. I love his vids! I'm looking with horror and worry at the ending of Win10 support (and oh, I'm TRYING to get into Linux... but my TWO main biz programs don't DO Linux, and until I get smart enough to TRY them with WINE or Bottles or whatever... I must prepare for how to 'go on' when the evil MS shuts 10 down. Please, Amazing Dave... definitely some more vids on security going forward!! THANKS! (Everyone get his book -- it's great!)

[@jimspc07]

@ 6:30 in the video. I love the penultimate solution to something not working as you thought it would. “Just unplug the cable and put it back where is used to go”. That's my kind of solution, easy and not requiring a ”what the hell did I do” investigation and an undoing, before it all works as it was. We know these things often progress without notes and the odd bit of finger pokin’ logic as one get into it. The ultimate solution, of course, when it does not work as intended, being pull out the plug and go to the pub. There is always, always, someone there who has the answer, all it takes is remembering it what it was. I used my ISP router to feed my network router mainly because it was a well known load of junk. I had to use it as there is a VOIP line connection land line and they will not let out the data to enable a move. I have since reverted to the ISP router as I got a new updated one after the old one expired. I should get back to using a safer method again. Before my old management cry of "are we exposed" becomes a realty.

[@scotterdog1036]

I could just hug you Dave! Thank you.

[@rjstewart]

Back around 2000 we implemented a filtering bridge (we called it a Fridge since it was an appliance lol). IIRC it was built on one of the BSDs which had the quirky feature at the time of being able to inspect IP packets with the interfaces bridged and no IP address bound. It was the outside firewall on a DMZ for a large law firm. One of the selling points was you physically had to walk up to it to do anything to it!

[@Craigeek]

I've been running OPNSense for about 7 years now. Minor correction, OPNSense is FreeBSD/Unix not Linux. Great video Dave!

[@3dmakerzone75]

Great rapid fire information on OPNSense. I would to see a deep dive.

[@michaeldeloatch7461]

Thanks Dave -- just about the best content yet among all your vids I have watched.

[@RHviddiz]

Just here for the thumbnail. Dave epic videos slam dunks inspiring to us who are trying to break into and get a glimpse of IT

[@H3cJP]

a tiny correction: OPNsense is based on FreeBSD, not Linux great video, im planning to setup a router with opnsense

[@kmolder9499]

Your previous video was so popular a Telegram scammer reached out to me pretending to be you. This person told me I had won a Macbook pro and iPhone pro... all for being a such a great subscriber.

[@id104335409]

You are!😊

[@EnVideoZone]

Same thing happened to meet with Explaining Computers - they should leave our teachers alone!

[@paulw7404]

I always ask them to send me their Credit Card Number, SS number and Mothers maiden name before any further communication from them!

[@fipoac]

*FreeBSD not Linux based

[@Wayne_Mather]

Was about to say the same thing 😏

[@The_Boctor]

Die-hard fan of both, and was also about to say it.

[@pete3897]

One of many errors in this vid I'm afraid - eg bridges don't route packets, they bridge frames

[@seansingh4421]

When I tried BSD, I was blown away with sheer consistent performance, smoothness and stability. I tried ghostBSD and it was really good.

[@travisaugustine7264]

Beat me to it!

[@xellaz]

Good video! I might try to put this in front of my Firewalla box as a transparent bridge with protection rules as you showed and see how it goes. 😁

[@mowtown75]

enjoyed that, and love that we average Jo's can take back some control at little expense. Thank you Dave!

[@mowtown75]

BTW I paused and went to google for a win.ini file example to remember what I used to do, I think it was there that I did dual booting back in the 90's :)

[@ericandrews4861]

Would love to see more in-depth configuration follow up.

[@dcc1165]

FYI -- small technical note - OPNsense is based on freeBSD based, not Linux - big difference to guys like me who nitpick about the differences...lol...but in the *nix world these days, it hardly matters :). I currently run pfSense and for some reason, it doesn't want to update to the latest version. Some plugins, I use (especially pfBlocker) can't be upgraded because they require the updated pfSense OS, which means those plugins are no longer the latest version. Since I'm looking at a reload/rebuild to get to the latest pfSense version, I may opt for OPNsense, thanks to this video. :)

[@BPL-Whipster]

OPNsense is great. Deciso also offer commercial support but don't seem to be mega cash grabby yet. There's also a third party add on (Zenarmor) available that gives you ngfw features like content filtering and other fancy crap. I'd use it for customers, no problem.

