CIS OPNsense Firewall Benchmark

This recommendation verifies that default admin credentials are changed and separate accounts created on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check admin account settings:
curl -s -k -u 'root:opnsense' https://localhost/api/auth/user | python3 -m json.tool

# Verify default password changed:
# Attempt login with default credentials (should fail)
curl -s -o /dev/null -w '%{http_code}' -k -u 'root:opnsense' https://localhost/api/core/firmware/status

# Change default admin password via console menu option 3
# Or via API:
curl -k -u 'root:CURRENT_PASS' -X POST \
  https://localhost/api/auth/user/setPassword/0 \
  -d '{"password":"<STRONG_NEW_PASSWORD>"}'

# Create separate admin account:
curl -k -u 'root:CURRENT_PASS' -X POST \
  https://localhost/api/auth/user \
  -d '{"user":{"name":"secadmin","password":"<PASS>","groups":["admins"]}}'

This recommendation verifies that external authentication with two-factor is configured on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication servers:
curl -s -k -u admin:$PASS https://localhost/api/auth/server | python3 -m json.tool

# Check TOTP status:
curl -s -k -u admin:$PASS https://localhost/api/auth/settings | grep totp

# Configure LDAP/RADIUS authentication:
# System > Access > Servers > Add
# Type: LDAP, Hostname: ldap.example.com
# Transport: SSL/TLS, Port: 636
# Search Scope: Entire Subtree

# Enable TOTP two-factor authentication:
# System > Access > Tester > Enable TOTP
# System > Settings > Administration > Authentication > Enable 2FA

This setting ensures that web GUI is HTTPS-only and restricted to management interfaces on the OPNsense firewall appliance. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the OPNsense firewall appliance is essential for defense in depth.

# Check HTTPS admin access:
curl -s -k -o /dev/null -w '%{http_code}' https://localhost/

# Verify HTTP redirect:
curl -s -o /dev/null -w '%{http_code}' http://localhost/

# Check web GUI settings:
curl -s -k -u admin:$PASS https://localhost/api/core/system/general | grep -i protocol

# System > Settings > Administration:
# Protocol: HTTPS
# SSL Certificate: Select valid certificate
# HTTP Redirect: Disable (force HTTPS only)
# Listen Interfaces: LAN only

# Via config.xml:
# <webgui>
#   <protocol>https</protocol>
#   <ssl-certref>CERT_REF</ssl-certref>
#   <noantilockout>0</noantilockout>
# </webgui>

This recommendation verifies that SSH uses key-based authentication with root login disabled on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSH configuration:
curl -s -k -u admin:$PASS https://localhost/api/core/system/ssh | python3 -m json.tool

# Verify SSH is key-only:
grep -E 'PasswordAuthentication|PermitRootLogin' /usr/local/etc/ssh/sshd_config

# System > Settings > Administration > Secure Shell:
# Enable Secure Shell: Yes (only if needed)
# Permit root user login: No
# Permit password login: No (key-only)
# SSH Port: Change from 22
# Listen Interfaces: LAN only

# Add authorized keys:
# System > Access > Users > Edit > Authorized keys

This recommendation verifies that firewall rules follow least-privilege deny-all default policy on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List firewall rules:
curl -s -k -u admin:$PASS https://localhost/api/firewall/filter/searchRule | python3 -m json.tool | head -50

# Check for overly permissive rules:
curl -s -k -u admin:$PASS https://localhost/api/firewall/filter/searchRule | grep -i 'any.*any.*pass'

# Firewall > Rules > WAN:
# Default: Block all inbound
# Add specific allow rules for required services only

# Firewall > Rules > LAN:
# Remove default 'allow all' rule
# Add explicit allow rules:
# - DNS to firewall only
# - HTTPS outbound
# - Required internal services
# Add final deny-all rule with logging

This recommendation verifies that anti-spoofing and bogon network blocking are enabled on WAN on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check anti-spoofing:
curl -s -k -u admin:$PASS https://localhost/api/firewall/filter/searchRule | grep -i bogon

# Verify bogon/RFC1918 blocking on WAN:
curl -s -k -u admin:$PASS https://localhost/api/interfaces/wan | grep -i 'block.*bogon'

# Interfaces > WAN:
# Block private networks: Checked
# Block bogon networks: Checked

# Firewall > Settings > Advanced:
# Enable anti-spoofing (pf antispoof)

# Update bogon networks regularly:
# Firewall > Aliases > Update bogons frequency: Weekly

This recommendation verifies that Suricata IDS/IPS is enabled in inline mode with updated rulesets on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check IDS/IPS status:
curl -s -k -u admin:$PASS https://localhost/api/ids/settings/get | python3 -m json.tool | head -30

