Deploy a Virtual Firewall with OPNsense

Deploy OPNsense in VirtualBox and configure a default-deny firewall ruleset.

Introduction

30 Second Summary

Every time you connect to Wi-Fi at a coffee shop or browse a website at work, a firewall is silently deciding what traffic gets through and what gets blocked. Understanding how firewalls make those decisions is one of the most fundamental skills in cybersecurity.

In this project, you will deploy a professional-grade virtual firewall on your own machine, write rules that control exactly which traffic is allowed, and then prove those rules work by testing them yourself.

What You'll Build

A virtual firewall lab using OPNsense running inside VirtualBox, with custom firewall rules implementing a default-deny security posture.

By the end of this project, you'll have:

  • A running OPNsense 26.1 virtual machine with WAN and LAN interfaces configured for zone-based network security.
  • A default-deny firewall ruleset with specific allow rules for HTTP/HTTPS and DNS traffic.
  • Documented test results and firewall logs proving your rules correctly block unauthorized traffic and permit only what you allow.
  • Secret Mission: Configure a port forwarding rule to expose a service through the firewall.

Are there any prerequisites?

You should be familiar with basic networking concepts like IP addresses, subnets, ports, and protocols. No prior firewall experience is needed. You will need a Windows machine with at least 8 GB of RAM.

Install VirtualBox and Download OPNsense

Before you can deploy a firewall, you need a safe, isolated environment to run it in. Oracle VirtualBox lets you create virtual machines on your Windows computer, so you can run an entire firewall operating system without affecting your host.

In this step, you will install VirtualBox (the virtualization platform), download the OPNsense firewall image, and extract it so it is ready to boot.

In this step, get ready to:
  • Install Oracle VirtualBox 7.2 on your Windows machine.
  • Download and extract the OPNsense 26.1 DVD ISO image.
  • Verify both tools are ready for the next step.
Install Oracle VirtualBox

VirtualBox is a free virtualization tool that lets you run entire operating systems inside your Windows machine. You will use it to host the OPNsense firewall as a virtual machine.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and check whether it appears in the results.

✔️ I see VirtualBox and it shows version 7.2

You already have the right version installed. Skip ahead to the next substep where you download OPNsense.

ⓧ I see VirtualBox but it is an older version

You need to upgrade to version 7.2 for this project. The VirtualBox installer will detect the existing version and upgrade it in place.

  • Open your browser and navigate to the VirtualBox downloads page:
  • https://www.virtualbox.org/wiki/Downloads
  • Click the Windows hosts link to download the installer.
  • Double-click the downloaded .exe file to launch the installer.
  • Click Next through each screen, accepting the default settings.
  • If you see a warning about unsigned drivers, click Continue to proceed.
  • Click Install when prompted, then click Finish to complete the upgrade.

What about my existing VMs?

Upgrading VirtualBox preserves all your existing virtual machines and their settings. Only the VirtualBox application itself is replaced.

ⓧ VirtualBox is not installed

  • Open your browser and navigate to the VirtualBox downloads page:
  • https://www.virtualbox.org/wiki/Downloads
  • Click the Windows hosts link to download the installer.
  • Double-click the downloaded .exe file to launch the installer.
  • Click Next through each screen, accepting the default settings for install location and components.
  • If you see a warning about unsigned drivers, click Continue to proceed. VirtualBox needs these drivers for networking.
  • Click Install when prompted. If a User Account Control dialog appears, click Yes to allow the installation.
  • Click Finish to close the installer.

What does VirtualBox install?

The installer adds the main VirtualBox application, USB support drivers, and network drivers. It also creates an Oracle VirtualBox group in your Windows Start menu.

  • After installation, press the Windows key, type VirtualBox, and press Enter to open it.
  • Confirm the VirtualBox Manager window appears. You can check the version by clicking Help in the menu bar, then About VirtualBox.

VirtualBox Manager does not open?

If VirtualBox fails to start or shows a kernel driver error, try restarting your computer. The installer loads system drivers that sometimes require a reboot to activate.

