📘 Complete Mac Mini OPNsense Guide - 1,959 Lines of Step-by-Step Instructions #2

Open
opened 2025-12-21 01:27:39 +11:00 by jessikitty · 0 comments
Owner

📖 Complete Mac Mini OPNsense Implementation Guide

The complete, comprehensive, step-by-step guide for implementing OPNsense on your Mac mini 2014 is available at:

📍 Location

Path: /mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md

Size: 1,959 lines / 46 KB
Reading Time: ~30 minutes
Implementation Time: 1-2 weeks (phased)


🎯 What's in the Full Guide

Phase 1: OPNsense Installation & Basic Router Setup (Day 1)

  • Download OPNsense ISO
  • Create bootable USB (macOS & Windows instructions)
  • Install on Mac mini (detailed screenshots/commands)
  • Configure WAN/LAN interfaces
  • Setup DHCP (10.0.0.1-200, Gateway 10.0.0.254, DNS 10.0.0.55)
  • Configure static IP exclusions
  • Set Archer AX72 Pro to AP mode
  • Test connectivity
  • 45+ detailed steps with commands

Phase 2: Advanced Router Features (Day 2-3)

  • Install ntopng (network traffic analysis)
  • Configure Suricata IDS/IPS
  • Enhanced device tracking (IP, MAC, NetBIOS, mDNS)
  • Setup periodic nmap scanning
  • Traffic shaping & QoS
  • Comprehensive logging
  • Security hardening
  • 30+ configuration steps

Phase 3: Zenarmor Parental Controls (Day 4-5)

  • Install Zenarmor (os-sensei)
  • Complete setup wizard
  • Create policy for Bella (14yo) - strict controls
  • Create policy for Xander (15yo) - moderate controls
  • Create policy for William (17yo) - relaxed controls
  • Application blocking (TikTok, adult content, etc.)
  • Time-based rules (school hours, bedtime, weekends)
  • Time quotas per app (2 hours YouTube/day, etc.)
  • Safe Search enforcement
  • Daily email reports
  • 35+ policy configuration steps

Phase 4: Home Assistant Integration (Day 6-7)

  • Enable OPNsense API
  • Install HACS integration
  • Configure device trackers
  • Create firewall rules for HA control
  • Build automations:
    • Bedtime blocking (9 PM - 7 AM)
    • School hours restrictions
    • Bandwidth alerts
    • Policy violation notifications
  • Create dashboard (full YAML code provided)
  • Zenarmor API sensors
  • Notification setup
  • 25+ integration steps

💎 Key Highlights

Why Mac Mini is PERFECT:

Mac Mini 2014 vs $400 Protectli VP2420:
✅ Same CPU generation (4th gen Intel i5)
✅ Same RAM (8GB)
✅ MORE storage (500GB vs 256GB)
✅ 3x network interfaces (1 onboard + 2 Thunderbolt)
✅ Built-in power supply
✅ $0 cost (you already own it!)

Performance:
✅ 1 Gbps routing with full DPI
✅ Suricata IDS/IPS + Zenarmor simultaneously
✅ Handles 50+ devices (you have 22)
✅ VPN server capability
✅ Years of detailed logs

What You'll Build:

Enterprise-Grade Router Features:
🔥 Deep Packet Inspection (see WHAT apps)
🔥 Application-level blocking (TikTok, gaming, etc.)
🔥 Time quotas per app (2 hours/day)
🔥 Per-device policies (3 kids, different rules)
🔥 Time-based controls (school vs after-school vs bedtime)
🔥 Safe Search enforcement (can't be disabled)
🔥 Intrusion detection/prevention
🔥 Real-time network monitoring
🔥 Automated daily reports
🔥 Home Assistant integration
🔥 Complete dashboard control

vs Basic MAC Blocking (OpenWRT on Archer):
❌ Can only block ALL internet or NOTHING
❌ Can't distinguish YouTube from Khan Academy
❌ No per-app visibility
❌ No time quotas
❌ Manual log analysis

Example Policy (from guide):

Bella (14yo) - School Days Policy:

