Opnsense

A Model Context Protocol (MCP) server for interacting with OPNsense firewalls. This server provides tools to manage firewall rules, view network interfaces, manage DHCP leases, and monitor system status.

Features

This MCP server exposes the following tools:

Firewall

• list_firewall_rules: List firewall filter rules.
• add_firewall_rule: Add a new firewall rule (pass/block/reject, tcp/udp/any).
• toggle_firewall_rule: Enable or disable a firewall rule by UUID.
• delete_firewall_rule: Delete a firewall rule by UUID.

Interfaces

• list_interfaces: List network interfaces with status and statistics.
• get_arp_table: Get the ARP table (IP-to-MAC mappings).

DHCP

• list_dhcp_leases: List active and static DHCP leases.

System

• get_system_info: Get system information (hostname, uptime, CPU, memory usage).
• get_firmware_status: Check for available firmware and package updates.
• get_system_log: Fetch recent system log entries.
• reboot_system: Reboot the OPNsense firewall.

Configuration

The server requires the following environment variables to authenticate with your OPNsense API:

• OPNSENSE_HOST: The base URL of your OPNsense firewall (e.g., https://192.168.1.1).
• OPNSENSE_API_KEY: Your OPNsense API key.
• OPNSENSE_API_SECRET: Your OPNsense API secret.
• OPNSENSE_VERIFY_SSL (optional): Set to true to verify SSL certificates (defaults to false for self-signed certificates).

Usage

Using with MCP CLI

You can run this server using the MCP CLI:

# Set your environment variables
export OPNSENSE_HOST="https://192.168.1.1"
export OPNSENSE_API_KEY="your-api-key"
export OPNSENSE_API_SECRET="your-api-secret"

# Run the server
mcp run server.py

Installation from Source

1. Clone the repository:

git clone https://github.com/yourusername/opnsense-mcp.git
cd opnsense-mcp

2. Install dependencies:

pip install .

3. Run the server:

opnsense-mcp