OPNSense: Protect Your Home LAN With a Transparent Filtering Bridge with Step by Step Instructions

[@takakazushi6703]

Love the fact that I could follow your step-by-step without getting lost. Yes! Do more OPNsense stuff. Add a segment on using a machine with built-in Wi-Fi so I don’t have to go down the add a separate access point gadget to complicate matters.

[@Texan1048]

My Arris router is a cable + wifi router, pretty rare nowadays tp find one of those

[@drewlarson65]

pf/opnsense suck at wifi, don't do this, that's not what they're for. look into openwrt

[@eDoc2020]

Built-in Wi-Fi won't work as well as a dedicated AP but more importantly very few chipsets work properly in FreeBSD in AP mode.

[@takakazushi6703]

Sadly, I COMPLETELY agree with you. THAT is why I’m hoping that people MUCH SMARTER than me (like Dave here) can suggest solutions so we can get that “built into the router” AP without needing that “extra/separate” AP gadget, it’s software and another layer of complexity.

[@Texan1048]

@@eDoc2020 it works from 300' feet away, thats good enough for me

[@mithubopensourcelab482]

In my professional life I must have done setup of OPNsense / pfSense more than 300 + times. But, I swear, never heard or imagined transparent filtering bridge. Thank you Dave for enlightening me and the world about it. Will surely put in to practice.

[@DavesGarage]

Glad I could bring something new to the table!

[@perwestermark8920]

Have had it on my todo to figure out how to set up transparent filtering on a naked Linux system. But too many other tasks taking time. In my case, I want an existing firewall to believe an external box with modem should look like a local interface so the firewall sees (and thinks it owns) the public IP.

[@abdulsalamshar5601]

yeah he reach Saudi Arabia also , i will do as he advice, thanks dave

[@SpriGgEx]

Me neither and i still dont rly see what the Point of it is. It doesnt come clear to me in this video.

[@perwestermark8920]

@@SpriGgEx Transparent here means it looks like a layer 2 switch. No changes to any IP numbers. So it isn't visible. Until one of the firewall rules decides to block something. Then it's just a magic cable that blocks the bad connections. So the computer on the inside can still believe that it owns the public IP number and runs without firewall.

[@MartinStrazynski]

This is exactly the sort of opnsense configuration I was looking for to implement for home clients. Beautiful, clear and concise video. Much appreciated. Looking forward to more content!

[@TDawgBR]

I appreciate the straight forward approach Dave, and I've noticed quite a few experts nit-picking, I haven't seen anything significant enough to disregard the video. Thanks for this.

[@alexatkin]

If you Google for Suricata there's plenty of people talking about how often it blocks things due to false positives and it wont see most malware as its delivered over SSL. The best you can really do is region and IP blocklists which require much less CPU power.

[@stephensalex]

Experts who needlessly nit-pick are just being difficult. Source, I work in the industry and listen to it daily. From a big-picture standpoint the video is great.

[@ICEMANZIDANE]

a grown up man advocating for a youtuber. You dont need to defend him, he is old enough and probably accepts his mistakes. Gotta love Fans of youtubers, DONT BE a fan of a youtuber.

[@MrCalldean]

@@ICEMANZIDANEYawn. I got bored after grown up.

[@ltlking]

⁠​⁠@@ICEMANZIDANEAssumption much? Maybe he’s just offering a fellow human being some kindness and support. Even grownups appreciate an attaboy from time to time. If you think that’s only for kids, then I’m sorry for you.

[@funknick]

Hey Dave, I just finished setting up a transparent filtering bridge following your steps laid out here. Thank you so much, this was a lot of help! I have a small hiccup (with a solution) I wanted to mention. In your setup steps, you have connected to the LAN port/interface while configuring OPNsense. Prior to setting up the IPS/IDS services, you have us turn off the DHCP and static IP for the LAN port interface. Once this is applied as a configuration, you will lose the ability to access the administration pages. When this happens, you're locked out and can't complete the rest of the steps in your video (turning on IPS/IDS/ClamAV). I think the reason you didn't have this problem is that you have more than 2 ethernet ports on your device (2 SPF, 4 ethernet) and you're using one of the ethernet ports as your management interface. The way I got around this, is the system I'm using has two ethernet ports for LAN/WAN on an Intel NIC and I use the motherboard's built in third ethernet port as a management interface. Before I followed your steps, I configured an interface, static IP, and DHCPv4 service for that 3rd ethernet port that I aptly named `MANAGEMENT`. Then I used that port instead of the LAN port to perform all my configurations. Anywho, that made for a fun little challenge. I had to re-install OPNsense to regain access and do some tinkering to hook up that 3rd port, but it was fun and now I've got a fully working transparent bridge for my ever-growing home network. Cheers and thanks for making this video!

[@SunshineDave]

I got to the end and was locked out as you describe. Also, you can't add a Firewall Pass rule to the WAN interface - WAN is absent in the current version of OPNSense. Hoping for an updated video. I bought the dual NIC mini PC just to do this, and I'll have to start all over. Can this all be done from the text interface with the Mini PC just hooked up to a monitor, keyboard and mouse?

[@funknick]

​@@SunshineDave Unfortunately, no, you can't perform the install from the CLI (text) interface that the system boots up from. Configuration is primarily performed via the web management portal. This is why I wrote my comment, as I think there is a mistake and the latest versions of OPNSense don't work with the instructions provided in this video. To properly set up the device, I believe 3 ethernet ports are required: - WAN - LAN - Management I honestly don't know if it's possible to set the system up properly with only the dual NIC at this time.

