OPNSense Firewall Rules Explained

00:00 - Intro
00:31 - Resources used in this video
01:28 - Rule action types
02:25 - Add private IP ranges alias
03:26 - LAN rules management
13:02 - Quick firewall "tick-box"
15:35 - Rules direction
16:35 - Rule cloning
18:00 - WAN rules management
20:27 - Additional tips
22:48 - Outro

PayPal Donation to support the release of new videos:

View and support us at LBRY:

[HannesDi]

99% percent of the videos out there claim to get you started with OPNsense, but what I saw there was just bullshit about downloading and installing, sometimes then they showed the interface but stop at the relevant parts.... "How to use the firewall". This is where your video is gold because it finally explains useful things!

Thanks for this short but great explanatory video

[TimmyNET]

I forget about your channel. You can go watch someone else with a 5 minute video but you will spend 3 hrs filling the gaps left out. Your video instructions are clear and direct. Thank you.

[weazel]

Hands down the best video concerning opnsense rules if found until now. Thank you very much.

[paulmedcalf]

Hands Down the best description for Firewall rules for OPNsense! Thankyou!

[SmalltimR]

There are so many superficial and useless Opnsense videos out there - this one is not the case!
- thank-you for posting this, and taking the time to explain things properly

[rentownnz]

This is by far the best working run through on how the interfaces relate to one another and I learnt some great tricks with moving the rules around as well. Great stuff. I was almost there but since you easily explained how the data is matched to a a top down approach, it makes logical sense and I imagine it as if there was water pouring in from the tip rule and the different filters the data out like different water filters take out the different minerals ... and then you are left with the pure water (DATA) that can freely flow into the system.

This really helped me diagnose and also get both my NORD VPN rules ordered correctly and my Wire guard up and running as well.... Just understanding that the Lan Interface has the highest hierarchy in the system just below the WAN interface.... lets me look at the LAN interface rules first, then replicated them into each Vlan Subnet that I had created for IoS, Guest, MainLan and VPN Test Vlan. I had all of the RFC1918 Blocking sorted, but now have a solid understanding on where it needs to be in the rule list. Thank you so much for taking the time to explain this in an easy to understand and almost working lab style! FANTASTIC JOB!

[Syrma]

I rarely, if ever comment or like a video, but this is one of the best I have seen, and I'm only half way through. Really easy to understand, explained well, and more importantly, shown what the changes do. As others have said, other videos make assumptions on knowledge levels. Great work

[SonicNinja]

Simple to understand and straight to the point. Thanks for the video.

[Serenuss]

This is brilliant, thank you for this. Best opnsense video I've seen so far on firewall rules.

[citizenatlrge]

The algorithm has done good work tonight! This is exactly what I was thinking of trying to search. No really, I hadn't even searched for this particular info yet, I'm still messing with unrelated things in OPN like monitoring and geoip, but here this is, right on time. Sometimes the algo scares me, but then things like this happen and I'm glad it works sometimes.

[drdadventures]

Great job explaining everything, finally a helpful video on firewall rules.

[klausagnoletti]

Great video. Been opnsense user for 5 yrs. But the penny finally dropped on a few of the firewall things after seeing your video. Thanks!

[FunctionGermany]

I suggest merging the first "allow internet" and the second "block private ranges" rules together for simplicity.
Instead of the two, you can make one "pass" rule where you choose "private ranges" as the destination and then INVERT the match.
This way, the single pass rule allows traffic to all destinations except the private ranges - in other words only the internet.
As a rule of thumb, avoid drop/reject rules when you can simply make stricter pass rules on top of the default "drop everything" rule.

[CrackFactory]

I learned so much from you very quickly. Thank you!

[cohan]

Saved this beginner hours. Thanks for this simple run-through, just brilliant.

[MarcoSerralheiro]

I was going nuts because LAN didn't have access to the Internet no matter what I tried. Had no clue that "pfctl -d" would do much more than just enable remote access to the OPNsense interface.
Thanks a lot!

[RFGSwiss]

this is the only useful opnsense video i found. you picked exactly the right usecases. thanks alot!

[MrGazp]

Thank you very much! very useful and easy to follow. greatly appreciated

[NotACrookNixon]

Excellent video - very clear demonstration and explanation.

[mate_starbuck]

You are a very good teacher, thanks for the upload!!!