SecureNet

What Is SecureNet?

A complete OPNsense deployment on Protectli Vault hardware: 8 isolated networks, Suricata IDS/IPS with ~200K signatures, Unbound DNS with self-hosted blocklists covering 1M+ domains, DNS over TLS, Monit monitoring, and pre-configured WireGuard integration for SafeNet VPN. Coreboot firmware with Intel ME neutralized via the HAP bit. Everything preloaded by Protectli engineers from OSS-authored configurations before it ships.

You plug it in, baseline security is already active. The 25-minute onboarding call customizes it for your ISP, your home, and your device inventory.

OPNsense Dashboard: Your network security at a glance

Network Architecture

SecureNet implements 8 separate networks: 3 physical (full access) and 5 virtual VLANs (restricted). Each network isolates devices by trust level and use case.

The 8 Networks

IP Addressing Strategy

SecureNet uses deliberate IP patterns so routing path is visible at a glance:

Port Assignments & VLAN Trunking

Firewall Rules & VLAN Isolation

OPNsense runs on FreeBSD's pf packet filter. Every restricted VLAN uses an identical 3-rule pattern applied as interface rules (processed after floating rules in OPNsense's rule order).

The 3-Rule Isolation Pattern

A device on the IoT VLAN can reach the internet and talk to other IoT devices, but it cannot reach your computers, your NAS, your admin network, or any other VLAN. Period.

Attack Scenarios Prevented

• ✓
  Compromised IoT CameraAttacker gains camera shell, scans for NAS. All blocked. Attack stops at the camera.
• ✓
  Malicious GuestGuest with hacking tools scans 192.168.1.0/24. Sees nothing. Zero visibility into internal network.
• ✓
  Smart TV SpywarePre-installed TV spyware tries to find SMB shares. Blocked. Work documents stay safe.

Suricata IDS/IPS

Suricata is the first layer of our two-layer packet inspection architecture. It sits on the WAN interface, inspecting all internet traffic before it reaches your internal networks.

Configuration

Ruleset Breakdown (Updates Nightly)*

Rulesets selected to maximize home network protection without false positives:

*Signature counts update nightly as new threats are discovered and old ones expire.

Performance with Full Security Stack (Lab Validated)

All performance numbers validated in our Security Performance Lab with real traffic patterns:

DNS Filtering & Ad Blocking

Unbound DNS runs locally on your SecureNet firewall, resolving queries faster than remote servers while blocking malicious domains and ads before any connection is made. DNSSEC validation is enabled for all upstream responses.

Self-Hosted Blocklists

We aggregate multiple trusted sources into a single, deduplicated blocklist hosted on our own infrastructure at oss-blocklist.net. Refresh runs nightly at 2 AM CST so your security updates while you sleep.

DNS Blocklist Sources (1 million+ domains)*

IP Blocklist Sources (~45,000 IPs)*

*Counts update nightly as sources refresh and community reports are added.

Whitelist Process

If a legitimate site gets blocked (false positive):

• 1. You report it to OSS
• 2. We verify the domain is safe
• 3. We add it to our whitelist
• 4. Next nightly refresh fixes it. No action required on your end.

Two-Layer Protection

DNS filtering and IP blocking work together to catch threats that slip through one layer:

DNS over TLS

All DNS queries from your network are encrypted before leaving your home. Your ISP cannot see what websites you're visiting.

Configuration

What Your ISP Sees

Hardware Monitoring (Monit)

Monit watches your firewall hardware 24/7 and sends email alerts before problems become crises.

What's Monitored

• ✓
  Port 1 NIC StatusIntel i226 NICs can fail. Monit detects link-down and alerts you. 1-hour delay prevents false positives from brief outages.
• ✓
  CPU UsageAlert at 95%+. Could indicate DDoS attack, malware, or IDS overload.
• ✓
  Memory UsageAlert at 90%+. Detects memory leaks or SYN flood attacks.
• ✓
  Disk SpaceAlert at 90%+. Log growth can fill disks over time.
• ✓
  Unbound DNSIf DNS crashes, Monit automatically restarts it and alerts you. Self-healing: fixed before you notice.

Port 1 Failover Procedure

If Port 1 NIC fails (you receive Monit alert):

Zenarmor Application Firewall

Zenarmor is the second layer of our two-layer packet inspection architecture. While Suricata inspects traffic at the WAN perimeter, Zenarmor monitors LAN traffic and identifies applications regardless of encryption.

