See the OPNsense configuration series .
This is an advanced guide. It uses Cloudflare DDNS for a domain whose nameservers already point to Cloudflare. Other providers have similar settings, but their fields and policies may differ.
OPNsense includes DDNS support for many providers, including Cloudflare, DuckDNS, DynDNS, DigitalOcean, DuckDNS, GoDaddy, Google Domains, HE.net, Linode, Namecheap, NoIP, OVH, and others.
Configure Dynamic DNS
This example uses firewall.example.com.
- Open Services > Dynamic DNS and click Add.
| Field | Selection | Notes |
|---|---|---|
| Enable | Checked | |
| Service Type | Cloudflare | IPv6 providers are marked with a v6 variant. |
| Interface monitor | WAN | |
| Hostname | firewall.example.com | The hostname to update. |
| Username | [email protected] | Cloudflare login email. |
| Password | Global API Key | See Cloudflare API documentation . |
| Description | Any note |
Click Save.
If the service does not update, click the play icon to disable it, then click it again to enable it. Check the email and API key if the problem continues.
Issue a Let's Encrypt certificate
Cloudflare can add SSL for a domain, but using a certificate directly on OPNsense gives more control and avoids depending on the Cloudflare proxy for every use case.
- Install the
os-acme-clientplugin under System > Firmware > Plugins. - Open Services > Let's Encrypt > Account and click +.
| Field | Value |
|---|---|
| Enable | Checked |
| Name | WebGUI SSL |
| Description | Any note |
| E-Mail Address | Your email address |
Click Save.
- Open Validation Methods and click +.
| Field | Value |
|---|---|
| Enabled | Checked |
| Name | WebGUI SSL |
| Challenge Type | HTTP-01 |
| HTTP Service | OPNsense Webservice (Automatic port forward) |
| IP Auto-Discovery | Checked |
| Interface | WAN |
| IP Address | Leave empty |
Click Save.
- Open Certificates and click +.
| Field | Value |
|---|---|
| Enabled | Checked |
| Common Name | firewall.example.com |
| LE Account | WEBGUI SSL |
| Validation Methods | WEBGUI SSL |
| Auto Renewer | Checked |
| Other fields | Leave defaults |
Click Save, then Issue/Renew Certificate Now.
Use the certificate for the OPNsense GUI
Open System > Settings > Administration and set SSL Certificate to firewall.example.com (Let's Encrypt). Click Save.
You should now be able to access OPNsense at https://firewall.example.com from the LAN.
- Without a firewall rule allowing external access, the hostname is reachable only from the internal network. Do not expose ports 80 and 443 directly to the Internet without a clear security plan.
- If AdGuard Home is installed using the OPNsense AdGuard Home guide , it can also be accessed through the domain.
A shell script that checks the server's current …
Install AdGuard Home on OPNsense to block …- Separate Guest traffic from the main network, …
- Put the ISP modem into bridge mode and configure …
Góp Ý / Bình Luận / Đánh giá