7 AM - 3 PM (School Hours):
  ✅ ALLOW: Educational sites (Khan Academy, school portal, Wikipedia)
  ✅ ALLOW: Research (Google for homework)
  ❌ BLOCK: Social media (TikTok, Instagram, Snapchat)
  ❌ BLOCK: Gaming (Fortnite, Roblox, Minecraft)
  ❌ BLOCK: Streaming (YouTube, Netflix)

3 PM - 9 PM (After School):
  ✅ ALLOW: YouTube Educational (2 hours max)
  ⏱️ LIMIT: TikTok (30 minutes max)
  ⏱️ LIMIT: Gaming (1 hour max)
  ⏱️ LIMIT: Social media (1 hour max total)
  🔒 FORCE: Safe Search on all searches

9 PM - 7 AM (Bedtime):
  ❌ BLOCK: Everything except emergency sites
  
Weekends:
  ⏱️ Extended quotas (3 hours gaming, 4 hours social media)
  📊 Still tracked and reported

Always:
  ❌ BLOCK: Adult content, Gambling, Violence
  📧 ALERT: Parent on violations
  📊 LOG: All blocked attempts

📋 Complete Command Reference

The full guide includes every command needed:

Installation Commands:

# Create bootable USB (macOS)
bunzip2 OPNsense-25.1-dvd-amd64.iso.bz2
diskutil list
diskutil unmountDisk /dev/diskX
sudo dd if=OPNsense-25.1-dvd-amd64.iso of=/dev/rdiskX bs=1m

Configuration Commands:

# SSH to OPNsense
ssh root@10.0.0.254

# Install packages
pkg install nmap avahi

# Create scan scripts
cat > /root/scripts/network_scan.sh << 'EOF'
[...complete script...]
EOF

Home Assistant YAML:

# Complete automation examples
automation:
  - alias: "Bella Bedtime Block"
    trigger:
      - platform: time
        at: "21:00:00"
    # [... full automation code ...]

# Complete dashboard examples
type: vertical-stack
title: Parental Controls
cards:
  # [... full dashboard YAML ...]

🎓 What You Learn

The guide teaches you:

  1. OPNsense Installation - Professional router OS setup
  2. Network Architecture - WAN/LAN separation, VLANs
  3. Firewall Rules - Packet filtering, NAT, routing
  4. Deep Packet Inspection - Application identification
  5. Intrusion Detection - Suricata IDS/IPS
  6. Traffic Analysis - ntopng, bandwidth monitoring
  7. Device Tracking - IP, MAC, hostname resolution
  8. Parental Controls - Policy-based filtering
  9. API Integration - OPNsense ↔ Home Assistant
  10. Automation - Event-driven network control

Skills applicable to: IT careers, network security, home lab, advanced homeassisting


Quick Start

Immediate Next Steps:

  1. Read: /mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md
  2. Backup: Any important Mac mini data
  3. Gather: 8GB+ USB drive, HDMI monitor, keyboard
  4. Download: OPNsense ISO (~500MB)
  5. Schedule: 2-3 hours for Phase 1
  6. Begin: Follow Phase 1 step-by-step

Phase 1 Can Be Done TODAY:

  • Download OPNsense: 10 minutes
  • Create USB: 10 minutes
  • Install OPNsense: 20 minutes
  • Basic config: 30 minutes
  • DHCP setup: 15 minutes
  • Archer AP mode: 10 minutes
  • Testing: 30 minutes
  • Total: 2-3 hours → WORKING ROUTER

💰 Cost Summary

Total Investment:

  • Hardware: $0 (using Mac mini 2014)
  • OPNsense: $0 (free, open source)
  • Zenarmor Home: $59/year (optional but recommended)
  • Total Year 1: $59
  • Total Year 5: $295

What You Save:

  • Protectli VP2420: $400 saved
  • Qustodio Premium: $138/year × 5 = $690
  • Total 5-Year Savings: $790+

You're getting enterprise-grade for $59/year vs $800+ for commercial solutions!


