Docs/OPNsense - Revision history

Allennova: /* WAN */

2026-07-01T22:42:47Z

WAN

← Older revision		Revision as of 22:42, 1 July 2026
Line 38:		Line 38:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
			!Main WAN IP
	\|-		\|-
	\|141.219.180.64/27		\|141.219.180.64/27
			\|141.219.180.69
	\|}		\|}
	Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.		Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.

2026-07-01T22:31:28Z

OpenVPN

← Older revision		Revision as of 22:31, 1 July 2026
Line 51:		Line 51:
	\|10.10.10.0/24		\|10.10.10.0/24
	\|}		\|}


			OpenVPN can be used as a secondary admin/user option compared to wireguard or can be used for homelab routing. This allows devices on a members network to communicate directly with lug devices, depending on what is configured on the user side and the server's side.

	=== Wireguard ===		=== Wireguard ===

2026-07-01T22:29:41Z

Wireguard

← Older revision		Revision as of 22:29, 1 July 2026
Line 62:		Line 62:
	<code>10.10.11.128/25</code> - Wireguard user range (access to only LAN)		<code>10.10.11.128/25</code> - Wireguard user range (access to only LAN)

	All members can ~~be freely given~~ 'user' wireguard ~~configs~~. ~~Only~~ ~~admin~~ configs ~~need~~ to be ~~restricted~~ (due to the aforementioned iDrac exploit issues).		All members can request 'user' wireguard configurations to connect to LUG infrastructure. These 'user' configs are restricted to LUG's LAN network only. (due to the aforementioned iDrac exploit issues).

	Neither wireguard config should have access to the internet.		Neither wireguard config should have access to the internet and are not intended for standard VPN traffic through LUG as an exit.

			Endpoint networks can be configured as needed but OpenVPN may be preferred for this usecase as LUG/users can dynamically change routes/receive DHCP updates.

	=== pfsync ===		=== pfsync ===

2026-03-31T01:26:54Z

add section and subnet for pfsync

← Older revision		Revision as of 01:26, 31 March 2026
Line 65:		Line 65:

	Neither wireguard config should have access to the internet.		Neither wireguard config should have access to the internet.

			=== pfsync ===
			{\| class="wikitable"
			!Subnet
			\|-
			\|10.10.250.0/24
			\|}
			Interface used for High Availability (HA) sync between the 2 firewalls.

			Cannot communicate with any other subnet.

	== OPNSense ==		== OPNSense ==

2026-03-06T18:33:26Z

fix wan range

← Older revision		Revision as of 18:33, 6 March 2026
Line 39:		Line 39:
	!Subnet		!Subnet
	\|-		\|-
	\|141.219.80.64/27		\|141.219.180.64/27
	\|}		\|}
	Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.		Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.

2025-11-04T08:09:57Z

← Older revision		Revision as of 08:09, 4 November 2025
Line 1:		Line 1:
	[[Docs\|<small>~/Docs</small>]]

	'''For Layer 1 network details, see [[Docs/Cables]].'''		'''For Layer 1 network details, see [[Docs/Cables]].'''

2025-05-15T02:08:05Z

← Older revision		Revision as of 02:08, 15 May 2025
Line 8:		Line 8:

	We have two OPNsense devices, Lasagna and Ravioli.		We have two OPNsense devices, Lasagna and Ravioli.

	'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''

	== Network ==		== Network ==

2025-05-15T02:07:56Z

← Older revision		Revision as of 02:07, 15 May 2025
Line 16:		Line 16:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.0.0/24		\|10.10.0.0/24
	\|1?
	\|}		\|}
	OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO] and internal networking hardware.		OOB Management services like [https://www.dell.com/en-us/lp/dt/open-manage-idrac Dell iDRAC] / [https://www.hpe.com/us/en/hpe-integrated-lights-out-ilo.html HP iLO] and internal networking hardware.
Line 34:		Line 32:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.1.0/24		\|10.10.1.0/24
	\|2?
	\|}		\|}
	Servers and Virtual Machines.		Servers and Virtual Machines.
Line 46:		Line 42:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|141.219.80.64/27		\|141.219.80.64/27
	\|640
	\|}		\|}
	Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.		Our public IP subnet under Tech's <code>141.219.0.0/16</code> block.
Line 58:		Line 52:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.10.0/24		\|10.10.10.0/24
	\|N/A
	\|}		\|}

Line 67:		Line 59:
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
	!VLAN ID
	\|-		\|-
	\|10.10.11.0/24		\|10.10.11.0/24
	\|N/A
	\|}		\|}
	<code>10.10.11.0/25</code> - Wireguard admin range (access to LAN+Management)		<code>10.10.11.0/25</code> - Wireguard admin range (access to LAN+Management)

2025-05-15T02:03:19Z

← Older revision		Revision as of 02:03, 15 May 2025
Line 1:		Line 1:
	[[Docs\|<small>~/Docs</small>]]		[[Docs\|<small>~/Docs</small>]]

			'''For Layer 1 network details, see [[Docs/Cables]].'''

			'''For Layer 2 network details, see [[Docs/Switches]].'''

	OPNsense is our router/firewall.		OPNsense is our router/firewall.

2025-05-15T01:53:39Z

← Older revision		Revision as of 01:53, 15 May 2025
Line 7:		Line 7:
	'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''		'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3'''

	== ~~Management (OOB)~~ ==		== Network ==

			=== Management (OOB) ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 25:		Line 27:
	Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.		Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.

	== LAN ==		=== LAN ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 37:		Line 39:
	LAN cannot communicate with Management.		LAN cannot communicate with Management.

	== WAN ==		=== WAN ===
	{\| class="wikitable"		{\| class="wikitable"
	!Subnet		!Subnet
Line 48:		Line 50:

	The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.		The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.

	== VPN Networks ==

	=== OpenVPN ===		=== OpenVPN ===
Line 75:		Line 75:

	Neither wireguard config should have access to the internet.		Neither wireguard config should have access to the internet.

			== OPNSense ==
			<Rules for access, updates, generating wireguard configs, etc>