Adding a Next-Gen Firewall to Your MikroTik Network
Run OPNsense with Zenarmor on a dedicated device on your LAN — adding deep packet inspection, application control, and threat intelligence without replacing your MikroTik router.
What This Guide Sets Up
MikroTik handles your routing and internet connection as normal. OPNsense sits on your LAN as an inline firewall — all traffic passes through it before reaching your devices, giving you application-layer visibility and control that RouterOS alone can’t provide.
Internet
│
MikroTik (router/WAN — does what it’s always done)
│ LAN traffic
▼
OPNsense + Zenarmor (inline NGFW — inspects all traffic)
│ clean traffic only
▼
CRS326 switch → your LAN devices
MikroTik LAN IP: 192.168.88.1 (your existing gateway)
OPNsense WAN IP: 192.168.88.2 (gets internet from MikroTik)
OPNsense LAN IP: 10.0.0.1 (new gateway for your devices)
Your devices: 10.0.0.x (DHCP from OPNsense)
Hardware — Pi 5 vs Mini PC
OPNsense’s officially supported platform is x86-64. ARM64/Pi support exists via community-built experimental images that are not official releases. For a production home setup, a cheap x86 mini PC is a much more reliable foundation — and frankly better value for money.
- Official OPNsense support
- All plugins including Zenarmor work fully
- Intel N100 / N150 chips: ~$100–150 AUD
- Usually has 2–4 built-in Ethernet ports
- Runs cool and quiet, ~10W idle
- Examples: Trigkey N100, Beelink EQ12, Topton N6005
- No official OPNsense ARM64 image
- Community images only — use at your own risk
- Only one built-in Ethernet port (need USB NIC for WAN+LAN)
- Zenarmor performance will be limited
- May work fine — just less supported
- Pi 5 steps covered separately below
This guide primarily covers the x86 mini PC path, which is the recommended setup. Pi 5 specific notes are called out where the steps differ.
Prerequisites
Part 1 — Install OPNsense
Go to opnsense.org/download and download the latest release. Select:
- Architecture: amd64
- Image type: dvd (for USB installer) or memstick-serial if the machine has no video out
- Mirror: pick one geographically close to you
The file will be a .iso.bz2 or .img.bz2. Extract it, then write it to your USB drive using Balena Etcher — just select the file, select your USB drive, and click Flash.
Plug the USB drive into your mini PC, connect a monitor and keyboard, and power it on. Enter the BIOS (usually F2, F12, or Del) and set USB as the first boot device.
OPNsense will boot to a login prompt. Log in with:
Username: installer Password: opnsense
Follow the installer wizard:
- Accept the default keymap (or select yours)
- Choose Install (ZFS) — ZFS is more resilient than UFS for an always-on appliance
- Select your storage disk when prompted
- Set a root password when asked
- Let it install and reboot — remove the USB when prompted
After reboot, OPNsense will ask you to assign network interfaces. It will list the interfaces it detected (e.g. igc0, igc1).
When asked “Do you want to configure VLANs now?” — type n and press Enter.
Assign interfaces:
- WAN: the port connected (or that will connect) to your MikroTik LAN
- LAN: the port connected to your CRS326 switch
ifconfig to see which one shows a link — that’s the port you just plugged into.
From the OPNsense console menu, select option 2) Set interface IP address, then choose LAN. Configure it as:
- IPv4 address: 10.0.0.1
- Subnet mask: 24
- No IPv6 for now
- Enable DHCP server on LAN: Yes
- DHCP start: 10.0.0.10
- DHCP end: 10.0.0.200
OPNsense will now hand out IPs to any device connected to your LAN port or CRS326 switch.
Part 2 — Configure OPNsense via Web Interface
Connect a laptop to the CRS326 switch (or directly to the OPNsense LAN port). You should get an IP in the 10.0.0.x range. Open a browser and go to https://10.0.0.1 — accept the self-signed certificate warning.
Log in with root and the password you set during install.
