To see the default rules on OPNsense Firewall Web UI, In the next section, we will create a rule to allow firewall administrators to access their firewalls as an example. Therefore it should be disabled and another allow rule should be defined for firewall management. This rule brings huge IT security gaps and may cause critical data leakage in a company network. Because the anti-lockout rule allows any device to access the management interfaces of the OPNsense firewall such as SSH console and Web GUI.

If the allow all rule is deleted or disabled, all traffic to the Internet and other local networks behind the firewall will be blocked, except for access to the OPNsense web administration interface.Īlthough the anti-lockout rule is a practical solution, since generally there would not be any threat from the internal home network, it is not advisable for organization networks. When a device is plugged directly into the router (or a switch connected to the router), and it will access the internet or the network behind the OPNsense. These rules prevent you from locking yourself out of OPNsense web UI and provide LAN with unrestricted Internet access. Allow All Rule Īfter installing the OPNsense firewall and configuring its LAN/WAN interfaces, it automatically creates a web administration anti-lockout rule and a allow all rule for IPv4 and IPv6.

If a packet is received from untrusted networks, it is not recommended to communicate back if traffic is not permitted. When access is denied on internal networks, it may be more practical to use reject so that the client does not have to wait for a time-out.

Tailscale opnsense