[@SunshineDave]

@@funknick I'll probably be looking for another video to setup OPNsense more conventionally. But I do have an ethernet dongle I could use as a third port if I had a clue how to create the management port. The oversight in this video is a fatal one. It should really be redone because success is impossible for most users, even the most advanced.

[@rustyp21]

Could you not have just logged in through the CLI and used option 4 to reset to factory defaults?

[@funknick]

@@rustyp21 sure, I guess I didn’t think of that during the moment. Good tip! Do you have a workaround for the management port issue?

[@bryonnevis2187]

Love the one-liners. @0:57 "The order in which you do things doesn't really matter," said with a completely straight face. CCNA dig pretty funny too!

[@DavesGarage]

Technically, the order DOESN'T matter if you perform them as a single atomic operation, right? :-)

[@ingchatboy]

Critical Care Nursing Assistant 😆

[@TheFNGee]

@@ingchatboy @davesgarage Uhh...Yeah. I didn't realize it could have so many definitions. 😆

[@JafiB]

Thank you for delving deeper into this subject, please keep this type of content coming! I'm also on the spectrum and as an AuDHDer I find your presentation suits me better than most KZbin creators as it's to the point! I need all go and low show to get through tutorials and can follow along with you without losing interest waiting for the next step! Keep up the great videos and thank you for all you have done for us geeks on the spectrum!

[@ragtop63]

For anyone interested in pfSense vs OPNsense, one of the biggest reasons to go with OPNsense is because of its advanced hardware support. It’s a fork of pfSense but the developers build support for newer hardware themselves instead of waiting for the BSD community to do so. This means that you typically aren’t waiting years for the OS to support a new NIC (or something else) like you do with pfSense. They’re both really good choices but OPNsense wins it for me because of the hardware support.

[@Aint1S]

Like the no ads at the start... Easy to settle into the video. 👍🏼👍🏼

[@thaphreak]

get premium, seriously, it makes youtube everything you want it to be

[@pete3897]

@@thaphreak really? it will filter sponsor messages that creators include in their videos?! sign me up!

[@Alex-ii5pm]

​@@pete3897no it won't

[@R07ishere]

@@pete3897 There is an extension that does this called "SponsorBlock For KZbin". It's a game changer.

[@scottkuzma125]

@@pete3897 Almost really, however you can scrub past that stuff, so yeah…really is worth the cost of admission.

[@johanbtheman]

Back in the days we called it ”bump in the wire”. Have set up a few cisco ASA with transparent filtering. Love your videos ❤ / retired CCNP-R/S, CCNP-S 😅

[@Notofsoundmind]

I had to replace my off the shelf router with a PC I converted into a router using OpenBSD. My ISP at the time would scan their network for devices that identified as routers, then check if the subscriber had their top tier residential service. If the subscriber was not using the top tier connection, then the ISP would throttle the connection, which is what they did to me. By using a PC as a router, I was able to trick my ISP's automated scanners into believing that I had only one machine attached to my modem. After that my connection speed was never throttled again. A home built, PC based router is the best way to go for many reasons.

[@SpaceCadet4Jesus]

I jumped off the slow moving Ubiquiti ship and landed on a Firewalla Gold life raft. So impressed with this little setup after testing that I'm putting them in client offices now. Set it up takes less than two minutes and further desired segregation/isolation changes are so easy I don't have to bring my networking knowledge. So easy to setup a mess of these around the state and control them from one browser tab at home office.

[@VaticanTop]

Ubiquiti is for your average dummy

[@jordanmelville5786]

Love everything you do Dave! As someone who will be doing the same thing when my new rack mount server arrives I do hope you make more videos on this and similar topics. You're experience and teaching style "works" for me - and I am thankful to have found your channel!

[@HugoDahl]

Something that might be worth covering, or mentioning with a friendly link to another content creator, is that most people also use their ISP-provided device as their WiFi access point. I know you mentioned being a Ubiquiti fanboy, however, the cost of entry can be a bit steep for some of we mere mortals! The reason I mention possibly another content creator, or maybe a collaboration, is that this may also be a proverbial "bridge too far". There is a lot to cover with WiFi hardware selection, such as multiple networks for guests, IoT, security, protocols (more than "WiFi6") and the likes. But I figured it's at least worth a mention, since the solution covered here wouldn't do anything for those using the ISP's gear for WiFi, and wasn't explicitly mentioned! Thanks, and I'll keep subbing and liking as you keep providing awesome value and insight!

[@dirkbester9050]

If you are too poor to turn off the ISP wifi and use your own, are you simultaneously rich enough for a transparent bridge?

[@rustyp21]

@@dirkbester9050 Not helpful. You just wasted my and everyone else's time with this comment.

[@joebelson7122]

Incredibly helpful. I'm typically over cautious whenever touching my OPNsense configuration, having caused some self inflicted outages - due to ignorance & an inherent rtfm aversion. Dave, thank you for vetting IDS & IPS and ClamAV and showing us how to implement. I am hopeful that you will decide to help us with more OPNsense configuration help. I'm using my implementation for: VLAN segregation (tv, cams, laptops, iot, printers, guests), DHCP, firewall (internet, no internet, and port filtering). How would I implement country filtering?

[@bradouellette1032]

Been running pfsense as my main router for 17 years. Love your videos. One thing I would add. If people are using the Internet Provider' box, they usually include WiFi, and your setup with the transparent filtering it won't see wifi packets.

