OPNsense

OPNsense is an open-source, FreeBSD-based firewall distribution, the most heavily automated single piece of software in the homelab: nearly every configuration surface, firewall rules, aliases, NAT, DHCP, DNS, certificate trust, firmware updates, is managed through its REST API rather than its own web UI.

It sits directly behind the ISP router on the WAN port, with one dedicated physical port per VLAN rather than a single trunk, so any two VLANs can each push full gigabit throughput at once without clogging each other, for example a desktop pulling a backup from the NAS while everything else keeps moving normally. Every interface has its own strict, fully logged firewall rules. OPNsense also runs DHCP, DNS resolution through Unbound, source and destination NAT, and holds the internal CA that signs every server certificate in the homelab.

A WireGuard VPN with two clients, phone and laptop, is the only service allowed to receive traffic on the WAN interface. Since nothing else is exposed to the internet, connecting to the VPN is required to reach any self-hosted service from outside the home network.

That API-first design is what makes it possible to treat the live firewall configuration as code. A dozen-plus dedicated Ansible roles cover everything from basic firewall rules to Kea DHCP reservations and Unbound DNS overrides, so a fresh OPNsense install can be brought to the exact same state as production from the Ansible repository alone.