If you have Hyper-V enabled on your Windows machine, it can conflict with VirtualBox. Search for Turn Windows features on or off in the Start Menu, uncheck Hyper-V, and restart.

help me troubleshoot why VirtualBox Manager is not opening on my Windows machine

Download and extract the OPNsense ISO

OPNsense distributes its installer as a compressed .bz2 archive. You will need 7-Zip to extract the .iso file from inside it.

  • First, check if you have 7-Zip installed. Press the Windows key and type 7-Zip.

✔️ I see 7-Zip in the results

7-Zip is already installed. Skip ahead to downloading the OPNsense image below.

ⓧ 7-Zip is not installed

  • Open your browser and navigate to:
  • https://7-zip.org
  • Click the Download link next to the 64-bit x64 .exe installer.
  • Double-click the downloaded file and click Install to complete the installation with default settings.

Why 7-Zip?

Windows does not natively support .bz2 archives. 7-Zip is a free, open-source file archiver that handles this format. OPNsense's official documentation recommends using it for Windows extraction.

  • Now download the OPNsense image. Open your browser and navigate to:
  • https://opnsense.org/download/
  • Set Architecture to amd64.
  • Set Image type to dvd.
  • Click Download to save the .bz2 file to your computer.

What is the DVD image type?

The DVD image is an ISO installer with live system capabilities. It runs in VGA mode and is the standard choice for installing OPNsense in a virtual machine.

  • Once the download finishes, open File Explorer and navigate to your Downloads folder.
  • Right-click the downloaded .bz2 file.
  • Select 7-Zip from the context menu, then click Extract Here.
  • Wait for the extraction to complete. This produces a .iso file in the same folder.

What does extracting do?

The .bz2 format is just compression (like a zip file with one item inside). Extracting it reveals the actual .iso file that VirtualBox will boot from.

  • Confirm you now see a file ending in .iso in your Downloads folder. It will be approximately 1 GB in size.

Don't see the 7-Zip option when you right-click?

On Windows 11, the context menu sometimes hides third-party options. Click Show more options at the bottom of the right-click menu to reveal the full list including 7-Zip.

If 7-Zip still does not appear, try restarting File Explorer or your computer after installing 7-Zip.

help me get 7-Zip to show up in my Windows right-click context menu so I can extract the OPNsense .bz2 file

Verify your setup
  • Press the Windows key, type VirtualBox, and press Enter to open VirtualBox Manager.
  • Confirm it opens without errors and you see the main VirtualBox Manager interface.
  • Open File Explorer and navigate to your Downloads folder.
  • Confirm you see the extracted .iso file (the OPNsense installer image).

You should now have two things ready: VirtualBox Manager opening cleanly, and the OPNsense .iso file sitting in your Downloads folder.

Your tools are ready. Next up, you will create a virtual machine inside VirtualBox and configure its network adapters to simulate a real firewall deployment.

Create and Configure the OPNsense Virtual Machine

With VirtualBox installed and your OPNsense ISO ready, it is time to build the virtual machine that will become your firewall.

A firewall sits between network zones, inspecting traffic as it flows from one zone to another. To simulate this, you will configure two virtual network adapters on your VM. One faces the internet (WAN) and the other creates a private segment between your Windows host and the firewall (LAN).

In this step, get ready to:
  • Create a new virtual machine with the correct OS type, memory, and disk settings.
  • Configure two network adapters to establish WAN and LAN zones.
  • Mount the OPNsense ISO and boot the VM for the first time.
Create the OPNsense virtual machine

Every virtual machine needs a few basic resources: a processor type, memory, and a hard disk. For OPNsense, you will configure the VM as a FreeBSD system because OPNsense is built on top of FreeBSD.

  • In VirtualBox Manager, click New in the top toolbar to start creating a virtual machine.
  • In the Name field, type OPNsense-Firewall.
  • Set Type to BSD.
  • Set Version to FreeBSD (64-bit).
  • Set Memory Size to 2048 MB.
  • Select Create a virtual hard disk now and click Create.
  • Choose VDI (VirtualBox Disk Image) as the hard disk file type and click Next.
  • Select Dynamically allocated for storage on physical hard disk and click Next.
  • Set the disk size to 16 GB and click Create.

