OPNsense Core Features Setup: Blocking, DNS Resolution & Hardening

You installed OPNsense. The WAN is up, traffic is flowing, and you feel good. Then you realize the firewall logs show only raw IPs, your kids hit gambling sites from the family VLAN, and the admin panel is still reachable on port 443 from anywhere. Time to fix all three.

This post covers the four tasks that should happen right after a fresh OPNsense deployment:

1. Block a specific website using aliases and firewall rules
2. Resolve LAN IP addresses to hostnames in firewall logs
3. Apply category-based DNS blocking (gambling, malware, torrents)
4. Harden OPNsense itself against misconfiguration and unauthorized access

Environment: OPNsense 26.1.2, Unbound DNS Resolver, single LAN subnet 10.10.1.0/24.

1. Block a Specific Website

There are two approaches. Use Option 1 (Firewall Alias) for blocking specific sites — it works and is the most direct. Use Option 2 (DNS override) as a complementary layer or when you want a lightweight block without a firewall rule.

Option 1 — Block via Firewall Alias (Recommended)

Step 1 — Create the Alias

Navigate to Firewall → Aliases → click +:

In the Content field, add all domains the site depends on — the main domain alone is not enough for CDN-backed sites:

reddit.com
www.reddit.com
old.reddit.com
redd.it
redditstatic.com
redditmedia.com

Click Save → Apply changes.

Step 2 — Create the Block Rule

Navigate to Firewall → Rules → LAN → click +:

Move this rule above your default allow rules — OPNsense evaluates rules top-down and stops at the first match.

Click Save → Apply changes.

2. Resolve LAN IPs to Hostnames in Firewall Logs

By default, OPNsense firewall logs show raw IPs like 10.10.1.21. You want them to display as gitlab or gitlab.home.lab. This matters when you’re triaging traffic at 2 AM.

The solution is Unbound Host Overrides — static DNS entries that map your LAN IPs to friendly names. Once set, the firewall log display picks up the names automatically.

Step 1 — Add Host Overrides in Unbound

Navigate to Services → Unbound DNS → Overrides → Host Overrides → click + for each LAN host:

Click Save after each entry, then Apply once all are added.

Step 2 — Enable Reverse DNS in Unbound

To have OPNsense resolve 10.10.1.21 → gitlab.home.lab, you also need PTR records. Unbound can generate these automatically.

Navigate to Services → Unbound DNS → General:

• Enable Register DHCP leases — adds PTR records for DHCP clients
• Enable Register DHCP static mappings — adds PTR records for static DHCP entries

Click Save → Apply.

Step 3 — Verify Resolution

From any LAN host, confirm the name resolves:

nslookup gitlab.home.lab 10.10.1.1
# Expected: 10.10.1.21

nslookup 10.10.1.21 10.10.1.1
# Expected: gitlab.home.lab (reverse lookup)

3. Category-Based DNS Blocking with DNSBL

Blocking individual sites by hand does not scale. For gambling, malware, tracking, and torrent sites you want feed-based blocking — thousands of domains updated automatically. OPNsense includes a built-in DNSBL (DNS Block List) feature in Unbound.

How It Works

Step 1 — Enable DNSBL in Unbound

Navigate to Services → Unbound DNS → Blocklist:

• Check Enable
• Set Type to Unbound (native mode, no extra packages)

Step 2 — Add Block List Feeds

In the same Blocklist tab, scroll to URLs and add the feeds you want. These are well-maintained, free lists:

Add each URL, then click Save → Apply.

Step 3 — Configure the Sinkhole Response

In the Blocklist settings, set Block action to one of:

• Return NXDOMAIN — simplest, client sees “domain not found”
• Return NODATA — similar to NXDOMAIN, some clients handle it better
• Redirect to sinkhole — return 0.0.0.0 or a custom block page IP

Return NXDOMAIN works for most homelabs.

Step 4 — Force Update the Lists

After saving, click Force Update to download the feeds immediately. OPNsense will schedule automatic refreshes from that point.

