N100 Firewall Setup: OPNsense Install and First Boot

A four-port fanless N100 box arrives with no operating system, no labels on the network ports, and usually no documentation beyond a folded sheet showing where the power jack is. This is the order of operations that gets OPNsense onto it without a reinstall, and the handful of first-boot decisions that are annoying to change later.

Hardware selection is a separate question. If the box is not bought yet, start with the Intel N100 firewall build guide, because the NIC chipset on the board determines whether any of this goes smoothly.

Before the installer: three things to settle

Console access. OPNsense’s documentation is explicit that after preparing the installation media you need to be able to reach the console, “either via keyboard and [virtual]monitor or serial connectivity.” Most N100 appliances have HDMI or DisplayPort plus a USB port, so a monitor and keyboard is the simplest path. Some of the smaller DIN-rail style units are serial-only. Check which one is in the box before downloading an image, because the image type depends on it.

BIOS entry key. The OPNsense manual notes that the key to reach the boot menu or UEFI setup “will be a function (F#), Del, or ESC key that needs to pressed immediately after powering on (or rebooting),” usually within the first two to three seconds. Generic N100 appliance boards mostly ship an AMI firmware, where Del reaches setup and F7 or F11 reaches the one-time boot menu, but the board is the authority and not this page. Find the key before the USB stick is in, not after.

Which port is WAN. Nothing on the chassis tells you. The plan for figuring this out is covered below; the point here is that guessing wrong is the single most common reason a first install ends with no internet and no management access at the same time.

Choosing the right image

OPNsense publishes two image families and four types, and picking the wrong one is a wasted evening.

Image type	Console	Type	Use it when
dvd (ISO)	VGA only, UEFI	Full	Installing in a VM or from virtual media
vga (USB)	VGA only, UEFI	Full	The appliance has HDMI/DP and a USB port
serial (USB)	Serial 115200, UEFI	Full	The appliance has no video output
nano	Serial 115200, secondary VGA	Embedded	Preinstalling onto a card for an embedded device

For a typical four-port N100 appliance with video output, the vga USB image is the right choice. The nano image is the wrong choice even though it looks convenient: OPNsense documents it as an embedded image that “writes to RAM disk” with “no log data retention after reboot,” which is not what you want on a box that has a real SSD in it.

Both full image types can run the OPNsense Importer before booting, and the Installer once booted. That matters for a rebuild later: the Importer can boot an existing on-disk configuration in memory without touching the installation, which is the documented way to preview an upgrade safely.

Boot, live environment, installer

The OPNsense boot process is designed to always land in a live environment first. Three logins are relevant and they are documented, not secret:

• Live environment shell and GUI: user root, password opnsense, GUI at https://192.168.1.1/.
• To start the installer: user installer, password opnsense.
• If the installer user does not work, log in as root, choose 8) Shell, and run opnsense-installer.

Change the root password during the install, not after. The installer prompts for it as one of its steps, and a firewall sitting on a LAN with the documented default password is not a firewall.

UFS or ZFS

The installer asks early. OPNsense’s own guidance is that “ZFS is in most cases the best option as it is the most reliable option, but it does require enough capacity (a couple of gigabytes at least).” On an N100 build with the 120 GB SSD that OPNsense’s recommended hardware specification calls for, capacity is not a constraint, so choose ZFS.

The practical payoff is boot environments. A firmware upgrade that breaks something can be rolled back to the previous boot environment instead of being restored from a config backup on a box whose failure mode is the whole household losing internet.

One exception is written into the documentation: on appliances that boot from soldered SD or MMC flash, OPNsense says to “select the UFS filesystem and choose mmcsd0 in the Disk Selection.” That is another reason the build guide argues against eMMC configurations for this class of hardware.

The remaining installer steps are short: keymap (the default is almost always fine), partitioning scheme (stripe is the correct answer for a single disk), disk selection, the “Last Chance!” confirmation that formats the target, the root password, and Complete Install.

Take care at disk selection. A four-port N100 box booting from a USB stick will show both the internal drive and the stick. The internal NVMe drive normally appears as nvd0 or nda0; the USB installer appears as da0. Installing onto da0 produces a firewall that works until the stick is removed.

