How to install OPNsense: default logins, first setup and hardening for IT teams and MSPs

Updated: November 2026. Logins, install steps and console labels checked against the OPNsense docs, release notes and 26.7 source for OPNsense 26.7.9 (install image 26.7) on 11 November 2026.

You've booted the OPNsense image, the console asks for a login, and the password you tried gets rejected. Past that prompt, the box still needs a disk layout, a LAN address and new passwords before it goes near a production network. This guide gives you the OPNsense installer password and every other default login, then the install and the first-login hardening IT teams and MSPs do before go-live.

TL;DR

• Installer login. The OPNsense installer login is installer / opnsense on the live image.
• Other defaults. Live console and web GUI use root / opnsense, kept after install if you skip the password step.
• Version. Install the 26.7 image, then update to 26.7.9 under System > Firmware > Status.
• Hardware. Plan on amd64 hardware with 3 GB of RAM or more, and verify the image first.
• Before go-live. New root password, named admins with TOTP, no management on WAN and password-protected backups.

OPNsense installer password and default logins

The dvd, vga and serial images boot into a live environment first, and the login that works depends on the stage. These are the defaults the docs list.

When installer / opnsense is rejected, the docs name one cause. The importer loaded an existing configuration at boot, and both users now take that config's root password. Otherwise, log in as root, choose 8) Shell and run opnsense-installer. The 26.7.8 changelog entry about the installer user changed how the account is stored, to allow argon2id hashing, and left the login alone.

Why the live image needs its own network

The live environment is a running OPNsense. The docs list console, web GUI and SSH access to it at 192.168.1.1, with the published passwords. On a production LAN, anyone who knows the defaults can log in, and 192.168.1.1 may already be the office router. Boot it on a bench switch or an isolated VM network. Live changes vanish at reboot anyway, because the media is read-only.

What you need before you install

OPNsense runs on x86-64 (amd64) hardware only. The hardware docs give three tiers, and the virtual machine docs add a fourth.

Memory scales with traffic. Each entry in the state table, the firewall's list of tracked connections, takes about 1 kB of RAM, so 1,000 states use roughly 1 MB. Our stateful firewall explainer covers how state tracking works.

By default, the console makes the first port LAN and the second WAN, so a typical build starts with two network ports. Pick the image by how you'll boot it.

Nano skips the installer: write it to the media, boot, and configure. OPNsense is licensed BSD 2-Clause, with the code on GitHub. Business Edition pricing and appliances are in our OPNsense vendor profile.

Download and verify the OPNsense image

Images ship on a schedule with the January and July majors, so the image can trail the release. Today the image is 26.7, from 15 July 2026, and the current release is 26.7.9, from 11 November 2026. The next image, 27.1, is due in January 2027. The release README says to update right after installing.

The download page's default is OPNsense-26.7-dvd-amd64.iso.bz2. Check its SHA-256 against OPNsense-26.7-checksums-amd64.sha256, then decompress and check the signature, which since 24.1 is made on the uncompressed image. These commands follow the install docs' syntax with the file names on the 26.7 mirror, and a good image ends with Verified OK.

code
openssl sha256 OPNsense-26.7-dvd-amd64.iso.bz2
bzip2 -d OPNsense-26.7-dvd-amd64.iso.bz2
openssl base64 -d -in OPNsense-26.7-dvd-amd64.iso.sig -out /tmp/image.sig
openssl dgst -sha256 -verify OPNsense-26.7.pub -signature /tmp/image.sig OPNsense-26.7-dvd-amd64.iso

The release README warns that a checksum on a mirror doesn't prove authenticity, so cross-check it against the forum announcement or the GitHub changelog. The same README prints the 26.7 public key. Compare OPNsense-26.7.pub with it before you trust the result. Then write the image with dd, or with physdiskwrite, Etcher or Rufus on Windows.

How to install OPNsense step by step

The map below shows which login works at each stage, from boot media to the first web GUI session.

Boot from the stick or the ISO. The installer's defaults are fine wherever this list doesn't say otherwise.

1. At the importer prompt, press a key only to restore a config from disk or from /conf/config.xml on a FAT USB stick.
2. Log in at the console as installer with the password opnsense. SSH from an internal host to 192.168.1.1 works too.
3. Keep the default keymap unless you need another.
4. Pick ZFS or UFS. The docs recommend ZFS as more reliable, and it needs a couple of GB of space.
5. On ZFS, choose stripe for a single disk.
6. Select the target disk, such as da0 or nvd0, and not the USB stick you booted from.
7. Confirm the Last Chance screen, which erases the disk.
8. On UFS, answer Yes to swap unless the disk is under 16 GB.
9. Set a new root password. Skip it and root keeps opnsense.
10. Choose Complete Install, then remove the stick or detach the ISO as the box restarts.

The Swedish Sysadmin's March 2025 walkthrough builds OPNsense in a VM over 42 minutes. It covers extracting the ISO, interface assignment, the web wizard and a first firewall rule. The video predates 26.7, so the wizard screens look different. The installer steps and logins match the current docs.

Installing OPNsense on Proxmox, VMware or Hyper-V

Use the DVD ISO, at least 3 GB of RAM and an 8 GB virtual disk. After the install, turn off all hardware offloading under Interfaces > Settings.

