TMA-OPNSENSE-5.3.1
Ensure WireGuard is used as the default VPN method
MediumLevel 1Automatedopnsense
Description
WireGuard must use a dedicated RFC1918 subnet that is not reused by any internal VLAN. Additionally, WireGuard must remain disabled unless explicitly required for approved remote access or site-to-site VPN use cases.
How it is checked
Audit method: Configuration pattern
- Pattern
<unbound>(?:[^<]|<[^/<]|</[^u<]|</u[^n<]|</un[^b<]|</unb[^o<]|</unbo[^u<]|</unbou[^n<]|</unboun[^d<]|</unbound[^><])*?<dnssec(?:\s*/>|>[^<]*</dnssec>)
How it is fixed
Fix method: Guidance or infrastructure patch
1. Navigate to VPN → WireGuard → Instances 2. Click the Plus Sign to add a WireGuard Instance 3. Click 'Save' when all of your instance details are entered
Properties
- Operating systems
- Any
- Tags
- opnsense
- Reference
- CIS OPNsense Benchmark v1.0.0 - 5.3.1 Ensure WireGuard is used as the default VPN method
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target opnsense