Why these settings?

OPNsense runs on FreeBSD, so setting the VM type to BSD tells VirtualBox to use the right hardware emulation. 2048 MB of RAM is enough for basic firewall operations without straining your 8 GB host machine.

A dynamically allocated 16 GB disk only uses physical space as the VM writes data to it, so it starts small and grows as needed.

You should now see OPNsense-Firewall listed in the left panel of VirtualBox Manager.

Don't see FreeBSD (64-bit) in the Version dropdown?

Make sure you selected BSD as the Type first. The Version dropdown only shows FreeBSD options after you choose BSD as the type.

If you only see 32-bit options, your system may have virtualization (VT-x/AMD-V) disabled in the BIOS. Restart your computer, enter BIOS settings, and enable Intel VT-x or AMD-V.

Help me enable hardware virtualization on my machine.

Configure network adapters for WAN and LAN

Firewalls need at least two network interfaces: one for the untrusted outside network (WAN) and one for the trusted internal network (LAN). You will set up both on your VM now.

Before configuring the VM's adapters, you need to make sure a Host-Only network exists on your machine. This network creates a private connection between your Windows host and the VM.

  • In VirtualBox Manager, click File in the menu bar.
  • Select Tools, then click Network Manager.
  • Click the Host-only Networks tab.
  • If no network is listed, click Create to add one.
  • Click Properties to verify the settings. The adapter should show 192.168.56.1 with a 255.255.255.0 netmask.
  • Click the DHCP Server tab and confirm that Enable Server is checked.
  • Close the Network Manager.

What is a Host-Only network?

A Host-Only network creates a private virtual network between your Windows machine and VirtualBox VMs. Traffic on this network never leaves your computer.

This is perfect for the LAN side of your firewall. Your Windows host will act as a device on the firewall's internal network, letting you access the OPNsense web dashboard directly.

Now configure the VM's two network adapters.

  • Select the OPNsense-Firewall VM in the left panel and click Settings.
  • Go to the Network section.
  • On the Adapter 1 tab, confirm Enable Network Adapter is checked.
  • Set Attached to to NAT.
  • Click the Adapter 2 tab.
  • Check the Enable Network Adapter box.
  • Set Attached to to Host-Only Adapter.
  • In the Name dropdown, select the Host-Only network you just verified (it will appear as something like VirtualBox Host-Only Ethernet Adapter).
  • Click OK to save the network settings.

Why NAT for WAN and Host-Only for LAN?

NAT lets the VM access the internet through your host's connection, just like a real WAN interface reaching the outside world. VirtualBox handles the address translation automatically.

The Host-Only adapter creates an isolated LAN segment. Your Windows machine connects directly to this segment at 192.168.56.1, so you can reach the OPNsense web GUI without exposing it to the internet.

No host-only network is currently selected?

If you see this message when selecting Host-Only Adapter, it means no Host-Only network has been created yet. Go back to File > Tools > Network Manager and click Create under the Host-only Networks tab.

Help me set up a Host-Only network in VirtualBox.

Mount the OPNsense ISO and start the VM

The final step before booting is to attach your OPNsense ISO file so the VM can boot from it, just like inserting an installation disc into a physical machine.

  • With the OPNsense-Firewall VM still selected, click Settings again.
  • Go to the Storage section.
  • Under Controller: IDE, click the disc icon labeled Empty.
  • On the right side, click the small disc icon next to Optical Drive and select Choose a disk file.
  • Navigate to the OPNsense .iso file you extracted earlier and select it.
  • Click OK to save the storage settings.

Now boot the virtual machine.

  • With the OPNsense-Firewall VM selected, click Start in the top toolbar.

A new window opens showing the VM console. You should see OPNsense boot messages scrolling past as the system loads from the ISO.

What should I see?

The console window displays a FreeBSD boot sequence followed by OPNsense initialization messages. After 30-60 seconds, you will see a login prompt. Do not log in yet. You will handle the installation in the next step.

VM window stays black or shows an error?

