OPNsense on bare metal — 18 months as the only perimeter

For most of the homelab's life, there wasn't a firewall. The ISP router did what ISP routers do — NAT out, block unsolicited inbound, don't ask hard questions. That's not zero security. It's just not