📊 Comparison to OpenWRT (Your Original Question)

Feature OpenWRT on Archer OPNsense on Mac mini
Hardware Cost $0 $0
Software Cost $0 $59/year
CPU Power 880 MHz MIPS i5 @ 2+ GHz (4x faster)
RAM 512 MB 8 GB (16x more)
Storage 128 MB flash 500 GB SSD (4000x more)
Network Ports 5x GbE 3x GbE
App Visibility No Full DPI
Block TikTok Only No Yes
Time Quotas No Yes (2 hours/day per app)
See What Apps No YouTube, Discord, etc.
Content Filtering ⚠️ DNS only DPI + DNS
Safe Search ⚠️ DNS-based Enforced (can't bypass)
IDS/IPS Too weak Suricata full-featured
Traffic Analysis ⚠️ Basic ntopng (professional)
Reporting Manual Automated daily emails
HA Integration ⚠️ SSH commands Native API

Verdict: OPNsense on Mac mini wins in every category except pure simplicity. The $59/year cost is worth it for the capabilities gained.


🎯 Success Criteria

After Phase 1 (Basic Router):

  • Internet working on all devices
  • WiFi via Archer AX72 Pro AP
  • DHCP assigning 10.0.0.x IPs
  • DNS resolving via AdGuard (10.0.0.55)
  • Static IPs working (HA @ 10.0.0.55)
  • OPNsense web interface accessible
  • Stable for 24+ hours

After Phase 2 (Advanced Features):

  • ntopng showing real-time traffic
  • Suricata detecting threats
  • Device tracking working (IP/MAC/hostname)
  • Periodic scans running
  • Logs capturing all activity
  • Stable for 24+ hours

After Phase 3 (Parental Controls):

  • Zenarmor analyzing traffic
  • 3 policies active (Bella, Xander, William)
  • Apps being blocked (TikTok, etc.)
  • Time quotas enforcing (2 hours YouTube)
  • Safe Search working
  • Daily reports arriving via email
  • Stable for 2-3 days

After Phase 4 (HA Integration):

  • Device trackers showing status
  • Firewall rules controllable via HA
  • Bedtime automation working
  • Dashboard displaying data
  • Notifications arriving on violations
  • All 22 devices tracked
  • System production-ready!

🆘 Emergency Procedures

All included in full guide:

If Internet Stops Working:

# Console access (monitor + keyboard)
1. Login as root
2. Select option 8 (Shell)
3. Run: ping 8.8.8.8
4. If fails: Check WAN interface
5. If works: Check firewall rules

If Can't Access Web Interface:

# Reset to defaults via console
1. Select option 4 (Reset to factory defaults)
2. Or just fix IP: ifconfig em0 10.0.0.254
3. Access: https://10.0.0.254

Complete Rollback:

# Revert to old router
1. Disconnect Mac mini
2. Connect old router
3. Restore HA backup
4. Network back to normal in 5 minutes

📞 Getting Help

Support Resources:

Common Questions Answered in Guide:

  • "Will this erase macOS?" → Yes (backup first!)
  • "Can I go back?" → Yes (rollback procedure included)
  • "Is 8GB RAM enough?" → Yes (perfect amount)
  • "What if I mess up?" → Step-by-step recovery included
  • "How long does this take?" → 1-2 weeks phased implementation

🏁 Bottom Line

Your Mac mini 2014 is PERFECT for this project.

You will transform it into:

  • Enterprise-grade firewall
  • Professional router
  • Intrusion detection system
  • Parental control platform
  • Network monitoring station

Better than:

  • $500 Firewalla Gold
  • $400 Protectli VP2420
  • $250 Qotom mini PC
  • OpenWRT on Archer (limited)

For:

  • $0 hardware cost (reusing Mac mini)
  • $59/year software (Zenarmor Home)
  • 1-2 weeks time (phased, tested approach)

The full guide makes this achievable even for beginners - every command, every setting, every troubleshooting step is documented!


