FIREWALL / IPV6 / REMOTE ACCESS
OPNsense and IPv6
OPNsense is the main gateway for my home network. Alongside everyday routing and firewall rules, it handles WireGuard, Suricata, Zenarmor and the certificate-based network access setup.
How the network is organized
The gateway runs on an Intel N305 appliance with 10GbE interfaces. I use separate network segments for trusted clients, guest access and the firewall lab. FreeRADIUS ties supported wired and wireless connections to the certificate infrastructure.
The interesting part has been keeping IPv4 and IPv6 behavior consistent. A dual-stack connection can appear healthy while the two protocols take different paths or fail for different reasons.
Tests that helped me understand it
- Suricata: I triggered a controlled IPS signature and checked that the firewall blocked it. This was a deliberate test, not an actual attack.
- Zenarmor: I tested a restricted web category and confirmed that the configured policy denied access.
- WireGuard: a mobile client successfully used a full IPv4/IPv6 tunnel, including DNS resolution and access to permitted local services. Other devices can use different tunnel profiles.
- IPv6 prefix translation: I checked the active translation rule and the external IPv6 address seen by the client. Both matched the provider prefix in use at the time.
- WAN source selection: when one global IPv6 source address could not reach the internet, I compared source-specific tests and worked out a recovery procedure.
What I am still testing
I have not yet seen this WireGuard/NPTv6 setup go through every possible provider prefix change and reboot sequence. I also want to run a complete set of negative tests between network segments, rather than rely only on the successful paths already checked.
Zenarmor's multi-core performance is a separate experiment. The gateway has 10GbE interfaces, but I do not yet have inspection-throughput measurements to publish.
Read the Zenarmor test plan → More about the network setup →