[@johnnygolden7401]

I plan to disable the wifi from the ISP box and implement a much better managed wifi router behind the OPNSENSE bridge that has full capabilities compared to most ISP boxes these days that limit what you can and can't do

[@a9fc]

hmm this would be only if they're not using the ISP's box only as a bridge?

[@notaras1985]

​@@johnnygolden7401which did you order

[@wilty5]

How do you disable wi-fi on the ISP router?

[@bradouellette1032]

@wilty5 I set mine to bridge mode, so it just acts as a cable modem, and passes it to thr ethernet port, no filtering or wifi. You can probably just disable the wifi, in the settings as another option though.

[@FreedomDaddy]

Thank you Dave. I did the IPS / IDS part and the ClamAV. Everything is good but I cannot get VLANS to work on my OPNSense / TP-Link managed switch. So I just made each Proptectli box interface a separate network. It works fine as that is all I need. More OPNSense content would be good, probably things like rules to keep us safe would be a good topic.

[@bimsbarkas]

Congratulations, both of those steps do nothing. Except slowing down your network.

[@WillieHowe]

Great video, Dave. Transparent bridging is a jewel that often gets overlooked. You can also do it with the Synology routers -- which IMO have the best parental and content filters available in their price class.

[@lingfish1]

Critical Care Nursing Assistant... lol.

[@danman32]

I was wondering if he was joking or not. But, it 4/1 is it not?

[@xWaLeEdOoOx]

it went past me for a moment then i was wait a min... what?!

[@walter.66]

😂 brilliant.

[@mitya]

Still beats MCSA :)

[@thentil]

Made me actually laugh out loud 😂

[@stucorbishley]

While I probably won’t go the transparent bridge route (pun intended), seeing OpnSense being run through like this makes me want to dive in. Been running MikroTik gear for over decade and have been curious about OpnSense but often ended up overwhelming myself with info and putting it on the back burner. Great video!

[@QualityDoggo]

MikroTik makes cool stuff too... there's always a trade off as things become more hardware-focused or software-defined. They seem to be a good mix in between.

[@priyanrajeevan]

cheap mikrotik router + their winbox ui is quick and simple , swiss knife for the network

[@stucorbishley]

What is (or is there) the equivalent for transparent filtering bridge for MikroTik, seems pretty CPU intensive so thinking it’s not something a 750 series would offer..

[@DavidHuffTexas]

_"Errata: OPNSense is FreeBSD, not Linux!"_ I'm an old, grey-bearded Unix sys admin, and that makes me like it even more.

[@JeordieEH]

That is what I was wondering, I remember pfsense was unix and I thought maybe they ported it over to Linux? Thanks for the clarification.

[@imadam]

why do you hate linux?

[@esk103]

You mean there are other *nix based OSs than Linux? FreeBSD is one of the OG versions of Unix. It is horrible what AT&T (or whatever their name was at the time) did to this *nix branch!

[@DavidHuffTexas]

@@esk103 Well, since AT&T's Bell Labs _invented_ Unix, they did what they darn well pleased with it back in the day :) @imadam I don't "hate" Linux, I just like FreeBSD a bit better. It's dead stable and I'm used to the way you do sys admin tasks on it. I also like the license it's released with better vs. the GPL. And apparently so did MS back in the day. I understand that they used the BSD network stack to add networking to Windows. Don't have details, but I bet our erstwhile host might...

[@ZathrusGizmo123]

Thanks Dave for this video! Being on the spectrum this was like eating popcorn for my brain! ❤

[@Techintx]

In grade school my parents got me an Atari 2400, and it was so cool. That got me into electronics. Then I mowed a lot of lawns and bought a TI 99/4a, and that got me on a route towards computer science. Now I am a cofounder of a shop that makes software that has helped change the world. Don’t discount consoles, but understand the power of a fully customizable computer.

[@michaeldeloatch7461]

OK Dave -- show us an OPNSense install on a TI99 ! Definitely not comparable to the Intel Atom, so it should work pretty good, right?

[@IBM29]

As a 5th grader in 1967, I would occasionally help my father transcribe his handwritten FORTRAN programs into something an IBM 1130 could read, using, you guessed it, an IBM29 80 Column Card Puncher. (He was getting his BSEE via night classes compliments of his employer.)

[@Techintx]

@@IBM29 oh god, I remember once helping my dad and dropping a whole stack of punchcards. I don’t remember anything after that.

[@Techintx]

@@michaeldeloatch7461 lmao!!!

[@Techintx]

@@michaeldeloatch7461 It’d actually be really fun to see that happen. I’d imagine you’d get close to 309K baud, if not less.

[@thepcenthusiastchannel2300]

I've been running pfsense since 2018 with version 2.4.3. Currently running 23.09.1. It's been very solid for me. I have the AV, IPS, IDS, etc all enabled and route at 10Gbps over Multimode Fiber and SFP+. I went with an AMD Ryzen 7 5700GE as the CPU for it with 16GB of RAM. It's enough for my 10Gbps FTTH Internet connection and multiple users as well as a VPN. To me, it's a solid system and I don't know how I ever did before by buying proprietary Cisco Meraki stuff that cost an arm and a leg in licensing. I really like pfsense and I recommend it.

[@bdlii]

Cool man. What do you use for your VPN client? I tried setting up a native W10 client but didn’t have much luck. Planning to try again and do more searching on best options.

[@jondonnelly3]

That is one fat pipe!