26.7 shipped with a known issue: Hyper-V guests with more than one vCPU could panic on certain hosts. 26.7.6 on 8 October carried a fix, and 26.7.7 on 13 October followed for Hyper-V users after that fix caused segfaults for others. The image is still 26.7, so on Hyper-V, update before you rely on the box.

If the host won't start VMs at all, enable virtualization in BIOS first.

First boot and the console menu

After the reboot, log in at the console as root with your new password. The default LAN is 192.168.1.1/24.

Option 1 assigns interfaces. Skip it and the defaults apply, with the first detected port as LAN and the second as WAN. To assign them by hand, the 26.7 console asks for WAN first, then LAN, then any extras as OPT. VLANs are optional at this step, and our VLAN explainer covers when they're worth it.

The install docs show an older version of this menu, with Reboot and Halt at 5 and 6 and older labels for 10 to 13. Go by what 26.7 prints.

Major upgrades through option 12 run offline, with no GUI or SSH until they finish, so keep console access in reach.

OPNsense setup wizard and first login

From a LAN client, browse to https://192.168.1.1 and log in as root. The browser warns because the web GUI uses a self-signed certificate by default, which no browser trusts out of the box. On a box you just installed and reached over its own cable, that's expected. The same warning on a firewall you didn't just build deserves a closer look.

The setup wizard opens on first login. 25.7 rebuilt it, and 26.1 added an abort button, deployment type choices and the option to turn off WAN or LAN. It covers basic system and network settings. The docs have no wizard page and the screens change between releases, so check each one against your build sheet.

On a new install, Dnsmasq hands out LAN addresses: since 25.7, factory resets and console assignments use it instead of ISC DHCP. Upgraded systems weren't part of that change.

Then update. In System > Firmware > Status, select Check for updates, and 26.7 moves to 26.7.9. Release Type under System > Firmware > Settings stays on Production, as the docs advise. Expect two majors a year and a minor about every two weeks. 26.7 has had nine point releases since 15 July.

In April 2026, a first-time user in r/homelab asked what to do after installing OPNsense on a two-port box. Replies said to add firewall rules only when something needs them and to keep USB network adapters off a router. Another reply suggested a VLAN for IoT devices once the switch and access points carry tagged traffic.

Harden OPNsense before go-live

The defaults are public, so they come off the box before it protects anything. The checklist uses the 26.7 setting names.

Leave Listen Interfaces for the GUI and SSH on all interfaces. The docs recommend that default and warn that binding by hand risks a lockout, rules out VPN interfaces and needs static addressing. Restrict access with firewall rules instead. Unmatched traffic is dropped, so with no WAN rule for the GUI or SSH, WAN stays closed, while the anti-lockout rule keeps LAN open.

The 26.7 image predates 26.7.5, so set the root password again after updating to get an argon2id hash. The os-git-backup plugin keeps every config change in Git, but the docs warn those backups are unencrypted and advise against public cloud Git hosting.

Common OPNsense install problems

The address clash catches bench builds. If the upstream router uses the same private range, WAN and LAN land in one subnet and routing breaks. Our private IP addresses explainer covers the ranges you can move LAN to.

Lost the OPNsense root password

The reset docs give three routes. If you can still reach the console menu, option 3 sets a new root password.

When nobody can log in, power off, boot again and pick Boot Single User, option 2, at the loader menu. On UFS, run mount -o rw /. On ZFS, run mount -u / and then zfs mount -a. Then run opnsense-shell password and reboot.

The third route needs the install media. Boot it, log in as installer, and after the keymap pick Password Reset - Recover Installation.

Running OPNsense for clients or multiple sites

One firewall is a project. A firewall at every client site is a process, and the defaults come off each one.

Keep a build sheet per site: version, disk layout, interfaces, LAN range and named admins. Keep the credentials in a vault, not the sheet. Our Vaultwarden guide covers running a self-hosted vault for work credentials.

Give each technician their own TOTP-protected account and remove it when they leave. Back up each config with a password, with a copy off the box. Book major upgrades where someone can reach the console.

Minors land about every two weeks, so name one owner for release watch and read the notes before each rollout. October shows why: 26.7.6 fixed a Hyper-V panic, and 26.7.7 followed five days later for the segfaults that fix caused elsewhere.

Deciso's Business Edition adds OPNcentral, a plugin from the commercial repository that keeps firewalls updated and managed from one entry point. Hosts register through an API key and secret generated per user. Business Edition majors ship in April and October, and 26.10 is current.

In an August 2025 r/msp thread on virtual firewalls, replies said OPNsense and pfSense hold up as VMs when sized right. One MSP runs a virtual HA pair of OPNsense, another has run it virtually for a decade. The cautions were updates that break things, forum-only support, and auditor questions from multi-tenant or compliance-heavy clients.

A virtual HA pair is two firewalls where one takes over when the other fails. Our failover explainer covers how that handover works.

If a client's standard is pfSense, our pfSense vendor profile covers it. VLANs, VPNs and intrusion detection come after go-live, each in its own change window.

From installer to go-live

The OPNsense installer password is opnsense for the installer user, and the live console and web GUI take it with root. Install 26.7 from verified media, update to 26.7.9, then replace the defaults with a new root password, named TOTP admins and no management on WAN. OpenMSP is published by Flamingo, which builds OpenFrame, open, AI-native infrastructure for IT and security; OpenFrame isn't a firewall. For where the firewall sits in the rest of the office, read our small office network design guide.