Tutorial

Build an OPNsense 26.7 Firewall on a Dual-NIC Mini PC

Turn a two-port N100 box into a full router: write the 26.7 VGA image, install to the SSD with ZFS, assign WAN and LAN, then harden the WAN side and keep a restorable config backup.

Intermediate ⏱ 50 minutes 8 steps

What you need

  • Mini PC with at least two Ethernet ports (Intel i226-V 2.5GbE is the common choice)
  • 8 GB RAM and a 64 GB or larger SSD
  • 4 GB USB stick
  • Monitor and keyboard for the install, or a serial console
  • Your ISP modem or ONT with an Ethernet handoff

1Pick a box with two real NICs

OPNsense is x86-64 only, so an ARM mini PC is out. A router needs one WAN port and one LAN port as a minimum; the popular N100/N150 firewall boxes ship two to four Intel i226-V 2.5GbE ports, which FreeBSD binds to the igc driver. 8 GB of RAM covers a home network running the resolver, an IDS and a handful of VLANs comfortably. Single-NIC boxes only work as router-on-a-stick with a VLAN-capable managed switch.

NoteCheap boxes with Realtek RTL8125 adapters do work, but Intel NICs have the better driver support and lower CPU cost per packet under pf.

2Write the 26.7 VGA image to a USB stick

The current Community Edition series is 26.7 (released July 2026). Download the VGA image plus the checksum file from the official mirror, compare the SHA-256 hash, then decompress and write the raw image with dd. The VGA image boots a graphical live environment; the serial image is for headless boards and the DVD image for optical media.

Download
curl -LO https://pkg.opnsense.org/releases/26.7/OPNsense-26.7-vga-amd64.img.bz2
curl -LO https://pkg.opnsense.org/releases/26.7/OPNsense-26.7-checksums-amd64.sha256
Verify the hash (macOS: shasum, Linux: sha256sum)
shasum -a 256 OPNsense-26.7-vga-amd64.img.bz2
grep vga OPNsense-26.7-checksums-amd64.sha256
macOS
diskutil list
diskutil unmountDisk /dev/diskN
bunzip2 -k OPNsense-26.7-vga-amd64.img.bz2
sudo dd if=OPNsense-26.7-vga-amd64.img of=/dev/rdiskN bs=4m
Linux
lsblk
bunzip2 -k OPNsense-26.7-vga-amd64.img.bz2
sudo dd if=OPNsense-26.7-vga-amd64.img of=/dev/sdX bs=4M status=progress conv=fsync
Notedd overwrites the target device without asking. Confirm /dev/diskN or /dev/sdX is the USB stick, not your boot disk, before pressing enter.

3Prepare the BIOS and boot the live environment

Set the AC power-loss behaviour to power on so the firewall comes back by itself after an outage — Beelink exposes it as State After G3 → S0 State, most AMI-based boards as Restore on AC Power Loss → Power On. Turn off any fast-boot option that skips USB enumeration, then boot the stick in UEFI mode, which the VGA image supports. The live environment answers on https://192.168.1.1 with root / opnsense.

NoteThe live environment runs from the stick and keeps nothing: every setting you make there is lost at reboot, so go straight to the installer.

4Install to the SSD with ZFS

At the live console log in as installer with password opnsense. Accept the default keymap, choose ZFS, keep the stripe layout on a single disk, select the internal SSD (nvd0 or ada0, not the USB stick), confirm the destructive-warning prompt, set a root password and finish. ZFS gives you boot environments you can roll back after a failed update, plus compression and checksums; pick UFS only on SD or eMMC storage.

Live console
login: installer
password: opnsense
If the installer user is missing
login: root
# choose 8) Shell, then:
opnsense-installer
NoteThe installer can also be started over SSH from another machine on 192.168.1.1, which is handy when the box has no monitor attached.

5Assign the interfaces from the console

On the first boot after installation OPNsense asks which port is which: it wants the LAN interface first, then the WAN, then any OPT interfaces. The stock assumption is LAN on port 0 and WAN on port 1, so if you cabled the modem to port 1 the assignment already matches. When the labels on the chassis do not tell you which port is which, drop into the shell and list the devices, then move the cables until the DHCP lease on WAN appears.

Console option 8) Shell
ifconfig -l
# igc0 igc1 lo0 ...   (i226-V ports appear as igc0/igc1)
Expected banner after assignment
*** Welcome to OPNsense 26.7 ***
WAN (igc1) -> v4/DHCP4: 192.168.2.100/24
LAN (igc0) -> v4: 192.168.1.1/24
NoteInterface names follow the driver, not the printed port number: Realtek ports show up as re0/re1, Intel i226-V as igc0/igc1. Assignments live in config.xml, so they survive reboots.

6Set the LAN address, DHCP and DNS

Open https://192.168.1.1 and log in as root, then change that password under System → Access → Users before anything else. Under Interfaces → LAN set the static IPv4 address and prefix (192.168.1.1/24), then enable DHCP for LAN under Services → Dnsmasq DNS & DHCP — the current default server, with Kea available as an alternative — using a pool that excludes the firewall address, for example 192.168.1.100 to 192.168.1.200. Upstream resolvers go in System → Settings → General, and dnsmasq forwards LAN queries to them.

NoteIf you change the LAN subnet, change the DHCP pool in the same session. A pool still pointing at 192.168.1.0/24 on a 10.0.0.0/24 LAN hands out unreachable addresses.

7Lock down the WAN and test from a client

Under Interfaces → WAN tick Block private networks and Block bogon networks when your ISP gives you a public address — that drops spoofed RFC 1918 and reserved source addresses before they reach the rule set. Firewall → Rules → WAN is default-deny, so leave it alone unless you publish a service. Then confirm the whole path from a laptop: it should pull a lease, resolve names through the firewall, reach the internet, and see nothing inbound from outside.

Client check (macOS/Linux)
ipconfig getifaddr en0            # Linux: ip -4 addr show
ping -c 3 192.168.1.1
dig @192.168.1.1 opnsense.org +short
ping -c 3 1.1.1.1
NoteOnly tick Block private networks when the WAN really is public. Behind an ISP router doing NAT, the WAN lease is a private address and your uplink dies.

8Update to 26.7.x and export the configuration

System → Firmware → Status installs the fortnightly minor updates in place; that is where the security fixes land. Major upgrades are different: console option 12 downloads the complete release offline, reboots, installs and reboots again, so run it with a monitor or serial cable attached and no expectation of web access during the process. Finish by downloading the configuration from System → Configuration → Backups and storing that XML off the box: it restores interfaces, rules, VPNs and certificates in one upload.

NoteKeep the exported config.xml current after every change. Reinstalling from scratch takes an hour; restoring a backup takes five minutes.