OPNsense launches a setup wizard on first login. Work through it:
- Hostname: e.g.
opnsense - Domain: e.g.
home.lan - Primary DNS: 1.1.1.1 (or your Pi-hole IP if you have one)
- WAN type: DHCP — OPNsense will get its WAN IP from MikroTik
- LAN IP: 10.0.0.1 (already set)
- Set a new admin password
Complete the wizard. OPNsense will reload.
Go to Interfaces → WAN. Since OPNsense is sitting behind MikroTik (not directly on the internet), disable the options that assume WAN is exposed directly:
- Uncheck Block private networks
- Uncheck Block bogon networks
Save and apply. OPNsense’s WAN will get an IP from MikroTik’s DHCP (e.g. 192.168.88.x).
Before adding anything else, update to the latest release. Go to System → Firmware → Updates and click Check for Updates. Install all available updates and reboot if required.
opnsense-update -u && opnsense-update -p
Part 3 — Install Zenarmor
Zenarmor requires two plugins to be installed. Go to System → Firmware → Plugins and search for zenarmor. Install both:
- os-sunnyvalley — the vendor repository (install this first)
- os-zenarmor — the main Zenarmor engine
Click the + button next to each. After both are installed, go to System → Firmware → Updates and run an update to pull the latest Zenarmor packages.
A new Zenarmor menu will appear in the sidebar. Click it to launch the setup wizard. Work through each screen:
Packet engine: Choose Netmap if available (faster, recommended for x86). If unavailable, choose NFQ.
Database backend: Choose SQLite — MongoDB is being deprecated as of September 2025 and SQLite is the recommended option for home use.
Interface selection: Select your LAN interface. This is the interface Zenarmor will inspect traffic on. Leave WAN unchecked unless you have a specific reason.
Subscription: Select Get Me the Free Edition. You can optionally enter your email to stay updated. The Free Edition is permanently free with no expiry.
Click Complete to finish setup. Zenarmor will start its engine — this may take a minute.
Go to Zenarmor → Policies → Default. The free tier uses a single catch-all policy that applies to all traffic. Configure the two main tabs:
Web Controls tab — block categories of websites. Recommended starting blocks:
- Malware / Phishing / Command & Control
- Ads & Trackers (optional — may break some sites)
- Adult Content (if applicable)
App Controls tab — block or monitor applications regardless of port or domain. Zenarmor can identify apps by their traffic patterns. Useful blocks:
- Anonymizers / Proxies / Tor
- Peer-to-peer (if you want to restrict it)
- Cryptomining
Click Save Changes after each tab.
Part 4 — Route Your LAN Traffic Through OPNsense
At this point OPNsense is running but your LAN devices are still getting their gateway from MikroTik. You need to physically wire the network correctly and optionally adjust MikroTik’s DHCP so devices use OPNsense as their gateway.
The physical layout should be:
MikroTik LAN port ──► OPNsense WAN port (cable 1) OPNsense LAN port ──► CRS326 port 1 (cable 2) CRS326 ──► all your LAN devices
Your MikroTik hAP ax³ Wi-Fi clients won’t go through OPNsense unless you also connect the hAP ax³ to the CRS326 as a downstream AP. To get all traffic through OPNsense:
- Connect the hAP ax³ LAN port to the CRS326 (not to its own WAN/internet port)
- Disable DHCP on the hAP ax³ LAN (so OPNsense handles DHCP for Wi-Fi clients too)
MikroTik needs a static route so it knows that the 10.0.0.0/24 subnet (your devices) is reachable via OPNsense’s WAN IP. Without this, MikroTik can’t reach your devices if you ever need to manage them, and the return path for some traffic may break.