[@mithubopensourcelab482]

If your pfsense is failing to upgrade, here is the super secret sauce to correct the situation. Just run it into pfsense shell [ press f8 on pfsense console or ssh it ] certctl rehash pkg-static update -f pkg-static install -fy pkg pfSense-repo pfSense-upgrade once completed, just visit upgrade, you will get latest updates.

[@rjy8960]

The use of FreeBSD as a base platform is great from a stability perspective - it is pretty much bombproof as far as *nix is concerned but the community is very slow to add new device drivers and then it takes an extra age for the drivers to trickle down into pfsense and opnsense. Opnsense seem to be more responsive to adding new PHY support than pfsense but it is still a lengthy process. It's a stability vs new shiny thing support tradeoff. Not that we don't need support for new shiny things. I've been running pfsesne for a few years and I'm comfortable with it. But it comes down to what you prefer and get used to. Both forks are great.

[@phxsisko]

I retired a netgear R8000 3 months ago and started using a Qotom 8 core Denverton based PC /w 4x10G/5x2.5G ports as my new router/switch using Opnsense. I can testify, Opnsense is hella good. I too selected it over Pfsense for the GUI and because it supports QAT for free over Pfsense which forces you to buy a sub to enable this feature. I also bridged mine, but that's because i'm using it like a home router since it's being used in a home (lol). That being said, the power and flexibility is insane. I wish it had some basic NAS features or a NAS plugin, but other than that, it pretty much does everything I want and more. Opnsense is more popular overseas and I think that's another reason I chose it. I don't plan on retiring in the US given how fast it's declining.

[@r000tbeer]

More OPNSense videos, please! I would suggest: ACME client for GUI certificate automation, an overview of Aliases, and how to setup a VPN connection.

[@lgf30022]

Thanks for this. Now my next network project!

[@dominator2117]

Man, when this guy posts you know its going to be a good video!!! Very Excited for this one!!!! Thanks Dave!

[@lacklustre222]

Wow you’re such a good explainer! I just got a Lenovo tiny pc to make my own router and I love the fact that you said all the pros and cons of keeping your isp router. We need more of this content! You’re great keep it up

[@Sanoja1961]

Looking trough my Amazon orders, I purchased the Protectli Vault five and a half years ago. I have never had an issue with it. I first ran Untangle on it for a couple of years (Great software, but it is not free). I eventually moved to OPNsense and have run it for at least two years. Again no problems. Configuration, maintenance, updates are very easy. My project for this afternoon is to switch it to a transparent filtering bridge configuration. Thanks again, Dave!

[@Surgekid31134]

Love it Dave ! You should make your own fork of this. “DaveSense” 😀

[@spuds7677]

This reminds me of the old Smooth Wall I had setup years ago. I had 3 NICs in it, so I can have an in, out and a DMZ.

[@krizzo]

Basic but good video, FYI OPN is pronounced just like open so it's opensense like open source. You're reasoning for picking it over PF, the UI is basically the number one difference. Ran pfsense for a few years and about 2 years ago, I tried OPNsense in a VM for testing purposes, we've come along way from ipcop and others. Thanks for bringing it back to my attention I may have to try running it again.

[@wngimageanddesign9546]

great video, Dave! Now I know how to go for upgrading an old pfsense build based on an Atom in an old Dell ITX case. New motherboard and cpu! I think I'll try OpenSense this time! And I got a 1U chassis for it too. I need to switch to a proper server tower and integrate my set up instead of a bunch of boxes and cabling piled on a desk.

[@funtimes9098]

I loved this video! And I would also love to see a deeper dive into opensense!!

[@grantc8353]

Thanks Dave. You had me up till 3am as a spur of the moment setting up a new router. My boss said to tell you not to do it again. Thanks 😅

[@johnnyjohnson6771]

Great video on a subject we all need. I love the direct, fast and no bull crap delivery. Please keep up with this type of content. Now subscribed and looking forward to more.....

[@action22611]

I love how your literally the first KZbinr that was honest about likes and subscribes. I rarely ever like or sub but you my friend get both!