Zenarmor Dashboard: Application visibility and control

What Zenarmor Catches That Suricata Can't

Free vs Paid Tiers

Support Boundaries

OSS provides: Installation, configuration, and brief dashboard tutorial during onboarding.

Zenarmor provides: Ongoing support, feature training, policy creation help, troubleshooting.

Zenarmor Resources

• • Zenarmor YouTube Channel (Excellent tutorials)
• • Zenarmor Documentation
• • Zenarmor Blog

WireGuard VPN Integration

SecureNet includes pre-configured WireGuard integration for SafeNet VPN subscribers. Traffic from SafeNet networks routes through our servers automatically via policy-based routing.

Tunnel Configuration

Policy-Based Routing

Connect to SafeNet WiFi when you want private browsing. Connect to your regular network for everything else. No apps to install, no settings to change. It's automatic.

Coreboot & Intel ME Disabled

Protectli Vaults ship with Protectli's coreboot firmware and Intel ME disabled via the HAP bit. This is the single most important firmware-level differentiator on this page, and no other home firewall vendor can legitimately claim it.

What Is Intel ME?

Intel's Management Engine is a secondary CPU embedded in nearly every Intel processor shipped since 2008. It runs its own closed-source firmware, has its own network stack, operates below the operating system, and cannot be inspected, audited, or disabled by standard means. It has full access to system memory, network interfaces, and storage. It runs whether your computer appears to be on or off.

Intel ME has had multiple documented critical vulnerabilities over the years, including remote code execution bugs discovered by researchers long after the affected hardware shipped. Because the ME runs below the OS, OS-level security tools can't see it and can't protect against it.

How Protectli Disables It: HAP Bit

The HAP (High Assurance Platform) bit is a configuration flag originally created for US government High Assurance Platform program customers. Setting HAP=1 causes the Intel ME to halt its firmware execution immediately after the bring-up phase. The ME is still present on the die (it's physically integrated into the chipset and can't be removed), but it stops running code after boot. No network stack. No listening services. No persistent execution.

Protectli ships all Vaults with coreboot firmware that sets HAP=1 and additionally cleans the ME firmware region to minimize the attack surface during the brief pre-HAP bring-up phase. This is the most thorough ME neutralization method publicly available and is used in production by security-focused organizations that require high-assurance hardware.

The Full Open Stack

From chipset through VPN tunnel, every configurable component is publicly reviewable and independently auditable. The one component we can't open-source (Intel ME's physical presence on the die) is the one we neutralize.

WiFi Access Point

OSS offers an optional enterprise-grade Omada EAP720 wireless access point, professionally configured in Stand Alone mode: no cloud dependency, no subscriptions, full VLAN support.

Specifications

What's Included

Hardware (Purchased From Protectli)

• ✓
  Protectli Vault (V1410 or VP2430)Fanless firewall appliance with coreboot firmware, Intel ME disabled, 2-year hardware warranty
• ✓
  SecureNet Pre-InstalledConfiguration loaded by Protectli engineers before ship. Plug in and baseline security is active.
• +
  Optional: Omada EAP720 Wireless Access PointWiFi 7 with full VLAN support, professionally configured. Not required if you already have a capable access point.

Services (OSS)

• ✓
  Onboarding ConsultationCustomize SecureNet for your ISP, home, and device inventory
• ✓
  ZFS Snapshot + Encrypted BackupKnown-good restore point after onboarding
• ✓
  Network DocumentationDiagram, failover procedures, restore instructions

Optional Subscriptions

• +
  SafeNet VPNPrivate browsing through OSS-operated WireGuard servers. Includes full support.
• +
  Zenarmor HomeApplication blocking, parental controls. $10/month via Zenarmor.

Is SecureNet Right for You?

Honest about who SecureNet is, and isn't, designed for.

Configuration Transparency

Everything is published. Verify every claim we make.

What's Public

• • SecureNet configurations: Forgejo
• • SafeNet server configurations: Forgejo
• • Security Performance Lab methodology and raw CSV data: Forgejo
• • AI Whitepaper: 50-page technical reference
• • DNS blocklist sources and aggregation methodology
• • Suricata ruleset selection rationale and tuning notes

What's NOT Public

• • Private keys (SSH, WireGuard)
• • Customer-specific passwords
• • That's it.