Read the full guide and start Phase 1 today! 🚀

Path: /mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md

# 📖 Complete Mac Mini OPNsense Implementation Guide The **complete, comprehensive, step-by-step guide** for implementing OPNsense on your Mac mini 2014 is available at: ## 📍 Location **Path:** `/mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md` **Size:** 1,959 lines / 46 KB **Reading Time:** ~30 minutes **Implementation Time:** 1-2 weeks (phased) --- ## 🎯 What's in the Full Guide ### Phase 1: OPNsense Installation & Basic Router Setup (Day 1) - Download OPNsense ISO - Create bootable USB (macOS & Windows instructions) - Install on Mac mini (detailed screenshots/commands) - Configure WAN/LAN interfaces - Setup DHCP (10.0.0.1-200, Gateway 10.0.0.254, DNS 10.0.0.55) - Configure static IP exclusions - Set Archer AX72 Pro to AP mode - Test connectivity - **45+ detailed steps with commands** ### Phase 2: Advanced Router Features (Day 2-3) - Install ntopng (network traffic analysis) - Configure Suricata IDS/IPS - Enhanced device tracking (IP, MAC, NetBIOS, mDNS) - Setup periodic nmap scanning - Traffic shaping & QoS - Comprehensive logging - Security hardening - **30+ configuration steps** ### Phase 3: Zenarmor Parental Controls (Day 4-5) - Install Zenarmor (os-sensei) - Complete setup wizard - Create policy for Bella (14yo) - strict controls - Create policy for Xander (15yo) - moderate controls - Create policy for William (17yo) - relaxed controls - Application blocking (TikTok, adult content, etc.) - Time-based rules (school hours, bedtime, weekends) - Time quotas per app (2 hours YouTube/day, etc.) - Safe Search enforcement - Daily email reports - **35+ policy configuration steps** ### Phase 4: Home Assistant Integration (Day 6-7) - Enable OPNsense API - Install HACS integration - Configure device trackers - Create firewall rules for HA control - Build automations: - Bedtime blocking (9 PM - 7 AM) - School hours restrictions - Bandwidth alerts - Policy violation notifications - Create dashboard (full YAML code provided) - Zenarmor API sensors - Notification setup - **25+ integration steps** --- ## 💎 Key Highlights ### Why Mac Mini is PERFECT: ``` Mac Mini 2014 vs $400 Protectli VP2420: ✅ Same CPU generation (4th gen Intel i5) ✅ Same RAM (8GB) ✅ MORE storage (500GB vs 256GB) ✅ 3x network interfaces (1 onboard + 2 Thunderbolt) ✅ Built-in power supply ✅ $0 cost (you already own it!) Performance: ✅ 1 Gbps routing with full DPI ✅ Suricata IDS/IPS + Zenarmor simultaneously ✅ Handles 50+ devices (you have 22) ✅ VPN server capability ✅ Years of detailed logs ``` ### What You'll Build: ``` Enterprise-Grade Router Features: 🔥 Deep Packet Inspection (see WHAT apps) 🔥 Application-level blocking (TikTok, gaming, etc.) 🔥 Time quotas per app (2 hours/day) 🔥 Per-device policies (3 kids, different rules) 🔥 Time-based controls (school vs after-school vs bedtime) 🔥 Safe Search enforcement (can't be disabled) 🔥 Intrusion detection/prevention 🔥 Real-time network monitoring 🔥 Automated daily reports 🔥 Home Assistant integration 🔥 Complete dashboard control vs Basic MAC Blocking (OpenWRT on Archer): ❌ Can only block ALL internet or NOTHING ❌ Can't distinguish YouTube from Khan Academy ❌ No per-app visibility ❌ No time quotas ❌ Manual log analysis ``` ### Example Policy (from guide): ```yaml Bella (14yo) - School Days Policy: 7 AM - 3 PM (School Hours): ✅ ALLOW: Educational sites (Khan Academy, school portal, Wikipedia) ✅ ALLOW: Research (Google for homework) ❌ BLOCK: Social media (TikTok, Instagram, Snapchat) ❌ BLOCK: Gaming (Fortnite, Roblox, Minecraft) ❌ BLOCK: Streaming (YouTube, Netflix) 3 PM - 9 PM (After School): ✅ ALLOW: YouTube Educational (2 hours max) ⏱️ LIMIT: TikTok (30 minutes max) ⏱️ LIMIT: Gaming (1 hour max) ⏱️ LIMIT: Social media (1 hour max total) 🔒 FORCE: Safe Search on all searches 9 PM - 7 AM (Bedtime): ❌ BLOCK: Everything except emergency sites Weekends: ⏱️ Extended quotas (3 hours gaming, 4 hours social media) 📊 Still tracked and reported Always: ❌ BLOCK: Adult content, Gambling, Violence 📧 ALERT: Parent on violations 📊 LOG: All blocked attempts ``` --- ## 📋 Complete Command Reference The full guide includes every command needed: ### Installation Commands: ```bash # Create bootable USB (macOS) bunzip2 OPNsense-25.1-dvd-amd64.iso.bz2 diskutil list diskutil unmountDisk /dev/diskX sudo dd if=OPNsense-25.1-dvd-amd64.iso of=/dev/rdiskX bs=1m ``` ### Configuration Commands: ```bash # SSH to OPNsense ssh root@10.0.0.254 # Install packages pkg install nmap avahi # Create scan scripts cat > /root/scripts/network_scan.sh << 'EOF' [...complete script...] EOF ``` ### Home Assistant YAML: ```yaml # Complete automation examples automation: - alias: "Bella Bedtime Block" trigger: - platform: time at: "21:00:00" # [... full automation code ...] # Complete dashboard examples type: vertical-stack title: Parental Controls cards: # [... full dashboard YAML ...] ``` --- ## 🎓 What You Learn The guide teaches you: 1. **OPNsense Installation** - Professional router OS setup 2. **Network Architecture** - WAN/LAN separation, VLANs 3. **Firewall Rules** - Packet filtering, NAT, routing 4. **Deep Packet Inspection** - Application identification 5. **Intrusion Detection** - Suricata IDS/IPS 6. **Traffic Analysis** - ntopng, bandwidth monitoring 7. **Device Tracking** - IP, MAC, hostname resolution 8. **Parental Controls** - Policy-based filtering 9. **API Integration** - OPNsense ↔ Home Assistant 10. **Automation** - Event-driven network control **Skills applicable to:** IT careers, network security, home lab, advanced homeassisting --- ## ⚡ Quick Start ### Immediate Next Steps: 1. **Read:** `/mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md` 2. **Backup:** Any important Mac mini data 3. **Gather:** 8GB+ USB drive, HDMI monitor, keyboard 4. **Download:** OPNsense ISO (~500MB) 5. **Schedule:** 2-3 hours for Phase 1 6. **Begin:** Follow Phase 1 step-by-step ### Phase 1 Can Be Done TODAY: - Download OPNsense: 10 minutes - Create USB: 10 minutes - Install OPNsense: 20 minutes - Basic config: 30 minutes - DHCP setup: 15 minutes - Archer AP mode: 10 minutes - Testing: 30 minutes - **Total: 2-3 hours → WORKING ROUTER** --- ## 💰 Cost Summary ### Total Investment: - **Hardware:** $0 (using Mac mini 2014) - **OPNsense:** $0 (free, open source) - **Zenarmor Home:** $59/year (optional but recommended) - **Total Year 1:** $59 - **Total Year 5:** $295 ### What You Save: - **Protectli VP2420:** $400 saved - **Qustodio Premium:** $138/year × 5 = $690 - **Total 5-Year Savings:** $790+ **You're getting enterprise-grade for $59/year vs $800+ for commercial solutions!** --- ## 📊 Comparison to OpenWRT (Your Original Question) | Feature | OpenWRT on Archer | OPNsense on Mac mini | |---------|-------------------|----------------------| | **Hardware Cost** | $0 | $0 | | **Software Cost** | $0 | $59/year | | **CPU Power** | 880 MHz MIPS | i5 @ 2+ GHz (4x faster) | | **RAM** | 512 MB | 8 GB (16x more) | | **Storage** | 128 MB flash | 500 GB SSD (4000x more) | | **Network Ports** | 5x GbE | 3x GbE | | **App Visibility** | ❌ No | ✅ Full DPI | | **Block TikTok Only** | ❌ No | ✅ Yes | | **Time Quotas** | ❌ No | ✅ Yes (2 hours/day per app) | | **See What Apps** | ❌ No | ✅ YouTube, Discord, etc. | | **Content Filtering** | ⚠️ DNS only | ✅ DPI + DNS | | **Safe Search** | ⚠️ DNS-based | ✅ Enforced (can't