Why I Run OPNsense as My Home Firewall (with Suricata) for Real Home Network Security

I run OPNsense as the home firewall at the edge of my house, and it is the single best decision I have made for home network security. Before this I trusted the plastic router the ISP handed me, the one with a locked-down web UI, firmware that gets patched maybe once a year, and zero visibility into what my own devices are actually doing. Swapping that box for a real self-hosted firewall running Suricata as an intrusion detection system changed how I think about my whole network. This is why I did it, and how I would tell a fellow homelabber to approach it.

Why the ISP router is not a firewall

The router your provider ships is built to a price. It does NAT, it hands out DHCP leases, and it calls that security. What it does not give you is honest visibility. You cannot see which internal host is beaconing out to a sketchy ASN at 3am. You cannot write a rule that says this IoT device may talk to the LAN but never to the internet. You cannot inspect DNS, log flows, or get alerted when something changes. For me the whole point of a homelab is to see and control my own infrastructure, and a black box at the most important chokepoint on the network defeats that.

OPNsense flips it. It is open source, it is built on a hardened FreeBSD base, and it treats you like the administrator instead of a tenant. You get a real stateful firewall, granular rules per interface and VLAN, and an API that lets you automate all of it.

What OPNsense actually gives a homelab

Segmentation you control

The first thing I did was carve the flat home network into VLANs: trusted machines, IoT, guests, and the lab itself. Cheap smart plugs and cameras live on their own segment and are not allowed to initiate connections into the trusted LAN. If one of them is ever compromised, the blast radius is one VLAN, not my whole house. You cannot express that policy on a consumer router. On OPNsense it is a handful of interface rules.

Suricata as an in-line IDS

I run Suricata on the firewall watching traffic against community rule sets. It flags port scans, known-bad signatures, and traffic to reputation-listed hosts. Running detection at the edge means it sees everything crossing the boundary, not just what one host happens to log. Start it in detection-only mode, live with the alerts for a couple of weeks, tune out the noise your own devices generate, and only then consider blocking. An IDS you have not tuned is just a firehose of false positives, so patience here pays off.

Automation through the API

OPNsense exposes a proper API, and that is where it stops being a router and starts being a platform. I automate mine: I watch gateway RTT and packet loss, pull firewall logs, and read DHCP leases programmatically. When a new device shows up on the network I know about it. When my WAN gateway starts losing packets I get told before I notice a slow page load. None of this needs an agent on any endpoint. It is all read from the one box that already sees every packet.

Turning the firewall into observability

A firewall that only blocks is half a firewall. The logs it produces are gold, and the next step in my lab was treating them that way. I built a small Docker-based portal I call EmberEye that pulls OPNsense alongside the rest of my stack (Proxmox, ntopng, NGINX, WireGuard, Portainer) into one dashboard. FastAPI on the backend, a Next.js front end, PostgreSQL and Redis behind it, background pollers hitting each service on a schedule and pushing updates over WebSockets. Instead of logging into six web UIs I get one screen, real-time, with an alerts engine that fires rules with cooldowns to Discord and email.

From there I went deeper into flows. My design rule for anything I bolt onto the network is that it must be passive, additive, reversible, and resource-fenced: it observes, it never sits in the load-bearing path, and I can rip it out with no downtime. So rather than standing up new daemons on the firewall, I extended the Suricata that was already running to emit flow, HTTP, TLS, and DNS events. Those feed a single ingest bus that normalizes everything into one canonical flow record, enriches it with geo and ASN data, and writes it into a columnar store built for retention and rollups. On top of that sit nightly baseline profiles and a few honest anomaly detectors: volumetric z-scores, new-country or new-ASN egress, DNS entropy, and beaconing patterns. When something trips, I get a Discord alert with a one-click pivot straight to the flow and the packets.

Is it overkill for a home?

Depends what you want. If you just need internet, keep the ISP box. If you consider your network part of your homelab, part of the thing you are here to learn and defend, then no, it is not overkill. The hardware ask is modest: a small fanless mini PC with a couple of NICs is plenty for a home line. The real cost is time spent learning, and that time is the point.

How I would start

• Get a small x86 box with at least two network interfaces and install OPNsense. Put it inline as your gateway.
• Recreate what you have first: WAN, LAN, DHCP, DNS. Confirm the house still works before you touch anything clever.
• Add VLANs and segment IoT and guests off your trusted machines.
• Enable Suricata in detection-only mode. Read the alerts. Tune. Then decide what to block.
• Turn on logging and start pulling data through the API. Even a simple dashboard teaches you what normal looks like, and normal is what makes the abnormal obvious.

A good home firewall is not about paranoia. It is about running your own network with your eyes open. OPNsense, Suricata, and a bit of self-hosted glue turned my edge from a box I could not see into the most instrumented, most trusted part of my lab. If you are already building a homelab, this is the foundation the rest of it deserves to sit on.