Quick start

From the download to the first login, on any KVM-based platform.

What you need

• A KVM-based platform: host42, OpenStack, Proxmox VE or KVM with libvirt.
• A VM with two network cards. NIC 1 is the WAN: it takes its address by DHCP. NIC 2 is the LAN: gate42 is its router, at 192.168.1.1.
• 1 vCPU, 2 GB RAM and 10 GB of disk at least; 2 vCPU, 4 GB and 20 GB are recommended. The disk grows to the size of the VM's disk on the first boot.
• BIOS, or UEFI without Secure Boot, a virtio disk (virtio-blk or virtio-scsi) and virtio network cards.

1. Download and check the image

Download gate42 1.8.2 from the download page and verify it: gate42-1.8.2-b17-amd64.qcow2, 855.9 MB.

2. Create the VM

Follow the guide for your platform. Every guide comes down to the same three things: the image as the VM's disk, NIC 1 on your WAN network, NIC 2 on your LAN network.

3. The first boot

The first boot takes one to two minutes. Then the VM's console (the serial console or the screen) shows the root password of this firewall, above the login prompt:

  gate42 first boot: log in as root with the password   k7pq-3mzt-x9ab-cd2e

  It is shown here until you change it: in the web GUI's setup wizard,
  or with option 3 of this console's menu.

Every gate42 makes its own password on its first boot, and its own web certificate and SSH host keys. Only someone with access to the VM's console can see the password.

4. The first login

Open https://<WAN address>:8443 in your browser. From a machine on the LAN, use https://192.168.1.1:8443. Behind a floating IP or NAT, use the public address.

The browser warns about the certificate: gate42 made it itself on the first boot, and no public authority has signed it. Accept it for now; you can install your own certificate later (System › Trust).

Log in as root with the password from the console. The setup wizard asks for the host name, the DNS servers, the time zone, the WAN and LAN settings and a new root password. Once you set a new password, the console stops showing the old one within two minutes.

5. Secure the web GUI

• The GUI answers on the WAN, so you can reach it right away. Limit it to your own addresses, in the cloud's security group or under Firewall › Rules › WAN (the rule "Allow web GUI on WAN").
• Create named admin users (System › Access › Users) and turn on two-factor login with TOTP (System › Access › Servers).
• SSH is off. Turn it on (System › Settings › Administration) only if you need it, with keys.

Defaults at a glance

Next

• Updates: keep gate42 patched.
• The OPNsense manual for everything else. The menus and features are the same in gate42.