OPNsense Migration Blueprint

What this helps with

• ✓Replacing consumer or ISP routers with a proper firewall
• ✓Setting up VLANs for IoT, work, and trusted devices
• ✓Configuring DNS filtering and split DNS
• ✓Writing a clean initial ruleset
• ✓Documenting your network after migration

Step-by-step plan

1. 1

   Inventory your current network

   List all devices, IP ranges, VLANs, port forwards, and VPN connections. Create a simple network diagram before you touch anything.

2. 2

   Plan your new network topology

   Design VLAN segments: Trusted, IoT, Guest, Management. Assign subnets (e.g. 10.0.10.0/24 per VLAN). Decide on a DNS strategy.

3. 3

   Install OPNsense

   Download the latest stable release. Boot from USB. Assign WAN and LAN interfaces. Set a strong admin password and update immediately after install.

4. 4

   Configure VLANs and interfaces

   Create VLANs under Interfaces → Other Types → VLAN. Assign each to an interface and enable DHCP. Configure trunk ports on managed switches.

5. 5

   Set up DNS and DHCP

   Enable Unbound DNS. Configure DNS over TLS (DoT) to a resolver of your choice. Set up static DHCP leases for servers and key devices.

6. 6

   Write firewall rules

   Start with a deny-all policy. Add rules per VLAN: allow trusted to anywhere, restrict IoT to internet-only, block inter-VLAN by default.

7. 7

   Migrate port forwards and VPN

   Re-create your port forwards one by one. Set up WireGuard or OpenVPN for remote access. Test each before cutting over.

8. 8

   Cut over and monitor

   Schedule a maintenance window. Swap cables. Verify all segments have internet. Check firewall logs for blocked traffic in the first 24h.