When you finally get
fed up with your Internet Service Provider’s router
One of the highest recommended alternatives is to create your own using a
custom OPNsense firewall
This places the control back into your grasp.
restrictions imposed on what your internet service provider can do with your connection
, offering extensive protection and numerous features you’ve been lacking until now. However, one of the amazing aspects of OPNsense isn’t merely that it’s a robust router; you have the ability to enhance it further as well.
installing additional services as plugins
Although there are numerous options to explore, certain selections stand out as essential, and those are highlighted below.
Zenarmor
One of the most effective IDS/IPS systems for safeguarding your network
The online world has long been intimidating, yet today it feels even scarier due to the abundance of government-backed cyber attackers, automatic port scanners, and unknown malicious software like viruses and worms ready to infiltrate your infrastructure. While OPNsense effectively safeguards personal networks using standard settings, my initial step is invariably setting up an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS).
While Zenarmor may come at a cost, there’s value in investing in reliable security software that receives regular updates and maintenance. This tool keeps an eye on your network activity, notifies you of suspicious behavior, and has the capability to identify new threats and stop them proactively. Occasionally, when Zenarmor operates in “protect” mode, it might flag normal traffic as questionable due to irregular patterns; however, adjusting these settings to permit legitimate traffic is straightforward once identified.
This tool can prevent malware, phishing websites, spam, botnets, spyware, and much more. It features an intuitive dashboard where you can adjust settings and see what it monitors or blocks. Additionally, it provides insights into DNS requests and other details, giving you a comprehensive understanding of your network activity—from individual transactions up to overall trends.
CrowdSec
Prevent recognized threats from accessing your IP address and scanning it.
While it’s excellent that IDS/IPS systems can alert you once threats are on your network, it’s always better to block them at the source before they can access anything. That’s where CrowdSec comes in, as it stops known threat IPs from even trying to connect to yours. Think of it as a crowdsourced bouncer for your home network, that proactively kicks out known troublemakers before they can start a ruckus. It’s fantastic, and because it drops traffic before it gets to your network, it also reduces noise so that any issues stick out better as you’re not sifting through even more data.
Tailscale
My top choice for a remote access application is simple to install and operate.
Although I have experimented with numerous remote access tools for my home laboratory, I continually return to them.
to Tailscale
It eliminates the hassle of remote access by automating all the VPN connection setups that I find extremely tedious, allowing me to concentrate on utilizing my self-hosted tools instead. The system is based on WireGuard, ensuring strong security, and my Tailnet functions regardless of where my devices are located. Additionally, I can log in and verify my identity through single-sign-on (SSO), eliminating the need for constant active connections. Furthermore, it bypasses the frustrating NAT problems associated with my home fiber internet, so I don’t have to maintain open ports continuously just to make it work.
Nginx
While it may not be the top choice for a reverse proxy right now, it’s the one I am most familiar with using.
Although OPNsense includes plugins for HAProxy, Caddy, Postfix, Relayd, and FTP-Proxy,
I still like to use Nginx more.
I suppose old habits persist stubbornly; however, feel free to opt for another reverse proxy solution if you’d rather do so. Now, I’ve grown accustomed to this setup and understand the implications whenever I update my DNS settings. It serves me well for my requirements—primarily linking with self-hosted Docker containers through user-friendly web addresses instead of needing to recall IP addresses along with their respective ports.
It might not be as fast as HAProxy, or able to pull its own self-signed certs like Caddy, but Nginx is still used by a huge swathe of industry, making it easy for me to find tutorials to fix things when, invariably, they go wrong.
os-git-backup
Keeps my configuration changes backed up to Git
We enjoy documenting all processes within our home lab, and it’s particularly advantageous when this task can be handled automatically through specialized tools. With this excellent plugin, every modification made to your OPNsense firewall gets recorded into Git, ensuring full transparency regarding alterations regardless of who performs them. Consequently, should problems arise, pinpointing specific adjustments becomes straightforward since everything is meticulously documented. Additionally, maintaining backups via these configurations proves invaluable; if ever necessary to reset your router’s storage, restoring functionality happens swiftly without delay.
ntoping
Keep an eye on your entire network for problems
Gaining comprehensive understanding of your network traffic is crucial for conducting home lab experiments. Ntopng allows you to gather information from traffic mirroring sources, SNMP devices, and various others, enabling analysis of the traffic to pinpoint top users, generate reports on network activities, and detect any abnormal traffic trends that may suggest a security intrusion. Setting this up is straightforward; the free edition supports monitoring up to eight interfaces and lets you collect data from wireless access points, specific switch ports, or any additional networking equipment you wish to oversee.
However, monitoring doesn’t stop at traffic alone. Once set up properly, this tool can notify you when TLS certificates are about to expire, signal potential malware for your intrusion detection/prevention systems, inform you if blacklisted hosts attempt to establish connections with your IP address, and much more. Adding
Adding Grafana and InfluxDB to the mix
, you receive a substantial volume of data condensed into an easily readable dashboard to understand what’s occurring across your entire network.
OPNsense has plenty of great plugins, these are just a few of my favorites
Once OPNsense is
installed
, the plugins section is the next stop. There are many options, along with these select few, and chances are you’ll be able to find a plugin for any networking services you use in other installations. It also means that your router and firewall are never static, as you can add or remove new plugins at any time to fit your changed networking needs.