Make sure the ISO is correctly attached in Settings > Storage. The disc icon should show the OPNsense filename instead of Empty.

If you see a UEFI shell or a "No bootable medium found" message, the ISO was not attached properly. Power off the VM, reattach the ISO, and start again.

Help me fix my OPNsense VM that won't boot.

Your virtual firewall hardware is ready. Next up, you will install OPNsense onto the virtual disk and configure its network interfaces so the firewall can actually route traffic between your WAN and LAN zones.

Install OPNsense and Complete Initial Setup

Your VM is running and showing OPNsense boot messages. The live environment is ready for you to install the operating system onto the virtual disk.

In this step, you will install OPNsense to the VM's hard drive, configure the network interfaces so the firewall knows which adapter is WAN and which is LAN, and then access the web-based management dashboard from your Windows browser.

In this step, get ready to:
  • Install OPNsense onto the virtual disk using the UFS filesystem.
  • Assign network interfaces and set the LAN IP address.
  • Access the OPNsense web GUI from your Windows browser.
Run the OPNsense installer

The OPNsense live environment is a temporary session running from the ISO. To make it permanent, you need to install it onto the VM's 16 GB virtual hard disk.

  • In the VM console window, you should see a login prompt.
  • Type installer as the username and press Enter.
  • Type opnsense as the password and press Enter. The password will not appear as you type.

Why installer instead of root?

OPNsense provides two login accounts in the live environment. Logging in as installer launches the installation wizard automatically. Logging in as root gives you a shell for troubleshooting without installing.

The installer walks you through several screens. Follow these prompts in order:

  • On the Keymap selection screen, accept the default and press Enter.
  • Select Install (UFS) when prompted to choose a filesystem.
  • On the Disk Selection screen, select da0 (your 16 GB virtual hard disk).
  • At the Last Chance! confirmation, select Yes to proceed with formatting.
  • When asked to Continue with recommended swap, select Yes.
  • On the Root Password screen, type a password you will remember and confirm it.
  • Select Complete Install to finish.

What is UFS?

UFS (Unix File System) is a lightweight filesystem inherited from FreeBSD. It uses less disk space than ZFS, making it a good fit for a 16 GB virtual disk in a lab environment.

The VM will now reboot automatically.

Installer not appearing?

If you see a shell prompt instead of the installer, you may have logged in as root instead of installer. Type exit and log in again with the username installer.

If the VM does not respond to keyboard input, click inside the VM window first to capture input. Help me troubleshoot the OPNsense installer

Remove the ISO and assign network interfaces

After the reboot, OPNsense will try to boot from the ISO again if it is still mounted. You need to remove the installation media so the VM boots from the installed disk instead.

  • In the VirtualBox VM window menu bar, click Devices.
  • Hover over Optical Drives.
  • Click Remove disk from virtual drive.
  • If the VM booted back into the installer, power it off using Machine > Reset so it restarts from the installed disk.

Once OPNsense boots from the installed disk, it will display an interface assignment screen or the main console menu.

What are WAN and LAN interfaces?

A firewall sits between two network zones. The WAN (Wide Area Network) interface faces the internet. The LAN (Local Area Network) interface faces your internal devices.

In your VM, Adapter 1 (NAT) provides internet access and should be WAN. Adapter 2 (Host-Only) connects directly to your Windows host and should be LAN.

OPNsense auto-assigns interfaces at first boot. You need to verify the assignment matches your network topology. The key indicator is which interface received a DHCP address from VirtualBox's NAT network (typically 10.0.2.15).

  • Look at the console output. It shows the current interface assignments and their IP addresses.
  • Identify which interface (em0 or em1) shows a DHCP-assigned address like 10.0.2.15. That interface is connected to the NAT adapter and should be your WAN.
  • The other interface (with no address or 192.168.1.1) is connected to the Host-Only adapter and should be your LAN.

If the assignments are already correct (WAN has a DHCP address, LAN is the other interface), you can skip reassignment. If they are swapped, reassign them:

  • From the console menu, select option 1 (Assign interfaces).
  • When asked about LAGGs and VLANs, type N and press Enter.
  • For the WAN interface, type the name of the interface that has the DHCP address (e.g., em0 or em1).
  • For the LAN interface, type the name of the other interface.
  • Confirm the assignment by typing y when prompted.