[@jondonnelly3]

I used to do the UniFi stack and ripped it all out. I went for microtek, cheap 2.5G switch and a NAS using an amd 4600GE and a stack of cheap nvmes. SMB 3 can combine 2.5G so NAS has 5G and so does my main PC. I have a WiFi 6E ap 2.5G uplink that covers the whole house with 2.4GHz switched off for everything else except my media pc which is on 2.5. It's works ok. Sometimes the microtek router crashes so i added a fan to it and set it to reboot once a week (2 different issues). The NAS uses no raiding and backs up to a pair of 10Tb WD gold on external caddy. I can literrally grab them and have everything. Photos and docs sync to Google drive. 1G symmetric ftth is the fastest i csn get.

[@StephenMcGregor1986]

pfSense is epic

[@thepcenthusiastchannel2300]

@@bdlii I use OpenVPN still. Old habbit. There is WireGuard now also available but haven't configured it yet.

[@Andreas-kp9pj]

14:33 Please more digging deeper into OPNsense! Thank you for your high quality content. Best regards

[@jp-ny2pd]

OPNSense is what I use for a lot of BGP edge routers. It works great for sub-10Gig networks. There's also a lot of ISP modem/router combos that mess up IPv6 in bridge mode. So there's a decent chance you may no longer have IPv6 when not using their router.

[@ipavemyownroad]

How do they "mess it up"? Can we work around this?

[@Craigeek]

I've been running OPNSense for about 7 years now. Minor correction, OPNSense is FreeBSD/Unix not Linux. Great video Dave!

[@truckerallikatuk]

I use PFsense myself. An excellent product. Quick edit: gigabit only needs a reasonably new Atom, or a Sandy Bridge era pentium... Dave is right, faster needs more horsepower, especially with IDS/IPS. Also: PF and OPN sense are BSD based, not Linux. Not that it matters.

[@JohnPMiller]

It can matter for hardware support. Linux supported Intel i226 NICs before FreeBSD. I use pfSense CE, but I'm thinking of switching to OPNsense. I'm worried that pfSense CE could become paid software like pfSense Plus.

[@ChrisMilton-Miltron]

BSD\UNIX\LINUX same thing.

[@ralmslb]

Regarding being BSD based and not Linux, it does matter. The reason I stopped using PFSense, was essentially due to the extremely out of date Intel drivers. Switched to Linux (using VyOS), the exact same box, had a 4x performance improvement doing the same thing.

[@darkdelta]

Me too, got a Netgate 4100, mounts in my rack. pfsense, lots of packages to choose from.

[@ramosel]

I run pfSense+ with Snort (inline)and pfBlockerNG on a Netgate SG-4860 appliance. I rarely see CPU usage over 20%... and that is only an Atom 4 core C2558. I really like having the ZFS Boot environments.

[@glen4cindy]

I decided to give this another try. I wiped my entire first install and started again. I tried to follow every step of the instructions. I started with IN and OUT connected between my router and switch. Everything worked as expected. After "Applying changes" I was still able to access the management IP. After moving IN and OUT between my modem and router as suggested here the transparent filter appears to "work" i.e. my internet access works but I cannot access the management IP anymore.

[@thatcreole9913]

Yeah this is perfect. Would love a deeper episode digging into the experience.

[@pc-fc9du]

This video was linked in a forum post so I watched out of curiosity especially regarding the transparent bridge since I already use OPNsense. Getting to the end, I decided I would subscribe (was watching it on the forum site) and arriving at KZbin discovered I already had, so changed my alerts to 'all' and tapped the like. Very well done video, clear and easy to follow, thank you.

[@3rett115]

This is a great start, but unfortunately IDS/IPS is severely limited to being almost useless because of HTTPS/TLS. A PKI can help quite a bit but is more advanced configuration and introduces issues itself with certificate pinning. I would recommend a video on EDR or even something like Crowdsec, which is more effective than an IDS transparent bridge.

[@DaveGamesVT]

Yeah, I was wondering about that. Surely it wouldn't be able to inspect HTTPS/TLS packets...?

[@mattheww797]

is it possible to test downloading the test virus from antiviurs site and seeing if ids/ips catches it?

[@freespeech2007]

I asked AU - Certainly! Detecting viruses over HTTPS (encrypted) delivery is a crucial aspect of network security. Here’s how Intrusion Prevention Systems (IPS) handle this: Traffic Inspection: HTTPS traffic is encrypted using TLS/SSL protocols, making it challenging to inspect the payload directly. However, modern IPS solutions can perform deep packet inspection even on encrypted traffic. They achieve this by: Decrypting the encrypted traffic temporarily. Analyzing the decrypted content for malicious patterns. Re-encrypting the traffic before forwarding it to the destination. Challenges: Performance Impact: Decrypting and re-encrypting traffic adds computational overhead, affecting system performance. False Positives: Decrypting traffic may lead to false positives if the IPS misinterprets benign content as malicious. Privacy Concerns: Decrypting user data raises privacy concerns, especially in enterprise environments. TLS Inspection: Some IPS systems support Transport Layer Security (TLS) inspection. They maintain a database of trusted certificate authorities (CAs) and use it to validate server certificates during decryption. If a server certificate is not trusted or revoked, the IPS can block or alert on the traffic. Signature-Based Detection: IPS systems use signature-based detection to identify known malware patterns. They maintain a database of signatures for various threats. When inspecting decrypted traffic, they compare it against these signatures. Behavioral Analysis: Advanced IPS solutions employ behavioral analysis. They learn normal traffic patterns and detect anomalies. For example, if an encrypted connection suddenly transfers large files, it might raise suspicion. Heuristics and Machine Learning: Some IPS systems use heuristics and machine learning. They analyze traffic behavior and adaptively learn to identify new threats. Evasion Techniques: Malicious actors use evasion techniques to bypass IPS inspection. They split payloads across multiple packets or use obfuscation. Modern IPS solutions continuously evolve to counter these techniques. In summary, while detecting viruses over HTTPS is challenging due to encryption, modern IPS systems employ various techniques to inspect and protect against threats even within encrypted traffic

