How to Replace Your BT or EE Smart Hub with OPNsense (FTTP Setup)

John Jestin

— 2 min read

If you're on BT or EE's Full Fibre (FTTP) service and want to ditch the locked-down Smart Hub in favour of OPNsense, this guide walks you through a complete setup. It covers everything from physical connections to PPPoE credentials and firewall rules — with no fluff, just practical implementation.

✨ Overview

Goal: Replace your BT/EE Smart Hub with a more secure and feature-rich OPNsense firewall/router.

Applies To: BT/EE customers with FTTP (i.e. ONT box present). DSL users should use a bridge-capable modem instead.

Tested Hardware:

  • Openreach ONT
  • Beelink Mini PC with dual Ethernet
  • OPNsense 25.1

🔧 What You Need

  • An ONT installed by Openreach (this is your fibre modem)
  • OPNsense installed on a device with at least 2 NICs
  • Ethernet cables
  • BT/EE PPPoE login details (standard ones provided below)

🖧 Step 1: Physical Connections

  1. ONT to OPNsense WAN Port:
    Plug an Ethernet cable from the ONT to your OPNsense's WAN interface (e.g. re1)
  2. OPNsense LAN Port to PC or Switch:
    Connect your OPNsense LAN interface (e.g. re0) to a switch or PC

📅 Step 2: Initial Login

  1. Boot OPNsense and connect a device to its LAN port
  2. Navigate to https://192.168.1.1
  3. Login with:
    • Username: root
    • Password: the one you set during install

🎓 Step 3: Run the Setup Wizard

General Settings

  • Hostname: opnsense
  • Domain: home.lan
  • Primary DNS: 1.1.1.1
  • Secondary DNS: 8.8.8.8
  • ❌ Uncheck Allow DNS server to be overridden by DHCP/PPP on WAN

WAN Configuration

  • Interface: re1 (or whichever port connects to the ONT)
  • IPv4 Configuration Type: PPPoE
  • Username: bthomehub@btbroadband.com
  • Password: BT
  • PPPoE MTU: 1492
  • IPv6 Configuration Type: None or DHCPv6 (optional)
  • ✅ Check both: Block RFC1918 and Block bogon networks

LAN Configuration

  • Interface: re0 (your LAN port)
  • IPv4 Configuration Type: Static IP
  • IP Address: 192.168.1.1/24
  • ✅ Enable DHCP Server
    • Start: 192.168.1.100
    • End: 192.168.1.199
  • IPv6: None

Admin Password

  • Set a strong administrator password

Click Reload to apply changes.

🚪 Step 4: Verify Your Connection

Go to Interfaces → Overview → WAN
You should now see:

  • Status: UP
  • IP Address: public (not 192.168.x.x)

Test internet access from a LAN-connected device.

📈 Step 5: Firewall Rules Check

By default, OPNsense allows LAN → WAN traffic. If needed:

  • Go to Firewall → Rules → LAN

Ensure there's a rule:

Allow LAN Net to any

🤔 Troubleshooting Tips

  • Power-cycle the ONT (off for 30–60s), then reboot OPNsense
  • Double-check WAN is assigned to the correct port
  • Check logs under Interfaces → Log File → PPP

🌟 Why Replace the Smart Hub?

  • No real control over firewall, NAT, or DNS
  • No built-in VPN or VLAN support
  • No visibility into network traffic
  • No future for power users

With OPNsense, you unlock full control of your network — and this guide gets you set up in under 30 minutes.

📋 Optional Next Steps

  • Enable DNS-over-TLS for privacy
  • Add WireGuard or Tailscale for remote access
  • Create VLANs to segment IoT, Guest, and Prod networks
  • Install IDS/IPS (Suricata or Zenarmor)

Let me know in the comments if you'd like advanced config guides for DNS, VLANs, or home-lab integrations!

Read more