How to identify your interfaces

The NAT adapter always gives the VM a DHCP address in the 10.0.2.x range. If you see that address on an interface, that interface is WAN. The remaining interface is LAN.

VM booted back into the installer?

If you see the installer login prompt again after rebooting, the ISO was not removed in time. Remove it via Devices > Optical Drives > Remove disk from virtual drive, then reset the VM using Machine > Reset.

Help me get OPNsense to boot from the installed disk

Set the LAN IP and access the web GUI

By default, OPNsense sets the LAN IP to 192.168.1.1. Your Host-Only network uses the 192.168.56.0/24 range, so you need to change the LAN IP to match.

  • From the OPNsense console menu, type 2 and press Enter to select Set interface(s) IP address.
  • Select the LAN interface number when prompted.
  • When asked to configure the IPv4 address via DHCP, type N.
  • Enter the new LAN IPv4 address: 192.168.56.2.
  • Enter the subnet bit count: 24.
  • When asked for an upstream gateway, press Enter to leave it blank (LAN does not need a gateway).
  • When asked about IPv6, type N to skip IPv6 configuration.
  • When asked to enable the DHCP server on LAN, type N.
  • When asked to change the web GUI protocol from HTTPS to HTTP, type N to keep HTTPS.
  • When asked to generate a new self-signed web GUI certificate, type Y.

The console should now display the LAN IP as 192.168.56.2. This means your Windows host (at 192.168.56.1 on the Host-Only network) can reach the OPNsense web interface.

  • On your Windows machine, open your web browser.
  • Navigate to https://192.168.56.2/.
  • Your browser will show a security warning about the self-signed certificate. Click Advanced, then click Continue to 192.168.56.2 (or Accept the Risk and Continue in Firefox).
  • Log in with username root and the password you set during installation.

You should see the OPNsense web dashboard showing the system overview, including uptime, interface status, and system information.

Why the certificate warning?

OPNsense generates a self-signed TLS certificate for its web interface. Since no certificate authority vouches for it, your browser flags it as untrusted. This is expected in a lab environment.

Cannot reach the web GUI?

If the page does not load, check these common causes:

  • Verify the LAN IP is set to 192.168.56.2 in the OPNsense console. The IP should appear on the main menu screen.
  • Open a Command Prompt on Windows and run ping 192.168.56.2. If there is no reply, the Host-Only adapter may be disabled on your Windows machine.
  • In VirtualBox, confirm that Adapter 2 is still set to Host-Only Adapter and the Host-Only network has IP 192.168.56.1.

Help me access the OPNsense web GUI

Your firewall is installed and you can manage it from your browser. Next up, you will configure firewall rules to control which traffic is allowed through.

Configure Firewall Rules with Default-Deny Posture

Your OPNsense firewall is running and accessible from your browser. Right now, the LAN interface likely has default rules that allow all outbound traffic. That means any device on your LAN can reach anything on the internet with zero restrictions.

In this step, you will flip that model on its head by implementing a default-deny security posture. You will delete the permissive default rules, then create specific allow rules for only the traffic you explicitly trust. This is the industry-standard approach used in enterprise firewalls and compliance frameworks.

In this step, get ready to:
  • Delete the default "allow all" LAN rules to establish a default-deny posture.
  • Create specific allow rules for DNS, HTTP/HTTPS, and ICMP traffic.
  • Review rule ordering and confirm the firewall is actively logging traffic.
Delete the default allow rules

A default-deny posture means the firewall blocks everything unless you have explicitly written a rule to permit it. The first thing to do is remove any pre-existing "allow all" rules on the LAN interface.

  • In the OPNsense web GUI, click Firewall in the left-hand menu.
  • Click Rules, then select LAN.
  • You should see one or more default rules that allow all traffic from the LAN network outbound. Select each default rule by clicking its checkbox.
  • Click the delete action (trash icon) to remove the selected rules.
  • Click Apply Changes to commit the deletion.

