How to Install OPNsense on the Vault

Last Updated On May 21, 2019
You are here:

OPNsense Overview

OPNsense is an open source, easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.  It is a popular choice for those interested in an open source firewall.  More information about OPNsense can be found on the OPNsense website https://opnsense.org/

The following article will detail how to install OPNsense onto your Protectli Vault.

Note: OPNsense 19.1 is now available. A previous article was published at this link regarding an important issue and workaround in OPNsense 19.1 due to the fact that it is based on FreeBSD 11.2 . Both of these issues can be resolved by setting BIOS to UEFI mode on the Vault. This article supersedes that one and following the instructions below eliminates the need to refer to the previous article. See the BIOS Compatibility table at the bottom of this article for more information.

Verify Hardware Recommendations

OPNsense has good documentation regarding hardware recommendations on their web site. Be sure to review the hardware requirements located at https://docs.opnsense.org/manual/hardware.html to verify that  the proper memory and storage is available for the intended application.

Install OPNsense

Obtain the Installation Image and Uncompress it

The OPNsense installation image can be downloaded from https://www.opnsense.org/download/. The same image can be used to install OPNsense on any of the Vault platforms. It is important to choose the correct options when downloading the image including “Architecture” and “Image Type”.  The proper selections are as follows and shown in the screenshot below.

Architecture: AMD64 (64 bit) Note: The 32 bit version will not work.  Be sure to download the 64 bit version.

Image Type: VGA or Serial as needed.  What you choose here depends on how you want to access the OPNsense console.  This is NOT how you will manage your OPNsense installation on a daily basis, but rather the way that you will access OPNsense in the event that you cannot log into the web UI.  A Serial console installation allows you to interface with the OPNsense console without a physical keyboard or monitor.  In order to use the serial connection, you will need to use the blue RJ45 to serial cable provided with your vault.  If your computer does not have a DB9 serial connection, you will need a USB to serial adapter.  A VGA installation will require a USB keyboard and HDMI monitor (FW2B, FW4B, FW6A, FW6B, FW6C) or VGA monitor (FW1, FW2, FW4A).

OPNsense Download Page

As of this writing, the Vault has been tested with version 19.1 of OPNsense.  Unless advised to the contrary, we recommend downloading the latest available version.

Now that the compressed image file has been downloaded, you will need to use a program like “7zip” or “winzip” on Windows to decompress the file.  The resulting file should look the same, except that the file name will now end in “.img” instead of “.img.gz”.

Burn the installation image to a USB drive

The easiest way to transfer the installation image to a USB drive is by using software called “Rufus” on Windows or “Etcher” on Apple OSX. See this link for detailed instructions on how to create a bootable USB drive using Rufus or Etcher.

Note: If using the Vault FW1x, FW2x, or FW4x, be sure to use a USB stick and the USB keyboard with a plug that is relatively skinny.  The 2 USB ports on the Vault are very close to each other and if either the USB stick or the USB keyboard plug is too wide, you will not be able to plug both in at the same time, which will prevent you from doing the installation.

Install the Operating System on the Vault

Once the OPNsense installation image is properly copied to the USB drive, it is ready to be installed on the Vault.

Important Note: The ports marked “WAN” and “LAN” are reversed when using OPNsense. In order to correct this issue see the PORT REVERSAL section below.

  • Verify that the Vault is powered down
  • Verify that the VGA monitor or serial console is connected
  • Verify that the USB keyboard is plugged in (you can skip this step if you are using the serial installer)
  • While powering up the Vault, press “DEL” key and verify that it boots to the BIOS.
  • Select “Advanced” tab
  • Select “CSM Configuration”
  • Select “Boot option filter”
  • Select “UEFI only”
  • Press “F4” to save and exit the BIOS
  • Power off the unit and insert the USB install drive into the other USB port on the Vault
  • While powering up the Vault again, press “F11” key and verify that it boots to the BIOS boot options screen.
    • NOTE: If using the serial installer, F11 commonly will not show the boot options menu.  In this case, use the “DEL” key to enter the BIOS.  In the BIOS, a specific boot device can be chosen from the last, or rightmost tab.
  • Select the USB drive UEFI partition to boot from
  • Verify that the Vault boots into a console menu/graphic and begins the installation process

PORT REVERSAL steps:

As noted above to fix the WAN/LAN ports use the following:

When prompted during install to “Press any key to start the manual interface assignment”. Note you only have a few second before this times out.

  • Press any key to continue

When prompted “Do you want configure VLANs now?”

  • enter the following command:N

When prompted to “Enter the WAN interface name”

  • For FW1, FW2, FW4A, FW6A,B,C enter the following command:em0
  • For FW2B and FW4B enter the following command: igb0

When prompted to “Enter the LAN interface name”

  • For FW1, FW2, FW4A, FW6A,B,C enter the following command: em1
  • For FW2B and FW4B enter the following command: igb1
  • If you have additional interfaces those can be configured in the GUI after install is complete
  • Verify login prompt occurs. In order to finish install of OPNsense, login as user “installer” with password “opnsense”
  • Verify installation screen appears. Follow the prompts on the screen to complete the installation
  • When prompted, reboot the system
  • Verify unit reboots to login prompt
  • Browse to the OPNsense dashboard at 192.168.1.1 login, and verify the dashboard is displayed

OPNsense has a comprehensive installation procedure that describes each step of the process here.

OPNsense Dashboard

At this point, OPNsense should be up and running on The Vault. However, If you experience any issues, please feel free to reach out to us at: support@protectli.com.

OPNsense BIOS Compatibility

The table below shows the compatibility of tested releases of OPNsense and BIOS on each of the Vaults.

VaultOPNsense VersionBIOS - LegacyBIOS - UEFIBIOS - coreboot
FW119.1.4Fail, Use UEFITestedN/A
FW219.1.4Fail, Use UEFITestedN/A
FW4A19.1.4Fail, Use UEFITestedN/A
FW2B19.1.4TestedTestedNot Tested
FW4B19.1.4TestedTestedNot Tested
FW6A19.1.4TestedTestedN/A
FW6B19.1.4TestedTestedN/A
FW6C19.1.4TestedTestedN/A