Verify Blocking Works

nslookup gambling-site.com 10.10.1.1
# Expected: NXDOMAIN or 0.0.0.0

nslookup google.com 10.10.1.1
# Expected: resolves normally

Allowlisting Exceptions

If a legitimate domain gets caught by a blocklist:

Navigate to Services → Unbound DNS → Blocklist → Allowlist → click +:

This permanently whitelists the domain regardless of which list blocks it.

4. Hardening OPNsense Itself

The firewall protects your network — but who protects the firewall? These are the steps I run on every fresh OPNsense install before it handles real traffic.

4.1 Restrict Admin Interface Access

By default, the web GUI listens on all interfaces. Lock it down to LAN only and move it off port 443.

Navigate to System → Settings → Administration:

Click Save.

4.2 Harden SSH Access

If you use SSH for remote access or automation:

Navigate to System → Settings → Administration → Secure Shell:

• Enable SSH only if you actually use it
• Set Login Group to admins only
• Enable SSH Authentication Method — set to Public Key Only
• Change the port from 22 to something less common (e.g. 2222)

Add your public key under System → Access → Users → your user → Authorized keys.

ssh -p 2222 -i ~/.ssh/id_ed25519 admin@10.10.1.1

Disable password authentication entirely once key access is confirmed.

4.3 Enable Automatic Updates

Navigate to System → Firmware → Settings:

• Set Release type to Production
• Enable Automatic updates
• Set schedule to weekly (e.g. Sunday 03:00)

OPNsense will download and stage updates. For critical security patches, enable Auto-reboot after update during off-hours.

4.4 Disable Unused Services

Every enabled service is an attack surface. Disable what you do not use.

Navigate to System → Settings → Administration:

Navigate to VPN and disable any VPN services (OpenVPN, WireGuard, IPsec) not in active use.

Navigate to Services and stop/disable services not relevant to your setup (e.g. Dyndns, Proxy, Stunnel).

4.5 Enable Intrusion Detection (Suricata)

If you expose any service to the internet — a VPN, a port forward to a home server — Suricata adds a critical layer of protection.

Navigate to Services → Intrusion Detection → Administration:

• Enable IDS on WAN interface
• Download Emerging Threats Open rulesets
• Start in IDS (alert-only) mode first, graduate to IPS after observing traffic for a week

4.6 Check the Firewall Ruleset for Loose Rules

Navigate to Firewall → Rules → inspect each interface.

Common mistakes after initial setup:

• Any-to-any allow rule on LAN — left over from the default install. Replace it with explicit rules for each permitted destination
• WAN rules allowing inbound on broad port ranges — each open port should have a documented reason
• No outbound rules — add source-based rules so IoT devices can only reach the internet, not your LAN servers

4.7 Verify the Backup Configuration

Navigate to System → Configuration → Backups → Download configuration.

Store the config XML somewhere safe (a password manager, encrypted USB, or your NAS). After any major change, re-download it.

End State: What You Now Have

After completing this guide, your OPNsense install does the following:

• Specific sites blocked via Firewall Alias rules (all CDN/asset domains included)
• Optional DNS layer block via Unbound host overrides for deeper coverage
• LAN hosts show as hostnames in firewall logs
• Category blocklists (gambling, malware, torrents) applied via DNSBL
• Admin interface locked to LAN, on a non-standard port
• SSH using keys only, password auth disabled
• Automatic firmware updates scheduled
• Suricata watching WAN traffic

What to Do Next

If you have not set up monitoring yet, the Grafana + Prometheus homelab stack pairs well with OPNsense — you can export firewall and Suricata metrics and build dashboards that surface blocked domains, top talkers, and alert trends over time.

For IDS deep-dive — rule tuning, IPS mode, and simulating attacks safely — continue to the OPNsense Intrusion Detection Guide.

Have a question or a different blocklist you swear by? Drop it in the comments.