What is a default-deny posture?

In a default-deny firewall, all traffic is blocked unless a rule explicitly allows it. This is the opposite of "allow all, block specific" where you try to block known bad traffic.

Default-deny is the industry standard because it protects against unknown threats. If a new vulnerability appears, the traffic it uses is already blocked unless you specifically allowed that port and protocol.

Why default-deny instead of allow-all?

An "allow all, block specific" approach requires you to predict every possible threat. With default-deny, you only need to define what should work. Everything else is stopped automatically. This matches enterprise security practices and compliance requirements like PCI-DSS and NIST frameworks.

Your LAN rules page should now be empty. Every packet arriving on the LAN interface is now silently dropped.

Don't see any default rules to delete?

Some OPNsense installations start with no default LAN rules, depending on how interface assignment was handled. If the page is already empty, you are in good shape. The default-deny posture is already active. Help me confirm my LAN rules page is correct.

Create allow rules for essential traffic

With everything blocked, you now need to punch precise holes for the traffic your network actually needs. You will create three rules in a specific order.

Start with the DNS rule so devices on your LAN can resolve domain names.

  • On the Firewall > Rules > LAN page, click the + button to add a new rule.
  • Set Action to Pass.
  • Set Interface to LAN.
  • Set Protocol to TCP/UDP.
  • Set Source to LAN net.
  • Set Destination to any.
  • Set Destination port range to DNS (port 53).
  • Add a description like Allow DNS from LAN so the rule is easy to identify in logs.
  • Enable the Log checkbox so this rule's matches appear in the Live View.
  • Click Save.

Why enable logging on each rule?

The OPNsense Live View only displays log entries for rules that have logging enabled. By checking the Log option on each rule, you can see exactly which traffic is being allowed in real time. This is essential for validating that your rules work correctly.

Next, create the HTTP/HTTPS rule so devices can access websites.

  • Click the + button to add another new rule.
  • Set Action to Pass.
  • Set Interface to LAN.
  • Set Protocol to TCP.
  • Set Source to LAN net.
  • Set Destination to any.
  • Set Destination port range to HTTP (port 80). Then add a second entry for HTTPS (port 443). OPNsense allows selecting multiple ports or a port range in the destination field.
  • Add a description like Allow HTTP/HTTPS from LAN.
  • Enable the Log checkbox.
  • Click Save.

Finally, create the ICMP rule so you can ping the firewall for diagnostics.

  • Click the + button to add a third rule.
  • Set Action to Pass.
  • Set Interface to LAN.
  • Set Protocol to ICMP.
  • Set Source to LAN net.
  • Set Destination to LAN address (this restricts pings to the firewall itself, not the whole internet).
  • Add a description like Allow ICMP to firewall.
  • Enable the Log checkbox.
  • Click Save.
  • Click Apply Changes to activate all three rules at once.

What do these three rules allow?

Rule 1 (DNS): Allows your LAN devices to look up domain names. Without this, nothing can resolve google.com to an IP address.

Rule 2 (HTTP/HTTPS): Allows web browsing over ports 80 and 443. This is the minimum needed for general internet access.

Rule 3 (ICMP): Allows ping to the firewall itself. This is a diagnostic tool so you can quickly verify the firewall is reachable from your host machine.

Can't find the protocol or port options?

Make sure you scroll down in the rule creation form. The Protocol dropdown and Destination port range fields are in the middle section of the form. If Destination port range is not visible, check that your selected protocol is TCP, UDP, or TCP/UDP. ICMP rules do not have a port field since ICMP does not use ports.

Help me configure my firewall rules correctly.

Review rule ordering and enable live logging

Firewall rules are evaluated top-to-bottom. The first rule that matches a packet wins. If your allow rules are in the wrong order or below a block rule, traffic could be incorrectly denied.

  • On the Firewall > Rules > LAN page, confirm your three rules appear in this order from top to bottom:
  • DNS rule (TCP/UDP, port 53, destination any).
  • HTTP/HTTPS rule (TCP, ports 80 and 443, destination any).
  • ICMP rule (ICMP, destination LAN address).
  • If the order is wrong, use the move handle (drag icon) on each rule to rearrange them.
  • Click Apply Changes if you reordered anything.