Interface assignment: the part that actually goes wrong

After the install and reboot, the system prompts for interface assignment. On an N100 appliance with four Intel 2.5GbE ports you will see four interfaces named igc0 through igc3, in board order rather than in any order printed on the case.

pfSense documents an auto-detection procedure that works identically in principle on either platform, and it is the fastest reliable method:

1. Unplug every network cable from the appliance.
2. Choose the auto-detection option (a in the pfSense assigner).
3. Plug a cable into the port you intend to use as WAN.
4. Wait a few seconds for the link-up event, then press Enter.
5. Repeat for LAN and any optional interfaces.

Netgate’s documentation notes that the interface list also prints MAC addresses and shows (up) after the address when a link is detected, so even without auto-detection you can plug one cable in at a time and read off which device changed state.

Two conventions worth adopting on a four-port box:

• Put WAN on the port physically furthest from the power jack, or on port 1, and write it down. Consistency across rebuilds is worth more than which port you picked.
• Do not bridge the remaining ports by default. On this hardware they are separate NICs on separate PCIe lanes, not switch ports. Bridging them in software turns the CPU into a slow switch. Leave OPT1 and OPT2 unassigned until there is a reason for them, or feed them to a real switch.

If the interfaces come up named re0 and re1 instead of igc0 and igc1, the appliance has Realtek controllers, not the Intel i226-V the listing may have implied. That is a hardware finding, not a configuration problem, and it changes what throughput to expect.

First boot: what to check in the first ten minutes

The default LAN address is 192.168.1.1 and the console welcome banner prints the current WAN and LAN assignments, so the first check is simply reading that banner. On pfSense, the GUI presents its Setup Wizard automatically at the first login; Netgate notes the wizard is optional and can be exited by clicking the logo.

A short first-boot list for N100 hardware specifically:

• Confirm the NIC driver. ifconfig should show igc interfaces. This is the single fact that predicts whether the rest of the deployment is uneventful.
• Leave hardware offloads disabled. Both projects ship checksum offload, TSO and LRO switched off. Netgate’s tuning documentation says the settings “default to checked (disabled) for good reason” because “nearly all hardware/drivers have issues with these settings, and they can lead to throughput issues.” Do not switch them on chasing 2.5 Gbps.
• Set the timezone and NTP before anything else. Certificate validation, VPN handshakes and log correlation all depend on it, and the wizard offers it early for that reason.
• Decide DNS deliberately. pfSense ships the DNS Resolver active in resolver mode, talking directly to root and authoritative servers, so the wizard’s DNS fields can be left blank. If the intention is to forward to an upstream resolver, that is a configuration change, not a default.
• Take a configuration backup before installing a single plugin. Export the XML and put it somewhere off the box. Combined with the Importer described above, that turns a future rebuild into a fifteen-minute job.
• Do not enable Suricata on day one. Get routing, NAT and DNS stable first. Inline inspection is the feature most likely to make a four-thread CPU the bottleneck, and diagnosing it on top of a fresh install is unnecessary work.

If the install will not boot or will not link

Two failure modes account for most first-install trouble on this class of appliance, and both have their own path:

• The installer boots but no port ever links. Work through the ordered checks in the guide on i226-V link drops and 2.5GbE flapping before assuming the board is faulty.
• Everything installs and routes, but throughput is below expectations. That is usually a sizing question rather than a fault. The N100 versus N305 and N5105 comparison covers where each part actually runs out of headroom, and the appliance throughput and power estimator gives a rough envelope for a given feature set before you spend time tuning.

The short version

Buy the box with Intel i226-V ports, use the vga full image, install to ZFS on the internal SSD rather than the USB stick, assign interfaces with the cable-detection method instead of guessing, change the root password during the install, and leave the hardware offloads alone. Everything else on an N100 firewall is a configuration decision you can revisit; those six are the ones that cost a reinstall.

Related reading

• Intel N100 firewall build guide: NICs, throughput, power
• N100 vs N305 vs N5105: firewall CPU comparison
• i226-V link drops: fix 2.5GbE flapping on OPNsense