Prepare OPNsense and Security Onion Installation Media

In this tutorial you will create two virtual machines (VMs): one OPNsense VM to provide routing for virtualized lab networks, and one VM to run Security Onion. On this page you are going to download the installation media needed to create those VMs and verify that the installation media is valid.

Download, Validate, and Prepare the OPNsense Installation Media

1. Open a browser and go to OPNsense’s download page.
2. Use the drop-down menus to select your processor’s System architecture and the image type. Select amd64 as the architecture and dvd as the media image type.

3. Scroll down the page and select the OPNsense Mirror Location where you want to download your media from.

   • You can also scroll down the page to see the full list of mirror sites:

   • If you click the link for one of the mirror sites, you will see all of the files available for download, including the different architectures, image types, and signature files to verify the media.

4. After selecting each option, click the Download OPNsense button.
5. Move these files from your local machine’s download folder into their own folder. In this series I am going to put my installation media in a folder called onion-isos.
6. Next I will check that the has on the file matches what is on the OPNsense downloads page. Open a command line application. In this case I am using PowerShell, which I can open by typing powershell in the search bar in the taskbar and then clicking Windows PowerShell in the results.
7. On the command line, navigate to the folder where you put the OPNsense files.
   > cd D:\onion-isos\

8. Now use certutil to check the SHA256 has of the file you downloaded from OPNsense.org:\ > certutil.exe -hashfile .\OPNsense-26.1.6-dvd-amd64.iso.bz2 SHA256.

9. The output of the command shows the hash:

   SHA256 hash of .\OPNsense-26.1.6-dvd-amd64.iso.bz2:
   6ba3633d9c0f96d82c792015a45f4b8aac45ea8fa2bdba3c5e534d0c90a4f08c
   CertUtil: -hashfile command completed successfully.
   PS D:\onion-isos>
   

10. Make sure the SHA256 value that the certutil command generates matches what is on OPNsense’s download page.

11. In the Windows File Explorer, right-click the .iso.bz2 file in your onion-isos folder and select Extract All… from the context menu.
12. The extraction process creates a new folder in the current folder, ending in .iso.
13. The ISO file is within the extracted folder, <OPNsense-filename>.iso.

Your OPNsense ISO is ready for installation.

Download, Validate, and Prepare the Security Onion Installation Media

1. You can download the current Security Onion ISO from their GitHub repo. The download link for the latest ISO is under Download and Verify.

2. Right-clik the link and select Save Link As… from the context menu.

3. Save the file to the same location that you saved your OPNsense download.

4. When the file download is complete, use the PowerShell certutil command again to generate the SHA256 hash for the ISO file you downloaded.

   > certutil.exe -hashfile .\securityonion-3.1.0-20260528.iso SHA256
   SHA256 hash of .\securityonion-3.1.0-20260528.iso:
   62fab57e247c843d6a04f0796d8162c732b65d82fc3e4a59d087135b9fd32912
   CertUtil: -hashfile command completed successfully.
   

5. Verify the hash value against the one on Security Onion’s GitHub:

Your Security Onion ISO is ready for installation.