[@jroysdon]

@@DaveGamesVT - it can still tell domains/IPs and block known-bad or known-compromised sites. But, yes, to really inspect, it would need to MitM the HTTPS traffic to decrypt, inspect, and then encrypt it again. But it can still detect many types of traffic without decryption, just not payload inspection.

[@DaveGamesVT]

@@jroysdon I'm a newbie to this topic but wouldn't that make the virus scanning option for this completely useless?

[@jasonbryant2377]

Dave your dry humor is right up my ally. Thanks for all you do. I love your videos. Yours truly, fellow Techie/Gear Head.

[@fipoac]

*FreeBSD not Linux based

[@Wayne_Mather]

Was about to say the same thing 😏

[@The_Boctor]

Die-hard fan of both, and was also about to say it.

[@pete3897]

One of many errors in this vid I'm afraid - eg bridges don't route packets, they bridge frames

[@seansingh4421]

When I tried BSD, I was blown away with sheer consistent performance, smoothness and stability. I tried ghostBSD and it was really good.

[@travisaugustine7264]

Beat me to it!

[@rjstewart]

Back around 2000 we implemented a filtering bridge (we called it a Fridge since it was an appliance lol). IIRC it was built on one of the BSDs which had the quirky feature at the time of being able to inspect IP packets with the interfaces bridged and no IP address bound. It was the outside firewall on a DMZ for a large law firm. One of the selling points was you physically had to walk up to it to do anything to it!

[@kstaxman2]

This looks like a simple way for most of us to add security and avoid the headaches of having to mess with the rest of our network. Every time I've looked at setting up something like this I've worried about just what you said, ending up with my network down and no understanding of how to get it back up. This set up doesn't leave you facing that prospect. Thanks so much for sharing this with us all. I'll be giving this a try.

[@crazycarl00]

LOL, the CCNA joke got a subscription. Wish I didn't have a crippling ADHD problem that went 40 years before being diagnosed so I could've followed this path after high school like I wanted to at the time. Can't even begin to imagine that life without alcoholism and despair.

[@alunhassall]

More opnsense videos please. You make it so easy!

[@lacklustre222]

Wow you’re such a good explainer! I just got a Lenovo tiny pc to make my own router and I love the fact that you said all the pros and cons of keeping your isp router. We need more of this content! You’re great keep it up

[@jaredlozano1692]

This is my first hearing of a transparent filtering bridge, thanks for sharing. 👍

[@kahrhoshe]

me too and im in the internet biz lol

[@tolpacourt]

firsttime hearings

[@shanefeather-lopez5935]

Great video, and I almost considered switching from PFsense to OPNsense but I've spent too much time configuring my current setup to want to figure it all out again in another UI 😂

[@3dmakerzone75]

Great rapid fire information on OPNSense. I would to see a deep dive.

[@Hindsight101]

Yes please! More OPN videos. The only issue I have is once all this is done I can no longer get any new plugins just the ones I have. Any advice?

[@maxs2982]

So turning on IDS/IDP is just a matter of checking the box? No other configuration needed? That's awesome.

[@xellaz]

Good video! I might try to put this in front of my Firewalla box as a transparent bridge with protection rules as you showed and see how it goes. 😁

[@airborneinferno]

You're tempting me into trying this out. I have a 1Gbps connection which my Unifi UDR can't pass fully when running the on board IDS & IPS so this transparent filter makes a lot of sense to me. Thanks for the guidance and will try this out soon when I have found a suitable box to load it onto.

[@rustyp21]

That's why I'm here - UniFI Dream Router chokes!

[@rolandleyco573]

Thank you for getting me started on OPNsense! I'd like to see more OPNSense content to get more tips and trick on my whole system. I recently just started on my networking journey and I all self taught. Guides like this are so digestible, I wouldnt mind getting more information on specific detail and why things should be.

[@What_s_Neu]

Dive deeper! You make great videos explaining things so good.

[@rasmars]

Please do more of these videos on OPNsense! I've appreciated this very video very much, and it helped me to figuring out how to best implement my hardware firewall. Cheers Dave!

[@RegularCupOfJoe]

Thank you, Dave. I'm the go to "network admin" for many in my family as well as a few business/organizations. I've used PiHoles, which are ok for light or low traffic networks, but i've found that I need a lot more power. Thank you for showing us this. I will start tinkering with it myself and then see if I can apply this to (especially) the businesses and organizations whose networks I help keep up to date. Please share more OPNSense stuff.

[@unicaller1]

The Unbound DNS plugin dose a good job for DNS filtering, Pi-Hole is hard to beat from an admin and stats standpoint though.

[@philrymer8325]

Hi Dave, just saw your tutorial, great video, would like to see a deeper dive on opnsense. You gained another suscriber and like!

