⌘K

OPNsense

Enterprise edge routing, multi-VLAN segmentation, and WireGuard tunnels on bare metal.

All Privacy Hardware NAS ZFS Reverse Proxy SWAG Plex Media Server Self-Hosting CrowdSec Fail2Ban Cybersecurity Networking Jellyfin Docker Automation

Core Lab networking stack v1.1, circa 2022 showing a Cisco 24 port SMB switch and a Unifi 16 port POE Switch. — Core Lab networking stack v1.1, circa 2022.

My 2026 Homelab Networking Stack: OPNsense, UniFi & 10GbE

A real-world walkthrough of my 2026 homelab networking architecture: bare-metal OPNsense with 2.5GbE WAN, dual UniFi Gen2 switches, 10Gbps SFP+ storage backhaul, and Dockerized controller management.

A picture of Core Lab Joe's hand holding Core Lab's own UGREEN 2.5G USB 3.0 to Ethernet adapter, in production — Core Lab's own UGREEN 2.5G USB 3.0 to Ethernet adapter, in hand and in production.

UGREEN USB 3.0 to 2.5GbE Adapter as an OPNsense WAN NIC (Realtek RTL8156B, 1.5Gbps)

My 18-month field report: using a sub-$25 UGREEN USB 3.0 to 2.5GbE adapter (Realtek RTL8156B) as a plug-and-play OPNsense WAN NIC on a 1.5Gbps symmetrical fiber plan.

Automating OPNsense Backups: Encrypted Off-Site SFTP and Git to OpenMediaVault 8 — Architecture diagram: Encrypted OPNsense XML config backups streaming across automated SFTP and Git pipelines to OpenMediaVault ZFS storage.

Automating OPNsense Backups: Hardened SFTP to NAS, Git Audits & REST API

How I automated my OPNsense firewall backups using hardened, key-only SFTP to OpenMediaVault, Git version control, and zero-dependency API scripts with full payload encryption.

Digital rendering of my 10+ yr old hand me down Alienware X51 R3 PC running OPNsense, 'ghosting' my WAN IP to the scanners. — Ghosting the Scanners with my 10+yr old hand me down Alienware X51 R3.

Beyond Default Deny: Reducing Attack Surface & Exposure in 2026

Stop Shodan and Censys from mapping your network. Learn how to use OPNsense 26.1, CrowdSec, and Divert Mode to achieve true Security through Obscurity in 2026.

Cyberpunk illustration of OPNsense with Suricata, featuring a vigilant meerkat guarding glowing data streams and detecting threats in real time. — Cyberpunk-style OPNsense + Suricata guardian watching network traffic, symbolizing real-time intrusion detection and prevention.

OPNsense IDS/IPS in 26.4+: Suricata, Inline vs Divert Mode

Learn how to configure Suricata IDS/IPS in OPNsense 26.4+. Compare Inline vs Divert mode, optimize performance, and secure your self-hosted services.

A macro shot in a dark server room shows an Ethernet cable plugged into a NIC, featuring a "Digital Fortress" maintenance log overlay with an OPNsense upgrade progress bar at 88% complete.

Upgrading to OPNsense 26.1

The jump to OPNsense 26.1 changes how DHCP and DNS interact. Learn how to navigate Kea migration, fix subnet mask mismatches, and resolve Android Wi-Fi errors.

Conceptual network command center. Left display: OPNsense 1.5Gbps throughput and low latency. Right display: AdGuard Home stats and active IDS/IPS shield for threat detection. — Total network control, visualized. See your OPNsense throughput, AdGuard Home stats, and real-time IDS/IPS alerts in a sleek, futuristic interface.

Advanced OPNsense Networking: Cloudflare Bypass, DNS/NTP Hijacking & SQM

Learn advanced OPNsense routing techniques including Cloudflare proxy bypass, DNS/NTP interception, and SQM bufferbloat fixes for high-performance homelab networks.

Grafana dashboard showing a global threat map of cyberattacks and a top 5 attackers bar gauge parsed from OPNsense firewall and NGINX Docker logs. — 🌍 Active Intelligence: A real-time global threat map and "Attacker Leaderboard" generated from OPNsense firewall blocks and NGINX access logs using the Grafana-Loki-Promtail (GLP) stack.

Building a Homelab Mini-SIEM with Grafana, Loki, and Promtail

Stop guessing and start visualizing. Turn siloed OPNsense and NGINX logs into a real-time threat map with the lightweight GLP stack. Includes GeoIP and Discord alerts.

Gloved hands hold a transparent tablet displaying a holographic network diagram where a secure WireGuard tunnel bypasses a red firewall shield in a server room. — Punching a secure hole through the fortress: A visualized WireGuard tunnel bypassing the edge firewall to connect directly to an internal host.

Mastering WireGuard: Site-to-Site & Road Warrior Setups Behind OPNsense NAT

Stop running WireGuard on your firewall. Learn how to decouple your VPN using Docker or Linux VMs behind OPNsense for better performance, portability, and Site-to-Site routing.

Digital illustration of a server room. Glowing blue network paths converge on an isolated, glowing red cube. A text overlay reads "TRAP SPRUNG: PID ISOLATED," symbolizing threat containment. — Gotcha. Visualizing the moment the hunt moved from passive monitoring to active identification. By using tcpdump on the docker bridge network, we trapped the specific container IP responsible for the beacons, proving it was an isolated workload and not the host OS.

Threat Hunting in the Homelab

Zenarmor blocked a C2 beacon from my NAS. It wasn't the OS. See how I used tcpdump to hunt down a compromised Docker container hiding in plain sight.

Core Lab mascot next to a glowing Cloudflare Tunnel portal. Text: Is Cloudflare Tunnel Safe for Plex/Jellyfin? A Cybersecurity Vet's Analysis. — Cloudflare Tunnels are convenient, but are they secure enough for your home network? We pop the hood to look at the traffic inspection and TOS risks.

Are Cloudflare Tunnels Safe for Media Servers? A Cybersecurity Vet's Analysis

A deep dive into securing self-hosted media servers. Explore the pros and cons of Cloudflare Tunnel and why you should consider Headscale or direct WireGuard for better privacy.

Wireguard icon, resting on the ground below a lightening bolt with the caption of "Wireguard: Speed of Light". — Wireguard is dark IT magic, wrapped in a lightening bolt!Wireguard is dark IT magic, wrapped in a lightening bolt!

The Speed of Light: OPNsense WireGuard Setup Guide

Set up a fast, secure WireGuard VPN on OPNsense: keys explained, the Cloudflare Orange Cloud trap, firewall rules, and handshake troubleshooting.