Docs/OPNsense - Revision history

Simone: add section and subnet for pfsync

2026-03-31T01:26:54Z

add section and subnet for pfsync

← Older revision		Revision as of 01:26, 31 March 2026
Line 65:		Line 65:

	Neither wireguard config should have access to the internet.		Neither wireguard config should have access to the internet.

			=== pfsync ===
			{\| class="wikitable"
			!Subnet
			\|-
			\|10.10.250.0/24
			\|}
			Interface used for High Availability (HA) sync between the 2 firewalls.

			Cannot communicate with any other subnet.

	== OPNSense ==		== OPNSense ==

Simone: fix wan range

2026-03-06T18:33:26Z

fix wan range

← Older revision		Revision as of 18:33, 6 March 2026
Line 39:		Line 39:
	!Subnet		!Subnet
	\|-		\|-
	\|141.219.80.64/27		\|141.219.180.64/27
	\|}		\|}
	Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.		Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.

D2wn at 08:09, 4 November 2025

2025-11-04T08:09:57Z

← Older revision		Revision as of 08:09, 4 November 2025
Line 1:		Line 1:
	[[Docs\|<small>~/Docs</small>]]

	'''For Layer 1 network details, see [[Docs/Cables]].'''		'''For Layer 1 network details, see [[Docs/Cables]].'''

D2wn at 02:08, 15 May 2025

2025-05-15T02:08:05Z

← Older revision		Revision as of 02:08, 15 May 2025
Line 8:		Line 8:

	We have two OPNsense devices, Lasagna and Ravioli.		We have two OPNsense devices, Lasagna and Ravioli.

	'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''

	== Network ==		== Network ==

D2wn at 02:07, 15 May 2025

2025-05-15T02:07:56Z

← Older revision		Revision as of 02:07, 15 May 2025
Line 16:		Line 16:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.0.0/24		\|10.10.0.0/24
	\|1?
	\|}		\|}
	OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO] and internal networking hardware.		OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO] and internal networking hardware.
Line 34:		Line 32:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.1.0/24		\|10.10.1.0/24
	\|2?
	\|}		\|}
	Servers and Virtual Machines.		Servers and Virtual Machines.
Line 46:		Line 42:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|141.219.80.64/27		\|141.219.80.64/27
	\|640
	\|}		\|}
	Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.		Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.
Line 58:		Line 52:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.10.0/24		\|10.10.10.0/24
	\|N/A
	\|}		\|}

Line 67:		Line 59:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.11.0/24		\|10.10.11.0/24
	\|N/A
	\|}		\|}
	<code>10.10.11.0/25</code> - Wireguard admin range (access to LAN+Management)		<code>10.10.11.0/25</code> - Wireguard admin range (access to LAN+Management)

D2wn at 02:03, 15 May 2025

2025-05-15T02:03:19Z

← Older revision		Revision as of 02:03, 15 May 2025
Line 1:		Line 1:
	[[Docs\|<small>~/Docs</small>]]		[[Docs\|<small>~/Docs</small>]]

			'''For Layer 1 network details, see [[Docs/Cables]].'''

			'''For Layer 2 network details, see [[Docs/Switches]].'''

	OPNsense is our router/firewall.		OPNsense is our router/firewall.

D2wn at 01:53, 15 May 2025

2025-05-15T01:53:39Z

← Older revision		Revision as of 01:53, 15 May 2025
Line 7:		Line 7:
	'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''		'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''

	== ~~Management (OOB)~~ ==		== Network ==

			=== Management (OOB) ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 25:		Line 27:
	Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.		Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.

	== LAN ==		=== LAN ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 37:		Line 39:
	LAN cannot communicate with Management.		LAN cannot communicate with Management.

	== WAN ==		=== WAN ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 48:		Line 50:

	The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.		The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.

	== VPN Networks ==

	=== OpenVPN ===		=== OpenVPN ===
Line 75:		Line 75:

	Neither wireguard config should have access to the internet.		Neither wireguard config should have access to the internet.

			== OPNSense ==
			<Rules for access, updates, generating wireguard configs, etc>

D2wn at 01:51, 15 May 2025

2025-05-15T01:51:33Z

← Older revision		Revision as of 01:51, 15 May 2025
Line 5:		Line 5:
	We have two OPNsense devices, Lasagna and Ravioli.		We have two OPNsense devices, Lasagna and Ravioli.

			'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''
	=== Firewall Rules ===
	View the WebUI for the specific firewall rules, but some of the more basic/essential ones are:

			== Management (OOB) ==
⚫	# Management cannot communicate with LAN/WAN ~~(the internet), and LAN cannot communicate with Management~~.
			{\| class="wikitable"
⚫	## Generally, Management should be restricted from everything else. ~~(maybe even other iDrac servers?)~~
			!Subnet
⚫	## OOB services tend to be ''super'' vulnerable, there are dozens of [https://github.com/mgargiullo/cve-2018-1207 premade scripts] that instapwn iDRACs and give you a root shell by just pointing them at the IP address.
			!VLAN ID
⚫	## Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.
			\|-
⚫	# Wireguard
		⚫	\|10.10.0.0/24
	## The admin/user split is so all members can be given a wireguard config to the internal network without having to worry about them being able to trivially get root on all servers running premade-exploits like [https://github.com/mgargiullo/cve-2018-1207 these] on the iDracs.
			\|1?
	## If someone shows up to a couple meetings they're probably fine to get an admin config; this is more for peace-of-mind to not need to worry about the configs given to people who went to one meeting once at the beginning of the semester and have never been seen again.
			\|}
	## Neither config should have access to WAN, just to prevent someone getting LUG in hot water if they attempt to torrent or something similarly dumb through the VPN.
		⚫	OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO] and internal networking hardware.

