Firewall Lab (OPNsense)

Done
NetworkingFirewallActive DirectorySecurity

Firewall Lab (OPNsense)

Goal

Place an OPNsense firewall between a Windows Server domain controller (DC01), a Windows client, and the internet. Restrict outbound traffic from the server to only what it needs.

Environment

  • Hypervisor: VMware
  • Firewall: OPNsense, LAN on em0, WAN on em1
  • Server: Windows Server with Active Directory, DHCP, and DNS
  • Client: Windows, joined to the domain
  • Networks: a bridged adapter for WAN, a VMnet for the firewall LAN, and a host-only network for the lab

Steps

  1. Downloaded the OPNsense ISO and installed it in VMware. Took snapshots of the server and client before each change.
  2. Fixed interface mapping. The VM adapter order did not match OPNsense's interface assignment, so I swapped the adapters on both the firewall and the client.
  3. Fixed the DHCP scope. Added option 003 (Router) with the OPNsense LAN address, and set the gateway on the server's network adapter.
  4. Fixed the subnet mismatch. The server and client were on the DC's subnet, but the firewall LAN was on another one. I moved the OPNsense LAN address into the same subnet.
  5. Disabled the local DHCP server in VMware Virtual Network Editor, so the VMs got their addresses from the domain controller.
  6. Added two DNS forwarders on DC01: 1.1.1.1 and 8.8.8.8.
  7. Added firewall rules for DC01, evaluated in order:
    • Allow DNS (port 53) to the DC's address
    • Allow NTP, so the DC's clock stays accurate for Kerberos
    • Allow HTTP and HTTPS, for Windows updates
    • Block all other outbound traffic from DC01

Results

  • The client gets an address from the domain controller and reaches the internet through OPNsense.
  • DC01 can only make outbound connections to DNS, NTP, HTTP, and HTTPS.

Lessons learned

  • Check interface order before debugging anything else. A swapped adapter looks like a routing problem.
  • Compare the DHCP scope's subnet with the firewall's LAN subnet. They must match.
  • Firewall rules are checked from top to bottom, and the first match applies. The block rule must come after the allow rules.
  • The default "allow LAN to any" rule still applies to the client. Only the server's rules are restricted so far.