Server Documentation: cisco.firewall.england

System Overview

Hostname: cisco.firewall.england
IP Address: 192.168.0.1 (Internal Gateway)
OS: FreeBSD 14.3-RELEASE-p7 (OPNsense 25.7 Stable)
Architecture: amd64
Primary Role: Stateful Firewall, NAT Gateway, and Perimeter Security.

Network Interfaces

em0 (WAN): 192.168.1.222 (Upstream Gateway: 192.168.1.254)
em1 (LAN): 192.168.0.1 (Local Network: 192.168.0.0/24)

Core Security Services (BSD rc.d)

The following critical daemons are active, providing the backbone of the OPNsense infrastructure:

Service	Component	Description
pf	Packet Filter	The core firewall engine managing stateful inspection.
unbound	DNS Resolver	Hardened recursive DNS server for the gateway.
dnsmasq	DNS/DHCP Forwarder	Lightweight DNS forwarder providing local resolution support.
suricata	IDS/IPS	High-performance Network IDS, IPS, and Security Monitoring.
syslog-ng	Logging	Enhanced system logging daemon for advanced audit trails.
sshd	OpenSSH	Secure remote administration on Port 22.
lighttpd	Web GUI	Serves the OPNsense administrative web interface (Ports 80/443).

Port Forwarding & NAT Configuration

The gateway handles several critical redirections to internal lab servers:

Ingress Port Mapping (RDR)

External Port	Protocol	Internal Target	Target Port	Service
1194	TCP/UDP	192.168.0.140	1194	OpenVPN Tunnel
12222	TCP/UDP	192.168.0.140	12222	WolAuthServer
46317	TCP/UDP	192.168.0.143	46317	DB Server (Encrypted Data)

Outbound NAT

Standard Masquerade: All internal traffic from 192.168.0.0/24 is NAT'ed through em0.
Static-Port NAT: Specifically configured for isakmp (Port 500) to ensure VPN/IPsec compatibility.

Security Policy & Rulesets (pf)

Anti-Spoofing: Strict block rules prevent traffic from unauthorized internal IPs on the WAN interface.
Automated Lockouts:
- <sshlockout> table: Automatically drops traffic to SSH/HTTPS ports from repeat offenders.
- <virusprot> table: Drops all traffic from known malicious sources.
- <bogons> table: Blocks unassigned and private IP space on the WAN.
ICMP Policy: Explicitly allows essential IPv6-ICMP types (Neighbor Discovery, Router Advertisement) for network health.

Maintenance & Monitoring

Log Management: syslog-ng and newsyslog manage rotation and archiving.
Traffic Graphing: rrdcached maintains Round Robin Databases for historical performance analysis.
Health Checks: A custom ping_hosts.sh script runs every 4 minutes via cron to verify the availability of critical lab nodes.

Critical Diagnostic Commands

Verify Listening Sockets: sockstat -4 -l
Inspect Filter Rules: pfctl -sr
Inspect NAT Rules: pfctl -sn
Check Service Status: service -e

Live Status

Status

CPU --

CPU Temp --

RAM -- (--)

Uptime --

Last Seen --

Raw Hardware Specifications

System:
  Kernel: redacted arch
  amd64 bits: 64
  compiler:
  clang v: 19.1.7
  Console: pty pts/0
    OS: FreeBSD redacted
Machine:
  Type: Firewall System: Cisco product: SALEEN
  Mobo: Cisco model: ASA5515
  BIOS: American Megatrends: redacted
    date: redacted
CPU:
  Info: quad core model: Intel Core i3 540 bits: 64 type: 
  cache: 
    L1: 32 KiB
    L2: 256 KiB L3: 4 MiB note: check
  Speed (MHz): 3059 min/max: N/A cores: No OS support for core speeds.
Graphics:
    None
Audio:
  Message: No device data found.
Network:
  Device-1: Intel 82574L Gigabit Network driver
  IF: em0 state: active speed: 1000baseT duplex
  Device-2: Intel 82574L Gigabit Network driver
  IF: em1 state: active speed: 1000baseT duplex
  Device-3: Intel 82574L Gigabit Network driver
  IF: em2 state
  Device-4: Intel 82574L Gigabit Network driver
  IF: em3 state
  Device-5: Intel 82574L Gigabit Network driver
  IF: em4 state
  Device-6: Intel 82574L Gigabit Network driver
  IF: em5 state
  Device-7: Intel 82574L Gigabit Network driver
  IF: em6 state
RAID:
  Device-1: zroot type: zfs status: ONLINE
  raw:
    size: 110 GiB 
    free: 109 GiB 
  zfs-fs:
    size: 106.59 GiB 
    free: 105.23 GiB
  Components: Online: 1:
Drives:
  Local Storage: 
  raw: 126.93 GiB 
  usable: 233.52 GiB 
  used: 1.36 GiB (0.6%)
  ID-1: /dev/ada0 vendor: Micron model 
    size: 119.24 
    GiB scheme: GPT
  ID-2: /dev/da0 model
    USB DISK MODULE PMAP 
    size: 7.69 GiB 
    scheme: MBR
Partition:
ID-1: / 
  size: 106.5 GiB 
  used: 1.28 GiB (1.2%) 
  fs: zfs 
  logical: zroot/ROOT/default
ID-2: /boot/efi 
  size: 259.9 MiB 
  used: 1.3 MiB (0.5%) 
  fs: msdosfs 
  dev: /dev/efiboot0
ID-3: /home 
  size: 105.23 GiB 
  used: 96 KiB (0.0%) 
  fs: zfs 
  logical: zroot/home
ID-4: /tmp 
  size: 105.23 GiB 
  used: 652 KiB (0.0%) 
  fs: zfs 
  logical: zroot/tmp
ID-5: /var/log 
  size: 105.3 GiB 
  used: 79.5 MiB (0.1%) 
  fs: zfs 
  logical: zroot/var/log
ID-6: /var/tmp 
  size: 105.23 GiB 
  used: 96 KiB (0.0%) 
  fs: zfs 
  logical: zroot/var/tmp
Swap:
  Alert: No swap data was found.
Sensors:
  Src: sysctl Message: No sensor data found. Are data sources present?
Info:
  Processes: 86 
  Uptime: 7h 53m 
  Memory: total: 8 GiB 
  available: 7.95 GiB 
  used: 1.38 GiB (17.3%)
  Init: init (BSD) 
  Compilers: clang: 19.1.7 
  Packages: 6 
  Shell: csh v: redacted