bypass) | | **IDS/IPS** | ❌ Too weak | ✅ Suricata full-featured | | **Traffic Analysis** | ⚠️ Basic | ✅ ntopng (professional) | | **Reporting** | ❌ Manual | ✅ Automated daily emails | | **HA Integration** | ⚠️ SSH commands | ✅ Native API | **Verdict:** OPNsense on Mac mini wins in every category except pure simplicity. The $59/year cost is worth it for the capabilities gained. --- ## 🎯 Success Criteria ### After Phase 1 (Basic Router): - [ ] Internet working on all devices - [ ] WiFi via Archer AX72 Pro AP - [ ] DHCP assigning 10.0.0.x IPs - [ ] DNS resolving via AdGuard (10.0.0.55) - [ ] Static IPs working (HA @ 10.0.0.55) - [ ] OPNsense web interface accessible - [ ] Stable for 24+ hours ### After Phase 2 (Advanced Features): - [ ] ntopng showing real-time traffic - [ ] Suricata detecting threats - [ ] Device tracking working (IP/MAC/hostname) - [ ] Periodic scans running - [ ] Logs capturing all activity - [ ] Stable for 24+ hours ### After Phase 3 (Parental Controls): - [ ] Zenarmor analyzing traffic - [ ] 3 policies active (Bella, Xander, William) - [ ] Apps being blocked (TikTok, etc.) - [ ] Time quotas enforcing (2 hours YouTube) - [ ] Safe Search working - [ ] Daily reports arriving via email - [ ] Stable for 2-3 days ### After Phase 4 (HA Integration): - [ ] Device trackers showing status - [ ] Firewall rules controllable via HA - [ ] Bedtime automation working - [ ] Dashboard displaying data - [ ] Notifications arriving on violations - [ ] All 22 devices tracked - [ ] System production-ready! --- ## 🆘 Emergency Procedures All included in full guide: ### If Internet Stops Working: ```bash # Console access (monitor + keyboard) 1. Login as root 2. Select option 8 (Shell) 3. Run: ping 8.8.8.8 4. If fails: Check WAN interface 5. If works: Check firewall rules ``` ### If Can't Access Web Interface: ```bash # Reset to defaults via console 1. Select option 4 (Reset to factory defaults) 2. Or just fix IP: ifconfig em0 10.0.0.254 3. Access: https://10.0.0.254 ``` ### Complete Rollback: ```bash # Revert to old router 1. Disconnect Mac mini 2. Connect old router 3. Restore HA backup 4. Network back to normal in 5 minutes ``` --- ## 📞 Getting Help ### Support Resources: - **Full Guide:** `/mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md` - **This Repo:** Issue tracker, examples, tips - **OPNsense Forum:** https://forum.opnsense.org/ - **Zenarmor Forum:** https://forum.opnsense.org/index.php?board=76.0 - **Reddit:** r/OPNsenseFirewall - **Home Assistant:** https://community.home-assistant.io/ ### Common Questions Answered in Guide: - "Will this erase macOS?" → Yes (backup first!) - "Can I go back?" → Yes (rollback procedure included) - "Is 8GB RAM enough?" → Yes (perfect amount) - "What if I mess up?" → Step-by-step recovery included - "How long does this take?" → 1-2 weeks phased implementation --- ## 🏁 Bottom Line Your **Mac mini 2014 is PERFECT** for this project. **You will transform it into:** - ✅ Enterprise-grade firewall - ✅ Professional router - ✅ Intrusion detection system - ✅ Parental control platform - ✅ Network monitoring station **Better than:** - ❌ $500 Firewalla Gold - ❌ $400 Protectli VP2420 - ❌ $250 Qotom mini PC - ❌ OpenWRT on Archer (limited) **For:** - **$0 hardware cost** (reusing Mac mini) - **$59/year software** (Zenarmor Home) - **1-2 weeks time** (phased, tested approach) **The full guide makes this achievable even for beginners - every command, every setting, every troubleshooting step is documented!** --- **Read the full guide and start Phase 1 today!** 🚀 Path: `/mnt/user-data/outputs/MAC_MINI_OPNSENSE_GUIDE.md`
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jessikitty/ha-wirelesscontrol-migration#2