Advanced Security Kaffee4Ecks OPNsense Config xD

[Kaffee4Eck]

Core System & Endpoint Setup​

Firewall​

• OPNsense (current stable version) with full VLAN segmentation

Endpoints​

Device Type	Usage
Windows	Gaming – hardened ESET Smart Security Premium
Arch Linux	Development & system administration
Mac Mini M1	Productivity & software testing

---

Virtualization Environment​

• Malware testing VMs are hosted in dedicated, air-gapped VLANs, fully isolated from production networks for safe phishing/malware/exploit simulations.

---

Firewall Components & Protection Layers​

Component	Description
ZenArmor (NGFW)	Layer-7 policy enforcement, app detection, activated per VLAN
Suricata IDS/IPS (inline)	Real-time traffic analysis using Emerging Threats and custom local rules
GeoIP Filtering	Blocks all incoming traffic from outside the EU, VLAN-specific
Firewall Aliases & Segmentation	Fine-grained control over traffic for workstations, IoT, guest devices, test labs, etc.

---

Extended Security Services & Features​

Service / Tool	Functionality
ESET Smart Security (hardened)	Signature + behavior-based protection, sample submission disabled, local firewall active
AdGuard Home + Unbound DNS	Local DNS filtering with privacy-focused DNS (DNSSEC, DoT/DoH optional)
SearXNG (Docker)	Private, self-hosted meta search engine – fully anonymous, no telemetry or tracking
TailScale	VLAN-isolated remote access with ACLs and audit logging
Sample Testing VLAN	Malware/phishing/exploit simulation VMs in a fully isolated network segment
Threat Feeds / IP & DNS Blocklists	Includes ThreatFox, AbuseIPDB, FireHOL, MalwareDomains, AdGuard lists, and custom feeds

---

Operating Systems & Per-System Security Strategy​

System	Measures
Windows (Gaming)	Hardened ESET, SmartScreen disabled, telemetry reduced
Arch Linux	AppArmor, hardened kernel, firewalld, DNS via DNS-over-HTTPS (DoH)
macOS (M1 Mini)	Local firewall, DNS via Unbound, no iCloud, tracker blocking active

---

Network Security Goals​

• Maximum segmentation & visibility – each device only sees what it’s supposed to
• No third-party cloud analysis (e.g., Microsoft Defender Cloud, Google DNS)
• Isolated, real-world malware testing environment with minimal risk to the rest of the network
• Zero Trust DNS & application enforcement

Protection Focus​

• Phishing / Malware / Command & Control (C2) communications
• Telemetry & tracking prevention (both DNS- and IP-based)
• Ransomware & exploit protection (behavioral + signature-based)

 

[harlan4096]

Even having ESET (Hardened), I would set up UAC to Always Notify.

About Periodic malware scanners, I'm sure You know the different ones You could use: NPE, EEK, KVRT...

Thanks for sharing