[@_goobs]

Thanks for this. I've been using OPNSense for a while and didn't realize I wasn't getting the most I could out of it. And Chuck's a smart guy, but thanks for making content that's easier to digest.

[@JimDumser]

If we're talking ISP all-in-one device (modem, router, switch, and possibly wifi) but connect the transparent bridge downstream of the ISP device, then you're loosing the switch and wifi functionality (or the IDS/IPS/AV capability on those other interfaces). You'd want to put the bridge between the modem and the router (like you did with your DMP), but that isn't possible with ISP provided all-in-one devices.

[@mike_98058]

Thanks for clarifying that. Unfortunately, I have and all-in-one.

[@Blarpington]

I would like to see a deeper dive because many of the features you enabled won't really work without deep packet inspection set up. I don't think deep packet inspection is possible in transparent bridge mode but I would love to be proven wrong about that.

[@SomeGuyWatchingYoutube]

I got it working in pfSense. Your NIC must support RSS and netmap. I always have issues with igb and em cards (probably because igb drivers are built on em.) igc and ix cards work great. There are both inline and legacy deep packet inspection ids/ips. Inline is a bit more powerful. I use the inline ips on the lan and limiters on the WAN. Also I think for the sake of the NIC memory it may be relevant to consider using two separate NICs of matching types. It is also worth noting that NICs only support certain types of ethernet cables. ie no cat8 on an i225 nic if you want everything to work perfect. cat5e or cat6a

[@DominicFlynn]

Yes.. This is a very useful path to explore for your subscribers imo. More videos on OPNSense.

[@Tsiikki]

Dave you used to say that you do these only for subs and likes, now mostly. 😅 Please continue this series!

[@bubaks2]

Shoutout to Chuck!

[@Anthony-pk8mf]

Yes, the Critical Care Nurses Assistant

[@vveso]

Awesome video Dave, very educational and helpful for home protection. Easy to follow along as well! Much appreciated!

[@Suzuki_Hiakura]

I remember going through the trouble of buying a cheap router with multiple antennas just to expand the Wi-Fi signal to the rest of the house... never could do much for antivirus stuff, but was nice to learn how to set up an access point for future reference and learn to navigate the router settings and the like.

[@drbyte2009]

This is THE SOLUTION i was looking for, very nice without having to change much to implement it! PERFECT !!!

[@drewk3402]

This episode was interesting and entertaining, Dave. More, please!

[@CedroCron]

Dave... More Please!! Thanks for the great video today as well.

[@PtolemyPetrie]

You have quickly become one of my favorites on here. I love this video. I hope it takes off so you are encouraged to keep making these great videos. I wonder if you cluster 2 raspberry pi you couldn't make opn sense work on pii, or similar hareware.

[@MatthewReiser123]

Even more excited to try OPNsense than to open my first Playboy magazine, but that was 40 years ago, and things have changed a bit.

[@lightninguru26]

suggestion... in your video description, at the end... consider changing it from "get my book here" to "get Dave's book here" as the previous message is coming off from a presentation point of view rather than first person.

[@lightninguru26]

@Te-le-gr-am_me_TheDavesGarage shut up, you're drunk.

[@justnicksc]

Thanks for the demo. I really enjoy the content you make and have learned alot of great tips from your channel

[@larry400]

Been using pfsense for years as a secondary firewall device on a backup network service, but never seen anything like this. Thanks for the new information and will put it to use very shortly. Need to get a device for home.

[@davethenerd42]

I had no idea I wasn't subscribed. I definitely want more on OPNsense

[@mattador1846]

Bravo! Great content, would like to see more of a deep dive in this and more similar content. Thank you Dave!

[@DaveBoxBG]

MORE PLEASE! This was awesome!

[@justanothernoobe]

this is great from the perspective of HOW to do it ... I'm going to have to search through your content to understand WHY to setup a Transparent Bridge etc., ...

[@paulo.valverde]

Great quality tutorial! Subscribed! Maybe in the future dive into more network segmentation and combining routers and switches. I liked the way you explained things! Very clear and easy to follow.

[@robertsandy3794]

Hi Dave, Definitely would like to hear more from you about OPNSense. It's something that I've been thinking of putting on my network. Hello from Australia!

[@hallkbrdz]

Thanks for this, quite interested in doing this. The $109 PC (with case, 8GB ram, 128GB SSD) should be fine for Starlink I would think.