In previous installments of this series we looked at how creating a DIY router using an e-waste-level PC has changed over the years, before attempting to boot OpenWrt for x86 on it. After an initial SD card booting failure on one system, another system with a newer mainboard – an Intel Board D2500CC – was used which happily booted OpenWrt from an SD card inserted into a USB card reader.

Unfortunately, OpenWrt didn’t see any usable Ethernet interfaces despite having no less than four Intel Ethernet controllers and two hooked up to active networks. After recently getting back to the project, I found out why both onboard Intel 82574L Ethernet controllers didn’t show up in OpenWrt: the drivers for the Intel 82574L controllers are in the e1000e driver package, while only the e1000 package is present in the provided x86 image. This issue persists in the ‘generic’ image profile to this day.

Yet rather than diving head-first into building my own image that includes the kmod-e1000e package, I decided to give OPNsense a shake first.

All The Features

Suffice it to say that OPNsense is a whole different galaxy compared to the cheerful-and-light OpenWrt. Rather than targeting just being a basic router, you instead get access to a feature list where it’s probably faster to start asking what it doesn’t do. This FreeBSD-based software specifically takes aim at commercial products offering firewall, network traffic analysis and routing as well as network security features, with plugins adding features that probably has the average network admin salivating.

Although only the tiniest bit of overkill when you merely want to set up a consumer-grade network router, not to mention possess just enough network administration skills to not injure yourself while running the setup wizard of a router and plugging in Ethernet cables, it’s still a nice fuzzy warm feeling to know that you have all this power at your fingertips should you ever need it.

The Get Started page for OPNsense is also rather reassuring, promising that the lowly 2012-era Intel Atom D2500CC board with its dual 1.8 GHz cores will do just fine. Although only 2 GB of DDR3 is installed, DDR3 SODIMM sticks are still plentiful and relatively affordable, so it’s easy to hoard have a strategic reserve of them for upgrading older systems to 4 GB and beyond if they support it. Surreptitiously closes drawer with RAM hoard

Storage-wise a 4 GB SD or CF card is considered the minimum, with a 120 GB SSD recommended. Considering that I’ll be living large with OPNsense I decided to splurge on a whole 128 GB SATA SSD here in the midst of a supply crisis no less. This way it should be possible to install OPNsense from a USB stick and be up and running without the limitations of running a ‘nano’ image off an SD card or similar.

The exciting aspect here is that while the D2500 Atom CPU is technically a 64-bit CPU and should run 64-bit Linux quite all right if the mainboard also supports it, the x86_64-only focus of OPNsense makes this a make-or-break aspect. Will I need to break out Yet Another E-Waste PC to make this work? Stay tuned.

Deployment Time

The instructions on the OPNsense ‘Get Started’ page are a bit vague on which image to use exactly, with the DVD ISO, VGA, Serial and Nano images all having apparently specific goals and purposes that aren’t easy to decipher once you try to figure out what exactly is different between the ‘DVD’ and ‘VGA’ image. Some searching with DuckDuckGo later and the found suggestions – including deeper in the full documentation – pointed me to the ‘VGA’ image. This .img file needs to be extracted from the .bz2 archive before it can be written with Rufus or similar to a USB stick.

Fortunately this half-guess at the right image turned out to be the correct one, as the system booted right into the live image, also putting to rest initial fears of the system rejecting the modernity of 64-bit. Amusingly, the installer works by logging into the live session’s login as installer rather than root with the same opnsense as the password, which is only mildly awkward when you find yourself staring at a login prompt for installing an OS.

A mere eleven minutes and forty-five seconds of OPNsense live session uptime later, the installation was finished and I was asked to remove the USB stick and reboot to admire the glory that is OPNsense. Meaning mostly to do first-time setup things and make sure that everything that should work also does so. Would the system even boot?

First Boot

With some level of trepidation, I pushed the power button on the front of the case, only to see it cycle through all the typical happy FreeBSD things, albeit it all distorted since the portable monitor I used hates 640×480 as resolution for some reason. I had opted for the typical ZFS filesystem option during installation, along with basically all the other defaults. The only thing that I was uncertain about was whether it would pick the right Ethernet port as the WAN port by default or that I’d have to reassign it.

This fear turned out to be unfounded, with what turned out to be the second interface (em1) – which I had plugged into an active LAN connection – being assigned the WAN role, leaving the second interface (em0) as the brand new LAN’s interface. By default OPNsense assigns clients on this LAN interface /24 style addresses with the router and DHCP server found on 192.168.1.1. Clients are assigned addresses in the range of 192.168.1.100-200.

As an aside, I really appreciate how OPNsense announces major state changes like finishing booting and going down for a reboot/shutdown result in the running of a beep script which creates a fanfare that even a half-deaf network admin working at the other side of a busy server room would be hard-pressed to miss. This isn’t a joke, I really appreciate clear signaling for anything that warrants those in the room to be 100% aware of this fact.

With a happy UP message on the em1 WAN interface, and happily blinking LEDs on the WAN interface, it was time to plug a client into the new LAN port to see whether I now had a real internet router.

Speed Testing

Rather than drag out a newer PC or laptop, I used my 2013-era gaming laptop running Manjaro. This makes it about the same age as the Intel board in the new OPNsense router, though both are clearly useful in a different way. Fortunately both systems were more than happy to see each other, with plugging in a new Ethernet cable between the two immediately popping up a confirmation pop-up in Manjaro about an Ethernet connection.

It being Arch-based, the first thing to test was updating Manjaro with what turned out to be nearly a gigabyte of updates. A few minutes later this was all downloaded and the laptop’s fan was kicking in as if to tell everyone to slow it down somewhat. Clearly it was time to run some comparative benchmarks with other systems not trapped behind this new OPNsense router.

Here I got some slightly funny results, which might be more due to how unreliable browser-based internet speed tests are. First using fast.com in Firefox I got a piddly 61 Mbps up and 23 down, which had me somewhat worried, yet when I ran over to my regular PC to run the same test in the Firefox ESR-based Waterfox, I got a very similar score at 55/36.

As a sanity check I benchmarked then with speedtest.net, which gave the Manjaro laptop a big thumbs up with 184/187 Mbps, which is closer to what my ISP claims is a ~300/150 Mbps connection. On my PC with Waterfox I got lower again the first time, but the second time it was much higher and closer to the result on the Manjaro laptop. It’s all relative, I guess.

I also checked the speedtest.net app on my Android phone using the regular Wi-Fi access point and got a happy 163/142 Mbps, so whatever is going on, it’s probably due to JavaScript or browser compatibility or similar shenanigans as are about 90% of all network issues these days.

Happy Routing

Either way, the connection on the Manjaro laptop in Firefox via the OPNsense router was stable over the course of an hour, with the speedtest claiming a 16 ms ping and so far no issues detected. I’ll definitely have to figure out a better way to benchmark the connection, and also to remember to check the system load on this newly minted OPNsense system, but so far it’s been an astoundingly and happily boring experience.

There are also a lot more features in OPNsense that are begging to be explored further, for which I’ll gladly take requests since me and professional networking equipment are at most on a neighbor-level of acquaintance. For some reason diving into OPNsense does feel like at some point you absolutely have to get that 19″ rack to fit in with the club.