		⚫	Management cannot communicate with LAN/WAN.
⚫	=== ~~Routing~~ ===

		⚫	Generally, Management should be restricted from everything else.
	==== Main networks ====
	We have two main networks:
⚫	* 10.10.0.0/24 - Management (OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO])
	* 10.10.1.0/24 - LAN (servers/VMs)
	We may also be getting a <code>/27</code> of Tech's <code>141.219.0.0/16</code> block through IT (~28-30 usable public IP addresses).

		⚫	OOB services tend to be ''super'' vulnerable, there are dozens of [https://github.com/mgargiullo/cve-2018-1207 premade scripts] that instapwn iDRACs and give you a root shell by just pointing them at the IP address.
⚫	The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM ~~(so we can't do it like IT and exclusively use publicly routable addresses)~~.

		⚫	Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.
⚫	==== VPN Networks ====
	In addition, there are two main VPN networks:

			== LAN ==
⚫	* 10.10.10.0/24 ~~- OpenVPN~~
			{\| class="wikitable"
⚫	* 10.10.11.0/24 ~~- Wireguard~~
			!Subnet
⚫	** 10.10.11.0/25 - Wireguard admin range (access to Management~~+LAN, no WAN~~)
			!VLAN ID
⚫	** 10.10.11.128/25 - Wireguard user range (access to only LAN~~, no WAN~~)
			\|-
			\|10.10.1.0/24
			\|2?
			\|}
			Servers and Virtual Machines.

			LAN cannot communicate with Management.

			== WAN ==
			{\| class="wikitable"
			!Subnet
			!VLAN ID
			\|-
			\|141.219.80.64/27
			\|640
			\|}
			Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.

		⚫	The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.

		⚫	== VPN Networks ==

		⚫	=== OpenVPN ===
			{\| class="wikitable"
			!Subnet
			!VLAN ID
			\|-
			\|10.10.10.0/24
			\|N/A
			\|}

		⚫	=== Wireguard ===
			{\| class="wikitable"
			!Subnet
			!VLAN ID
			\|-
		⚫	\|10.10.11.0/24
			\|N/A
			\|}
		⚫	<code>10.10.11.0/25</code> - Wireguard admin range (access to LAN+Management)

		⚫	<code>10.10.11.128/25</code> - Wireguard user range (access to only LAN)

			All members can be freely given 'user' wireguard configs. Only admin configs need to be restricted (due to the aforementioned iDrac exploit issues).

			Neither wireguard config should have access to the internet.

D2wn at 08:01, 23 April 2025

2025-04-23T08:01:56Z

← Older revision		Revision as of 08:01, 23 April 2025
Line 1:		Line 1:
			[[Docs\|<small>~/Docs</small>]]

	OPNsense is our router/firewall.		OPNsense is our router/firewall.

	We have two OPNsense devices, Lasagna and Ravioli.		We have two OPNsense devices, Lasagna and Ravioli.

D2wn: Created page with "OPNsense is our router/firewall. We have two OPNsense devices, Lasagna and Ravioli. === Firewall Rules === View the WebUI for the specific firewall rules, but some of the more basic/essential ones are: # Management cannot communicate with LAN/WAN (the internet), and LAN cannot communicate with Management. ## Generally, Management should be restricted from everything else. (maybe even other iDrac servers?) ## OOB services tend to be ''super'' vulnerable, there are dozen..."

2025-04-23T08:01:32Z

Created page with "OPNsense is our router/firewall. We have two OPNsense devices, Lasagna and Ravioli. === Firewall Rules === View the WebUI for the specific firewall rules, but some of the more basic/essential ones are: # Management cannot communicate with LAN/WAN (the internet), and LAN cannot communicate with Management. ## Generally, Management should be restricted from everything else. (maybe even other iDrac servers?) ## OOB services tend to be ''super'' vulnerable, there are dozen..."

New page

OPNsense is our router/firewall.
We have two OPNsense devices, Lasagna and Ravioli.

=== Firewall Rules ===
View the WebUI for the specific firewall rules, but some of the more basic/essential ones are:

# Management cannot communicate with LAN/WAN (the internet), and LAN cannot communicate with Management.
## Generally, Management should be restricted from everything else. (maybe even other iDrac servers?)
## OOB services tend to be ''super'' vulnerable, there are dozens of [https://github.com/mgargiullo/cve-2018-1207 premade scripts] that instapwn iDRACs and give you a root shell by just pointing them at the IP address.
## Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.
# Wireguard
## The admin/user split is so all members can be given a wireguard config to the internal network without having to worry about them being able to trivially get root on all servers running premade-exploits like [https://github.com/mgargiullo/cve-2018-1207 these] on the iDracs.
## If someone shows up to a couple meetings they're probably fine to get an admin config; this is more for peace-of-mind to not need to worry about the configs given to people who went to one meeting once at the beginning of the semester and have never been seen again.
## Neither config should have access to WAN, just to prevent someone getting LUG in hot water if they attempt to torrent or something similarly dumb through the VPN.

=== Routing ===

==== Main networks ====
We have two main networks:
* 10.10.0.0/24 - Management (OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO])
* 10.10.1.0/24 - LAN (servers/VMs)
We may also be getting a <code>/27</code> of Tech's <code>141.219.0.0/16</code> block through IT (~28-30 usable public IP addresses).

The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM (so we can't do it like IT and exclusively use publicly routable addresses).

==== VPN Networks ====
In addition, there are two main VPN networks:

* 10.10.10.0/24 - OpenVPN
* 10.10.11.0/24 - Wireguard
** 10.10.11.0/25 - Wireguard admin range (access to Management+LAN, no WAN)
** 10.10.11.128/25 - Wireguard user range (access to only LAN, no WAN)