Why does rule order matter?

OPNsense evaluates rules from top to bottom and stops at the first match. If you placed a broad block rule above your allow rules, traffic would be dropped before the allow rules ever get a chance to match. Always place your specific allow rules above any explicit block rules.

Now open the Live View to confirm the firewall is actively logging.

  • In the left-hand menu, click Firewall.
  • Click Log Files, then click Live View.
  • You should see log entries appearing in real time. These entries show both allowed and blocked traffic as it hits the firewall.

What should I see in the Live View?

The Live View updates in real time whenever a rule with logging enabled matches traffic. You will see columns for timestamp, interface, action (pass or block), source, destination, and port. Blocked packets that do not match any of your three allow rules will appear as default-deny drops.

Live View page is empty?

If no entries appear, generate some traffic by opening a new tab in your browser and navigating to any website. If entries still do not appear, go back to your rules and confirm the Log checkbox is enabled on each rule. Also check that global logging is enabled under System > Settings > Logging.

Help me get the firewall Live View working.

Your firewall now enforces a strict security boundary. Only DNS lookups, web traffic, and pings to the firewall itself are allowed through. Next up, you will put these rules to the test by sending both allowed and blocked traffic through the firewall and checking the logs.

Validate Your Firewall Rules

Your firewall rules are in place, but rules on a screen are just a theory until you test them.

In this step, you will send traffic that should be allowed and traffic that should be blocked, then confirm the firewall handles each correctly. This is the core workflow of firewall validation: prove your security posture works before trusting it in production.

In this step, get ready to:
  • Test allowed traffic (ICMP ping) from your Windows host to the firewall.
  • Test blocked traffic (SSH on port 22) and confirm the firewall denies it.
  • Analyze firewall log entries to document allowed and blocked connections.
Test allowed traffic from your Windows host

Your ICMP rule explicitly allows ping traffic from the LAN network to the firewall. Sending a ping from your Windows host proves this rule is working.

  • Press the Windows key to open your search bar.
  • Type cmd and press Enter to open Command Prompt.
  • Test ICMP connectivity to your firewall by running this command:
ping 192.168.56.2

What should I see?

You should see replies coming back from 192.168.56.2 with response times in milliseconds.

This confirms your ICMP rule (Rule 3) is actively passing ping traffic from your Windows host through to the OPNsense LAN interface.

Not getting replies?

Make sure your Windows Host-Only adapter is still active. Check that the adapter's IP is in the 192.168.56.0/24 range by running ipconfig in Command Prompt and looking for the VirtualBox Host-Only adapter.

Also confirm the OPNsense VM is still running in VirtualBox Manager.

help me troubleshoot why ping to my OPNsense firewall at 192.168.56.2 is not getting replies

Test blocked traffic to confirm default-deny

A firewall that allows everything you configured is only half the story. You also need to prove that traffic without a matching allow rule gets blocked.

  • In Command Prompt, attempt an SSH connection to port 22 on your firewall by running this command:
Test-NetConnection 192.168.56.2 -Port 22

What does this command do?

Test-NetConnection is a PowerShell cmdlet that attempts a TCP connection to a specific port on a remote host.

Since you have no firewall rule allowing SSH (port 22), the connection should fail. The output will show TcpTestSucceeded : False after a timeout, proving your default-deny posture is working.

  • Wait for the command to complete. It may take 10-20 seconds before timing out.
  • Confirm the output shows TcpTestSucceeded : False.

This failed connection is exactly what you want to see. Your default-deny posture is blocking traffic that has no explicit allow rule.

  • Switch back to your browser with the OPNsense web dashboard.
  • Navigate to Firewall in the left sidebar.
  • Select Log Files, then Live View.
  • Look for an entry with a red X icon showing the blocked SSH connection attempt on port 22.

What does the red X mean?

In OPNsense's Live View, a red X icon indicates traffic that was blocked by the firewall. A green checkmark indicates traffic that was allowed.

