--- title: OPNsense Must-Haves: Settings & Plugins You Should Enable description: Running OPNsense as a home lab firewall for over a year reveals which settings and plugins matter most. ZFS with mirrored NVMe drives enables snapshots and... canonical: https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OPNsense Must-Haves: Settings & Plugins You Should Enable | daily.dev og:description: Running OPNsense as a home lab firewall for over a year reveals which settings and plugins matter most. ZFS with mirrored NVMe drives enables snapshots and... og:url: https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4 og:image: https://api.daily.dev/og/posts/6XCd59Sl4.png og:image:alt: OPNsense Must-Haves: Settings & Plugins You Should Enable og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OPNsense Must-Haves: Settings & Plugins You Should Enable **[Christian Lempa](https://daily.dev/sources/christianlempa)** · 22 min read · 0 upvotes · 0 comments ## Summary Running OPNsense as a home lab firewall for over a year reveals which settings and plugins matter most. ZFS with mirrored NVMe drives enables snapshots and disk redundancy, and automatic configuration backups can be pushed offsite with the OS-SFTP plugin, keeping the latest 30 encrypted backups. For security, block WAN access to admin ports (SSH, 80, 443) and use SSH keys instead of root passwords. OPNsense 26.1 modernized firewall rule management with API support. The free Q Feeds plugin feeds malicious IP and domain lists into firewall rules that block over 200K malicious IPs and 100K domains, and a new Telegraf plugin exposes ZFS pool health metrics for Grafana monitoring. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Should I use ZFS or UFS when installing OPNsense? ZFS is recommended over UFS for OPNsense installations because it provides snapshots and disk redundancy. A mirrored setup with two physical NVMe drives keeps the firewall operational if one drive fails, letting you replace the broken drive and restore the ZFS pool without data loss. Note that OPNsense's dashboard has no built-in way to show ZFS pool health status. _daily.dev surfaces practical storage trade-offs like this for engineers planning resilient firewall setups._ ### How do I prevent WAN access to the OPNsense web UI and SSH? Create a firewall rule blocking traffic to the WAN interface on the admin ports, including SSH, port 80, and port 443, from any source. This follows OPNsense's own recommendation to keep listening interfaces on all interfaces while still preventing external access to the management interface, similar to the exposure risk seen in the January 2025 Fortinet firewall exploits. _Developers hardening network edges compare hardening steps like these on daily.dev before deployment._ ### What is the Q Feeds plugin for OPNsense and what does it block? Q Feeds is a threat intelligence plugin for OPNsense that provides a free community tier blocking over 200,000 malware IPs and over 100,000 malware domains. After installing the OSQ Feeds connector plugin and adding an API key from the Q Feeds portal, it automatically updates malicious IP block lists used in firewall rules for both inbound and outbound traffic. _Self-hosters evaluating free threat intel feeds track tool comparisons like this on daily.dev._ ## Similar posts on daily.dev - [I switched from pfSense to OPNsense, and I'm happy with the upgrade](https://daily.dev/posts/i-switched-from-pfsense-to-opnsense-and-i-m-happy-with-the-upgrade-m6koeb6mw) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#homelab](https://daily.dev/tags/homelab), [#firewall](https://daily.dev/tags/firewall) [View this post on daily.dev](https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OPNsense Must-Haves: Settings \u0026 Plugins You Should Enable","url":"https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4"},"datePublished":"2026-10-20T14:03:34.573Z","dateModified":"2026-10-20T14:04:07.846Z","description":"Running OPNsense as a home lab firewall for over a year reveals which settings and plugins matter most. ZFS with mirrored NVMe drives enables snapshots and...","image":"https://i.ytimg.com/vi/-aQvFv6k5iM/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/-aQvFv6k5iM/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Christian Lempa","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Christian Lempa","logo":"https://media.daily.dev/image/upload/s--r09bzzis--/f_auto/v1723788767/logos/christianlempa","url":"https://daily.dev/sources/christianlempa"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,homelab,firewall","timeRequired":"PT22M","video":{"@type":"VideoObject","name":"OPNsense Must-Haves: Settings \u0026 Plugins You Should Enable","description":"Running OPNsense as a home lab firewall for over a year reveals which settings and plugins matter most. ZFS with mirrored NVMe drives enables snapshots and...","thumbnailUrl":"https://i.ytimg.com/vi/-aQvFv6k5iM/sddefault.jpg","uploadDate":"2026-10-20T14:03:34.573Z","duration":"PT22M","url":"https://api.daily.dev/r/6XCd59Sl4","embedUrl":"https://www.youtube.com/embed/-aQvFv6k5iM"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Christian Lempa","item":"https://daily.dev/sources/christianlempa"},{"@type":"ListItem","position":3,"name":"OPNsense Must-Haves: Settings \u0026 Plugins You Should Enable"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/opnsense-must-haves-settings-plugins-you-should-enable-6xcd59sl4#faq","mainEntity":[{"@type":"Question","name":"Should I use ZFS or UFS when installing OPNsense?","acceptedAnswer":{"@type":"Answer","text":"ZFS is recommended over UFS for OPNsense installations because it provides snapshots and disk redundancy. A mirrored setup with two physical NVMe drives keeps the firewall operational if one drive fails, letting you replace the broken drive and restore the ZFS pool without data loss. Note that OPNsense's dashboard has no built-in way to show ZFS pool health status. daily.dev surfaces practical storage trade-offs like this for engineers planning resilient firewall setups."}},{"@type":"Question","name":"How do I prevent WAN access to the OPNsense web UI and SSH?","acceptedAnswer":{"@type":"Answer","text":"Create a firewall rule blocking traffic to the WAN interface on the admin ports, including SSH, port 80, and port 443, from any source. This follows OPNsense's own recommendation to keep listening interfaces on all interfaces while still preventing external access to the management interface, similar to the exposure risk seen in the January 2025 Fortinet firewall exploits. Developers hardening network edges compare hardening steps like these on daily.dev before deployment."}},{"@type":"Question","name":"What is the Q Feeds plugin for OPNsense and what does it block?","acceptedAnswer":{"@type":"Answer","text":"Q Feeds is a threat intelligence plugin for OPNsense that provides a free community tier blocking over 200,000 malware IPs and over 100,000 malware domains. After installing the OSQ Feeds connector plugin and adding an API key from the Q Feeds portal, it automatically updates malicious IP block lists used in firewall rules for both inbound and outbound traffic. Self-hosters evaluating free threat intel feeds track tool comparisons like this on daily.dev."}}]} ```