[@dcc1165]

FYI -- small technical note - OPNsense is based on freeBSD based, not Linux - big difference to guys like me who nitpick about the differences...lol...but in the *nix world these days, it hardly matters :). I currently run pfSense and for some reason, it doesn't want to update to the latest version. Some plugins, I use (especially pfBlocker) can't be upgraded because they require the updated pfSense OS, which means those plugins are no longer the latest version. Since I'm looking at a reload/rebuild to get to the latest pfSense version, I may opt for OPNsense, thanks to this video. :)

[@BPL-Whipster]

OPNsense is great. Deciso also offer commercial support but don't seem to be mega cash grabby yet. There's also a third party add on (Zenarmor) available that gives you ngfw features like content filtering and other fancy crap. I'd use it for customers, no problem.

[@mithubopensourcelab482]

If your pfsense is failing to upgrade, here is the super secret sauce to correct the situation. Just run it into pfsense shell [ press f8 on pfsense console or ssh it ] certctl rehash pkg-static update -f pkg-static install -fy pkg pfSense-repo pfSense-upgrade once completed, just visit upgrade, you will get latest updates.

[@rjy8960]

The use of FreeBSD as a base platform is great from a stability perspective - it is pretty much bombproof as far as *nix is concerned but the community is very slow to add new device drivers and then it takes an extra age for the drivers to trickle down into pfsense and opnsense. Opnsense seem to be more responsive to adding new PHY support than pfsense but it is still a lengthy process. It's a stability vs new shiny thing support tradeoff. Not that we don't need support for new shiny things. I've been running pfsesne for a few years and I'm comfortable with it. But it comes down to what you prefer and get used to. Both forks are great.

[@r000tbeer]

More OPNSense videos, please! I would suggest: ACME client for GUI certificate automation, an overview of Aliases, and how to setup a VPN connection.

[@H3cJP]

a tiny correction: OPNsense is based on FreeBSD, not Linux great video, im planning to setup a router with opnsense

[@RaymondJohnsonM]

Installing OPNSense as a router greatly improved network performance especially when used with unbound DNS. Page loads are faster, and the Latency in games is about 20-30% better. Goodbye isp hardware. WoW latency was 56-64ms, and it now sits about 36-41ms. Love it!

[@stuartedwards6996]

What hardware are you using for OPNSense?

[@pioruns]

Sorry to disappoint you, OPNSense transparent bridge cannot decrease your real gaming latency. Perceived latency because DNS caching does not affect real connection between you and Blizzard server.

[@richziegler4194]

Upgraded from Subbed to "Notify All" This is EXCELLENT content!

[@JohnPMiller]

He's a "solid bell" for me too.

[@Ozz465]

the momment his stle sunk in , i did the same. Straight to the nitty gritt . love it

[@airsay]

Just upgraded to subscribe. Notify all loading

[@wngimageanddesign9546]

great video, Dave! Now I know how to go for upgrading an old pfsense build based on an Atom in an old Dell ITX case. New motherboard and cpu! I think I'll try OpenSense this time! And I got a 1U chassis for it too. I need to switch to a proper server tower and integrate my set up instead of a bunch of boxes and cabling piled on a desk.

[@stephanszarafinski9001]

Interesting video, nice to watch as well. I would 100% use a dedicated management interface (on a 3rd interface). That way you don’t pollute your wan traffic with local management traffic. You also don’t have the risk of making the box unmanagable. Anwyay, transparant bridges are cool ❤ I first used one 22 years ago, on redhat linux with iptables. Bridging was just new in the kernel, exciting times 😂

[@Suzuki_Hiakura]

I remember going through the trouble of buying a cheap router with multiple antennas just to expand the Wi-Fi signal to the rest of the house... never could do much for antivirus stuff, but was nice to learn how to set up an access point for future reference and learn to navigate the router settings and the like.

[@grantc8353]

Thanks Dave. You had me up till 3am as a spur of the moment setting up a new router. My boss said to tell you not to do it again. Thanks 😅

[@kmolder9499]

Your previous video was so popular a Telegram scammer reached out to me pretending to be you. This person told me I had won a Macbook pro and iPhone pro... all for being a such a great subscriber.

[@id104335409]

You are!😊

[@EnVideoZone]

Same thing happened to meet with Explaining Computers - they should leave our teachers alone!

[@paulw7404]

I always ask them to send me their Credit Card Number, SS number and Mothers maiden name before any further communication from them!

[@dominator2117]

Man, when this guy posts you know its going to be a good video!!! Very Excited for this one!!!! Thanks Dave!

[@BaldrsFate]

Thanks Dave, we need more fun and exciting cyber security videos and other ways of protecting us and our families online

[@MompfDompf]

Love your videos, because it give me some ideas, what to do in the near future on my home network. I'm now so far, as having VLANS to seperate any kind of critical stuff, IoT(rash), Wifi etc. But your videos give an inspiration to my next further steps. Thank you so far.

[@elenorsnow8970]

Clicked on this vid... read the description and thought "OOOH, gotta watch this!" Then I checked and it's DAVE!!! I've read his AMAZING and helpful (and fun!) book. I love his vids! I'm looking with horror and worry at the ending of Win10 support (and oh, I'm TRYING to get into Linux... but my TWO main biz programs don't DO Linux, and until I get smart enough to TRY them with WINE or Bottles or whatever... I must prepare for how to 'go on' when the evil MS shuts 10 down. Please, Amazing Dave... definitely some more vids on security going forward!! THANKS! (Everyone get his book -- it's great!)

[@kevinsadowy5602]

I appreciate your no nonsense approach to narration. Then add just a bit of humour to fill the time as needed. 👍

[@BB-nn9en]

Same. I can't stand modern KZbin and their rewarding of crap filler content to meet a certain video length. Thanks Dave!