# Verify Suricata is running:
service suricata status

# Services > Intrusion Detection > Administration:
# Enabled: Yes
# IPS Mode: Yes (Inline)
# Pattern Matcher: Hyperscan
# Interfaces: WAN, LAN

# Download Rulesets:
# ET Open, Abuse.ch, Feodo Tracker
# Enable auto-update: Daily

# Set alert/block policies per ruleset

This recommendation verifies that centralized remote syslog with TLS is configured on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration:
curl -s -k -u admin:$PASS https://localhost/api/syslog/settings | python3 -m json.tool

# Verify remote syslog:
grep -r 'syslog' /usr/local/etc/syslog.d/

# System > Settings > Logging > Targets:
# Add remote syslog target
# Transport: TLS
# Hostname: siem.example.com
# Port: 6514
# Facility: All
# Log Level: Informational

# System > Settings > Logging > Local:
# Preserve logs: 90 days
# Enable firewall log: Yes
# Log default blocks: Yes

This setting ensures that NTP synchronization is configured and restricted to LAN on the OPNsense firewall appliance. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the OPNsense firewall appliance is essential for defense in depth.

# Check NTP configuration:
curl -s -k -u admin:$PASS https://localhost/api/ntpd/settings | python3 -m json.tool

# Verify NTP sync:
ntpq -p 2>/dev/null || chronyc sources

# Services > Network Time > General:
# Enable: Yes
# Prefer IPv4: Yes
# NTP Servers: 0.pool.ntp.org, 1.pool.ntp.org
# Interface: LAN
# Orphan Mode: 12

# Serve time to LAN clients only

This recommendation verifies that Unbound DNS uses DNSSEC and DNS over TLS on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS settings:
curl -s -k -u admin:$PASS https://localhost/api/unbound/settings | python3 -m json.tool | head -20

# Verify DNS over TLS:
grep -i 'forward' /usr/local/etc/unbound.opnsense.d/*.conf

# Services > Unbound DNS > General:
# Enable: Yes
# DNSSEC: Enabled
# DNS over TLS: Enable forwarding with DoT

# Services > Unbound DNS > DNS over TLS:
# Add servers:
# 1.1.1.1:853 (Cloudflare)
# 9.9.9.9:853 (Quad9)
# Verify Domain: cloudflare-dns.com

This recommendation verifies that firmware is current with automatic security update checks on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firmware version:
curl -s -k -u admin:$PASS https://localhost/api/core/firmware/status | python3 -m json.tool | grep -E 'product|version'

# Check for updates:
curl -s -k -u admin:$PASS https://localhost/api/core/firmware/check

# System > Firmware > Status:
# Check for updates regularly
# Enable automatic security updates

# System > Firmware > Settings:
# Update Mirror: closest mirror
# Firmware Flavor: OpenSSL
# Check schedule: Daily

# Apply updates:
curl -k -u admin:$PASS -X POST https://localhost/api/core/firmware/update

This recommendation verifies that unnecessary plugins and services are removed or disabled on the OPNsense firewall appliance. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the OPNsense firewall appliance increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check installed plugins:
curl -s -k -u admin:$PASS https://localhost/api/core/firmware/info | python3 -m json.tool | grep -A2 'plugin'

# List enabled services:
service -e

# Remove unnecessary plugins:
# System > Firmware > Plugins
# Review and remove unused plugins

# Disable unnecessary services:
# Services menu > review each service
# Disable UPnP, mDNS if not required
# Disable SNMP or restrict community string

This recommendation verifies that encrypted configuration backups are automated on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
curl -s -k -u admin:$PASS https://localhost/api/core/backup/providers | python3 -m json.tool

# List local backups:
ls -la /conf/backup/

# System > Configuration > Backups:
# Enable Google Drive / Nextcloud backup
# Backup count: 100
# Encryption password: Set strong password

# Create backup via API:
curl -k -u admin:$PASS -X POST \
  https://localhost/api/core/backup/download/this \
  -o opnsense-backup-$(date +%Y%m%d).xml

This recommendation verifies that CARP high-availability is configured for failover on the OPNsense firewall appliance. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OPNsense firewall appliance vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HA/CARP status:
curl -s -k -u admin:$PASS https://localhost/api/interfaces/vip_settings | python3 -m json.tool

# Verify CARP state:
ifconfig | grep carp

# System > High Availability > Settings:
# Synchronize States: Enabled
# Synchronize Interface: Dedicated sync interface
# Remote System: Backup firewall IP

# Interfaces > Virtual IPs:
# Add CARP VIPs for LAN and WAN
# VHID: Unique per VIP
# Advertising Frequency: Base 1, Skew 0 (master)