OPNsense can provide network-edge security and segmentation for a business environment. Appropriate hardware, understandable rules and an operating model are essential. Two firewalls alone do not provide end-to-end availability for a site.
Connections
Providers, switches and routing
Firewall
Rules, VPNs and HA where required
Operations
Monitoring, updates and recovery
Assess availability from the connection to the application
An HA pair can cover the failure of one firewall. Shared switches, power supplies or a single internet connection remain potential failure points. The surrounding network must also support failover. For virtual firewalls, include the hypervisor, virtual switches and their configuration.
Test synchronisation and failover separately
Taking over a virtual IP does not prove that existing connections survive. Test the three mechanisms separately, starting in a test environment.
Three checks for an OPNsense pair
- CARP: who holds the virtual IP?
Check MASTER/BACKUP roles on both nodes. After an approved switchover, test access through the virtual IP again.
- pfsync: is connection state present?
Find a defined test connection in Firewall → Diagnostics → States Dump on both nodes. Observe the existing session and a new connection separately during switchover.
- Configuration: what is transferred?
Check the synchronisation scope and verify a harmless test change on the designated primary node. Synchronised states do not imply identical rules.
DECISION POINTTest VPNs, routing and the return to normal operation separately. Before production failure tests, secure management access, stop criteria and a return path. Existing sessions do not survive every failure scenario.
Agree updates and support in advance
Define who assesses new releases, performs tests and approves updates. Back up configurations and test recovery. The edition, plugins and external support agreements should match the response times your operations require.
Questions to resolve
- Which failures must the architecture handle?
- Have failover and recovery been tested in practice?
- Who handles updates and incidents outside routine operations?
MTS Maschinenbau
At MTS Maschinenbau, an OPNsense HA cluster is part of the redesigned infrastructure. The case study explains its relationship with network segmentation, the platform and backup.
View the project