[@krizzo]

Basic but good video, FYI OPN is pronounced just like open so it's opensense like open source. You're reasoning for picking it over PF, the UI is basically the number one difference. Ran pfsense for a few years and about 2 years ago, I tried OPNsense in a VM for testing purposes, we've come along way from ipcop and others. Thanks for bringing it back to my attention I may have to try running it again.

[@ericandrews4861]

Would love to see more in-depth configuration follow up.

[@phxsisko]

I retired a netgear R8000 3 months ago and started using a Qotom 8 core Denverton based PC /w 4x10G/5x2.5G ports as my new router/switch using Opnsense. I can testify, Opnsense is hella good. I too selected it over Pfsense for the GUI and because it supports QAT for free over Pfsense which forces you to buy a sub to enable this feature. I also bridged mine, but that's because i'm using it like a home router since it's being used in a home (lol). That being said, the power and flexibility is insane. I wish it had some basic NAS features or a NAS plugin, but other than that, it pretty much does everything I want and more. Opnsense is more popular overseas and I think that's another reason I chose it. I don't plan on retiring in the US given how fast it's declining.

[@Blarpington]

I would like to see a deeper dive because many of the features you enabled won't really work without deep packet inspection set up. I don't think deep packet inspection is possible in transparent bridge mode but I would love to be proven wrong about that.

[@UnixDaemonKiller]

I got it working in pfSense. Your NIC must support RSS and netmap. I always have issues with igb and em cards (probably because igb drivers are built on em.) igc and ix cards work great. There are both inline and legacy deep packet inspection ids/ips. Inline is a bit more powerful. I use the inline ips on the lan and limiters on the WAN. Also I think for the sake of the NIC memory it may be relevant to consider using two separate NICs of matching types. It is also worth noting that NICs only support certain types of ethernet cables. ie no cat8 on an i225 nic if you want everything to work perfect. cat5e or cat6a

[@paulo.valverde]

Great quality tutorial! Subscribed! Maybe in the future dive into more network segmentation and combining routers and switches. I liked the way you explained things! Very clear and easy to follow.

[@GeorgeMixalis]

This is like the worst video thumbnail in the history of youtube, but i cant help but love it 😊. Great video and content as always

[@_goobs]

Thanks for this. I've been using OPNSense for a while and didn't realize I wasn't getting the most I could out of it. And Chuck's a smart guy, but thanks for making content that's easier to digest.

[@beachroadfilms]

Using OPNSense as a transparent bridge is awesome Dave. This is exactly what I was looking for. Thanks Dave !

[@funtimes9098]

I loved this video! And I would also love to see a deeper dive into opensense!!

[@tomkimes]

Great video, informative and straightforward configuration description - just how it should be done! You've got my vote for additional videos. My suggestion is a video to dive into more detail of the transparent filtering bridge in operation, such as: what does a client see when packets are rejected due to geo-ip or virus detection, etc., how to setup log monitors and notifications, backing up the configuration and any other operational suggestions.

[@tomkimes]

I can't see how the ClamAV works through the bridge. I'm pretty sure the configuration is correct, but when I try the Eicar test download the signature appears instead of being blocked. Any suggestions are appreciated. I suspect the ClamAV plugin depends on a Web Proxy??

[@scotterdog1036]

I could just hug you Dave! Thank you.

[@cpcfreak]

Hi Dave, this was a great video, very worthwhile and it's now something I'll seriously consider for my home network. In transparent bridge mode I had to wonder about the potential uses of this tool for network diagnostics or analysis, as a substitute for Wireshark or similar utilities. I've found a common cause of network problems to be one bad / failing device, with more and more connected devices it's becoming a bigger issue and I'd love to avoid the old "switch em off / switch em on" routine if I had a suitable network appliance permanently in place.

[@BillLambert]

You can use "tcpdump" to do this in OPNsense or PFsense, but the bridge is not strictly required. You can run it just as well when configured as a traditional router, as long as the data is flowing through one of the interfaces, tcpdump will see it. The alternative (read: old-school) way to do it is with a switch that does port mirroring, which can be handy since you can then route that mirrored port to another machine on your network that might be better suited for traffic analysis (or simply has a nice GUI for you).

[@SpaceCadet4Jesus]

​@@BillLambertCan't OPNSense assign a mirror port to your extra hardware ports? And if it does, does it operate at full speed?

[@spuds7677]

This reminds me of the old Smooth Wall I had setup years ago. I had 3 NICs in it, so I can have an in, out and a DMZ.

[@darkmatter2632]

Hey Dave, thanks for the walkthrough. {Revised} The dual NIC pc recommend came with Realtek 8125 nic’s that are not supported by FreeBSD.

[@gregjones3952]

Appreciate the straight forward approach you use. Would love to see more content like this.

[@Tsiikki]

Dave you used to say that you do these only for subs and likes, now mostly. 😅 Please continue this series!

[@michaeldeloatch7461]

Thanks Dave -- just about the best content yet among all your vids I have watched.

[@circleofowls]

Please do more OPNSense stuff. I already had a box setup between my modem and switch using an old Dell Optiplex Micro but I hadn't been aware of the Clam AV service, now that I am and have it setup, I'm wondering what else I've missed in there. Fantastic video!

[@Moonraker11]

Very good video! Question, if you have mainly SSL/TLS traffic, how is it going to perform IDS/IPS on packets. Is it just IP reputation based at this point? Or, is the router actually doing HTTPSi (HTTPS inspection) by performing a MitM?