The blocked entry for your SSH attempt confirms that the default-deny rule caught traffic with no matching allow rule and dropped it.

Don't see the blocked entry in the log?

The Live View only shows entries as they happen. Try running the Test-NetConnection command again while watching the Live View page.

Also make sure you are looking at the correct interface. Filter the log view to show only the LAN interface if available.

help me find blocked SSH traffic in my OPNsense firewall logs

Analyze the firewall log entries

Reading firewall logs is a daily task for security operations teams. Each log entry contains the information you need to determine what happened, where it came from, and whether the firewall handled it correctly.

  • In the Live View page, locate an entry with a green checkmark (allowed traffic).
  • Note the four key fields for that entry: source IP, destination IP, port, and protocol.
  • Now locate an entry with a red X (blocked traffic).
  • Note the same four fields for the blocked entry.

What am I looking at in these log entries?

Each entry tells a story. The source IP shows where the traffic originated. The destination IP shows where it was headed.

The port number identifies which service was being accessed (22 for SSH, 53 for DNS, 80 for HTTP, 443 for HTTPS). The protocol (TCP, UDP, ICMP) tells you the transport method.

Together, these four fields let you reconstruct exactly what a device on your network was trying to do. This is the foundation of log analysis in security operations.

  • Compare your allowed entry (green checkmark) to your blocked entry (red X).
  • Confirm that the blocked entry shows port 22 and the allowed entry shows a port matching one of your allow rules (53, 80, 443, or ICMP).

You have now validated your firewall from both sides. Allowed traffic passes, blocked traffic is denied, and you can read the logs to prove it.

Secret mission

Configure Port Forwarding (Destination NAT)

Your firewall blocks and allows traffic. But what about exposing internal services to the outside world? In this secret mission, you will configure a Destination NAT rule to forward traffic from one port to another, simulating how real enterprises expose web services through a firewall.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project runs entirely locally, so there are no ongoing costs. The VM consumes no CPU or memory when powered off.

Resources you used:

  • OPNsense-Firewall VM (VirtualBox virtual machine file on local disk, approximately 2-3 GB).
  • VirtualBox Host-Only network adapter (192.168.56.1/24).

Keep everything running

No action needed. Choose this if you're still actively building or plan to extend your firewall lab with VPN, IDS/IPS, or VLANs.

  • Leave the VM in VirtualBox Manager. It consumes no resources when powered off.
  • The Host-Only network adapter stays configured and ready for your next session.
  • To shut down the VM cleanly, select it in VirtualBox Manager and click Close > Power Off.

Pause - I'll come back to this later

Shut down the VM to free up memory but keep all files in place for next time.

  • Right-click the OPNsense-Firewall VM in VirtualBox Manager.
  • Select Close > Save State.
  • The VM resumes instantly next time you start it. All firewall rules and configurations are preserved.

Delete - I don't want to use this again

Remove all project resources and start fresh. This permanently deletes your firewall configuration and rules.

  • Right-click the OPNsense-Firewall VM in VirtualBox Manager.
  • Select Remove > Delete all files. This deletes the virtual hard disk and all VM configuration.
  • Remove the Host-Only network adapter by clicking File > Host Network Manager in VirtualBox Manager.
  • Select the 192.168.56.1/24 network and click Remove.
  • Delete the downloaded OPNsense .iso file and .bz2 archive from your Downloads folder.

Nice Work!

Nice Work!

You just deployed a professional-grade virtual firewall from scratch. You now have a working OPNsense lab environment where you can practice firewall administration, test security rules, and build real-world skills that translate directly to enterprise network security.

You've learned how to:

  • Deployed OPNsense 26.1 in VirtualBox with WAN and LAN network zones properly assigned.
  • Implemented a default-deny firewall policy and wrote specific allow rules for HTTP/HTTPS, DNS, and ICMP traffic.
  • Validated firewall rules by testing allowed and blocked traffic and analyzing firewall logs to confirm correct enforcement.
  • Secret Mission: Configured a Destination NAT (port forwarding) rule to expose a service through the firewall.

Ready to quiz yourself?