First, give OPNsense a static WAN IP on MikroTik’s DHCP so it doesn’t change:
# Find OPNsense's MAC address first /ip/arp/print # Add a static DHCP lease for OPNsense's WAN interface /ip/dhcp-server/lease/add \ mac-address=XX:XX:XX:XX:XX:XX \ address=192.168.88.2 \ comment="OPNsense WAN"
Then add a static route so MikroTik knows about the OPNsense LAN subnet:
/ip/route/add \ dst-address=10.0.0.0/24 \ gateway=192.168.88.2 \ comment="OPNsense LAN subnet"
Verifying Everything Works
- Devices connected to the CRS326 get a
10.0.0.xIP address - You can browse the internet normally from those devices
- The Zenarmor dashboard at Zenarmor → Dashboard shows traffic flowing
- The Query Log shows DNS lookups being processed
- Blocked categories show hits after normal browsing
To confirm OPNsense is in the traffic path, run a traceroute from a LAN device — you should see 10.0.0.1 as the first hop:
tracert 1.1.1.1
traceroute 1.1.1.1
The first hop should be 10.0.0.1 (OPNsense), then 192.168.88.1 (MikroTik), then your ISP.
Zenarmor Free Edition — What You Get
| Feature | Free | Home (paid) |
|---|---|---|
| App identification & control | ✅ Yes | ✅ Yes |
| Web category filtering | ✅ Pre-set categories | ✅ Custom categories |
| Threat intelligence blocking | ✅ Yes | ✅ Yes |
| Dashboard & reporting | ✅ Yes | ✅ Advanced |
| Multiple policies | ❌ One catch-all policy only | ✅ Per-device / per-user policies |
| TLS inspection | ❌ | ✅ |
| Number of devices | Up to ~100 (SQLite) | Unlimited |
| Cost | Free forever | Paid subscription |
For a home network the Free Edition covers the most important bases — app control, category filtering, and threat blocking. The paid Home tier is worth it if you want per-device policies (e.g. different rules for kids’ devices vs adults).
Troubleshooting
Devices aren’t getting a 10.0.0.x IP
Check the physical cabling — devices need to be connected to the CRS326, which connects to OPNsense’s LAN port. Verify OPNsense’s DHCP server is running under Services → DHCPv4 → LAN. Check that the lease range is configured and the service is enabled.
Internet isn’t working from LAN devices
Confirm OPNsense’s WAN interface has an IP from MikroTik (Interfaces → WAN should show a 192.168.88.x address). Check that NAT is enabled — go to Firewall → NAT → Outbound and ensure automatic outbound NAT is selected. Also check the firewall rules under Firewall → Rules → LAN allow traffic out.
Zenarmor dashboard shows no traffic
Make sure Zenarmor is set to inspect the correct interface. Go to Zenarmor → Settings → Interfaces and confirm your LAN interface is selected. If you changed interfaces after setup, restart the Zenarmor engine from Zenarmor → Settings → Updates & Support → Restart Engine.
Some sites or apps stop working after enabling Zenarmor
Check Zenarmor → Dashboard → Blocked Connections to see what was blocked. You can add exceptions in the policy settings. Start with more permissive category settings and tighten over time once you know what’s normal on your network.
Can’t reach OPNsense web interface after wiring changes
If you’ve changed cables and lost access, connect a laptop directly to OPNsense’s LAN port. You should get a 10.0.0.x address and reach https://10.0.0.1. From the console you can also reset the interface config using option 2 from the menu.
Quick Reference
| Item | Value |
|---|---|
| OPNsense web interface | https://10.0.0.1 |
| OPNsense WAN IP (from MikroTik) | 192.168.88.2 (static lease) |
| OPNsense LAN / gateway | 10.0.0.1 |
| DHCP range for devices | 10.0.0.10 – 10.0.0.200 |
| Zenarmor dashboard | OPNsense sidebar → Zenarmor → Dashboard |
| Install Zenarmor plugins | System → Firmware → Plugins → search “zenarmor” |
| Default OPNsense login | root / password set during install |
| Check OPNsense updates | System → Firmware → Updates |
| MikroTik static route | /ip/route/add dst-address=10.0.0.0/24 gateway=192.168.88.2 |
Uses OPNsense (BSD licence) and Zenarmor Free Edition · Guide last updated June 2026