[@orangejuche]

If you're in the middle of the traffic, you can see the entire handshake of establishing the HTTPS/TLS connection, and for corporate networks that use things like Suricata, yes, they do perform HTTPSi, examining the contents of the encrypted packet and then passing them on into the network. The procedure would be the same on your little transparent bridge, it sniffs the keys for the HTTPS connection, and then examines the packets for things that violate the rules you set, and then passes on the good packets while rejecting suspicious or dangerous connections.

[@td19xyz]

​@@orangejuche Nope - that would be an example of a MitM attack. In corporate settings, the HTTPSi inspector has it's own certificate which all corp machines are configured to trust (either by adding it as a certificate, or it being issued by a corp specific root CA, which is added as a certificate). At least, that's what the docs I found say

[@orangejuche]

@@td19xyz My bad, you are correct, and I was incorrect. Suricata can't see what is in an encrypted packet without an HTTPS proxy with a trusted root CA that performs decrypt and encrypt of the traffic and forwarding of the decrypted traffic stream to Suricata. This doesn't mean Suricata is useless for handling HTTPS traffic, as while it can't see what is inside, it still has the metadata of the connection, and can filter attempted HTTPS connections from servers on a list of untrusted clients.

[@mowtown75]

enjoyed that, and love that we average Jo's can take back some control at little expense. Thank you Dave!

[@mowtown75]

BTW I paused and went to google for a win.ini file example to remember what I used to do, I think it was there that I did dual booting back in the 90's :)

[@JimDumser]

If we're talking ISP all-in-one device (modem, router, switch, and possibly wifi) but connect the transparent bridge downstream of the ISP device, then you're loosing the switch and wifi functionality (or the IDS/IPS/AV capability on those other interfaces). You'd want to put the bridge between the modem and the router (like you did with your DMP), but that isn't possible with ISP provided all-in-one devices.

[@mike_98058]

Thanks for clarifying that. Unfortunately, I have and all-in-one.

[@wilty5]

Does anyone know of a solution to make this work if you’re using an ISP All-in-one router/modem device?

[@JimDumser]

You'd have to have the transparent bridge as the only device connected to the all-in-one device, then duplicate all the functionality (WiFi, switching) downstream of the bridge. (AIO -> Bridge -> switch/APs/other devices)

[@action22611]

I love how your literally the first KZbinr that was honest about likes and subscribes. I rarely ever like or sub but you my friend get both!

[@vveso]

Awesome video Dave, very educational and helpful for home protection. Easy to follow along as well! Much appreciated!

[@larry400]

Been using pfsense for years as a secondary firewall device on a backup network service, but never seen anything like this. Thanks for the new information and will put it to use very shortly. Need to get a device for home.

[@justnicksc]

Thanks for the demo. I really enjoy the content you make and have learned alot of great tips from your channel

[@randybaker5971]

Dave, thank you for the info/walk-through. It took me a number of attempts, but I finally have mine up and running! If you have the bandwidth, might you dive into the firewall/firewall rules please. I have searched for over two weeks now and am unable to figure out how to 'harden' my firewall (or if I even need to, due to ignorance on my part...). Hopefully, I have not missed something about this already in the comments section? Thanks again, enjoying the channel!!

[@lgf30022]

Thanks for this. Now my next network project!

[@bryandata6658]

Dave - thanks for suggesting a interesting project to do at home. I discovered quickly that first I needed to set-up management access to my box on OPT1, so that I could fix the things I fouled-up when creating the bridge. In my case, I only plan accessing the box using a laptop and a physical cable on the OPT1 lan-port.

[@Chester-hk6zp]

how do you setup a mgmt interface and access the gui from it?

[@CliveDrone]

@@Chester-hk6zp I'd like to know this too.

[@CedroCron]

Dave... More Please!! Thanks for the great video today as well.

[@MatthewReiser123]

Even more excited to try OPNsense than to open my first Playboy magazine, but that was 40 years ago, and things have changed a bit.

[@mattador1846]

Bravo! Great content, would like to see more of a deep dive in this and more similar content. Thank you Dave!

[@DominicFlynn]

Yes.. This is a very useful path to explore for your subscribers imo. More videos on OPNSense.

[@bubaks2]

Shoutout to Chuck!

[@Anthony-pk8mf]

Yes, the Critical Care Nurses Assistant

[@techieg33k]

I used to run PFSense, but when I moved I needed a device that could run in 24vdc and could run -40f to 130f and never found anything with enough power or affordability. Switched to Mikrotik which has a lot of great control. Thanks for your video. I would run OPNSense if I had the chance

[@jimspc07]

@ 6:30 in the video. I love the penultimate solution to something not working as you thought it would. “Just unplug the cable and put it back where is used to go”. That's my kind of solution, easy and not requiring a ”what the hell did I do” investigation and an undoing, before it all works as it was. We know these things often progress without notes and the odd bit of finger pokin’ logic as one get into it. The ultimate solution, of course, when it does not work as intended, being pull out the plug and go to the pub. There is always, always, someone there who has the answer, all it takes is remembering it what it was. I used my ISP router to feed my network router mainly because it was a well known load of junk. I had to use it as there is a VOIP line connection land line and they will not let out the data to enable a move. I have since reverted to the ISP router as I got a new updated one after the old one expired. I should get back to using a safer method again. Before my old management cry of "are we exposed" becomes a realty.