OPNsense

let's see here.

uh jason sends over a five dollar super chat thank you very much uh ai has let me build private apps i would never release to the public yes um i don't mind building internal apps for uh for for testing things or to improve my own workflow but i also understand how incredibly irresponsible it would be to release those as things uh into the wild um And in fact, Veronica, you posted something today or yesterday, I think it was today, about updating your OpenSense to the new version to eliminate the PHP bug.

And you made a comment at the very end of that of...

even if your service is internal, that doesn't mean I trust all the devices on my network.

Um, so that was my gateway to then like, well, I wanna have all these other things inventoried that, uh, an assessor might ask for or a good security program might have, such as firewall rules.

So I've got between my two places of doing work and data center, I've got a WatchGuard firewall, I've got a Meraki firewall, and I've got two OPNsense firewalls.

So I told, uh, uh, I, I told Claude, "Hey, I, I need to pull down all the, all the rules for all of these firewalls, and I want them in Notion, and then I want a quarterly ticket that reminds me to do a firewall review, and then I wanna do that firewall review with you to make sure I haven't introduced, uh, you know, firewall rules that, that stink." And like a champ, Claude was like, "Okay, you need to go into OPNsense and create an API read key to read all the rules.

Uh, do the same kind of thing in, uh, Meraki." Uh, the WatchGuard side I haven't tackled, but that's on my, uh, to- to-do list.

Um, and, uh, then Claude said, "Okay, you know, don't tell me the API keys, but boom, let me fart out a JSON file.

You import that into N8N.

You create a new credential called, you know, OPNsense API key one and two.

Paste them here and there, and, uh, I'll do the rest for you." And I mean, it nailed it first time.

If you wanna join those people, you can go to two.fiveadmins.com/support, and remember that for various amounts on Patreon, you can get an advert-free RSS feed of either just this show or all the shows in the Late Night Linux family.

And if you wanna send in your questions for Jim and Alan or your feedback, you can email show@two.fiveadmins.com. Matthew writes, "I'm using OPNsense on an old PC with an Intel Core i3 6100 and eight gigs of RAM to segment my home network into VLANs with a UniFi USG 3P as the internet gateway.

I'm thinking of adding a second NIC to the OPNsense box as a WAN interface, which I can connect directly to the internet, so it can handle all routing duties by itself.

Are there any advantages to doing everything in OPNsense and getting rid of the USG? I'm also worried that Ubiquiti might end support for the network app that I run on my Proxmox server to manage my USG."

With this one, I don't think there's many disadvantages.

In general, the OPNsense is meant to do this job and does it quite well, and with eight gigs of RAM is likely to overcome the biggest problem you have with any kind of normal consumer router, which is they only have a very limited amount of RAM in order to keep the NAT state table, which is what usually is the thing that causes you to have to keep rebooting the damn thing when it fills up.

And so I don't think there'd be any downsides or missing features in OPNsense versus the UniFi, and many upsides in additional plugins and things you could do with the OPNsense.

And it just gives you that extra amount of the ability to SSH into the OPNsense and debug what's going on.

Most people go one way into this hobby, and they never come back out.

You buy a mini PC with four NICs, you flash OPNsense onto it bare metal, you click through the setup wizard, and then you forget it exists until the internet stops working at seven in the morning.

Which is the correct way to do it, by the way.

Daniel did exactly that, and then he had to rebuild the config from scratch.

So Daniel pushed back, and this is the interesting part.

He asked it why he wanted this in the first place.

Almost everything in OPNsense is a feature he's never touched and never will.

The two things he actually needs, failover planning and VPN configuration, are the two things that are hardest to get working in OPNsense, and the AI, to his surprise, agreed with him that building his own might make sense.

You know, I mean, in the early days, I rolled my own Linux proxies and used them as routers at my house.

I've used OpenSense on a box with multiple NICs as a proxy.

That works pretty nice.

But oh, you wanted Wi-Fi.

I use agents to, to talk to my infrastructure, to reconfigure stuff.

I, I'm not the best at OpenSense, but Claude can take a, a backup file, can edit it, and give me back a restore file.

So nice.

Uh, and then I go about my Saturday, right? So, um, things like that I see growing, uh, in the future.