Docs/OPNsense: Difference between revisions
No edit summary |
m (→WAN) |
||
| (6 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
[[Docs|<small>~/Docs</small>]] |
|||
'''For Layer 1 network details, see [[Docs/Cables]].''' |
'''For Layer 1 network details, see [[Docs/Cables]].''' |
||
| Line 8: | Line 6: | ||
We have two OPNsense devices, Lasagna and Ravioli. |
We have two OPNsense devices, Lasagna and Ravioli. |
||
'''The VLAN configuration (like VLAN IDs) should probably be moved to [[Docs/Switches]] to keep this article strictly Layer3''' |
|||
== Network == |
== Network == |
||
| Line 42: | Line 38: | ||
{| class="wikitable" |
{| class="wikitable" |
||
!Subnet |
!Subnet |
||
!Main WAN IP |
|||
|- |
|- |
||
|141.219. |
|141.219.180.64/27 |
||
|141.219.180.69 |
|||
|} |
|} |
||
Our public IP subnet under Tech's <code>141.219.0.0/16</code> block. |
Our public IP subnet under Tech's <code>141.219.0.0/16</code> block. |
||
| Line 55: | Line 53: | ||
|10.10.10.0/24 |
|10.10.10.0/24 |
||
|} |
|} |
||
OpenVPN can be used as a secondary admin/user option compared to wireguard or can be used for homelab routing. This allows devices on a members network to communicate directly with lug devices, depending on what is configured on the user side and the server's side. |
|||
=== Wireguard === |
=== Wireguard === |
||
| Line 66: | Line 67: | ||
<code>10.10.11.128/25</code> - Wireguard user range (access to only LAN) |
<code>10.10.11.128/25</code> - Wireguard user range (access to only LAN) |
||
All members can |
All members can request 'user' wireguard configurations to connect to LUG infrastructure. These 'user' configs are restricted to LUG's LAN network only. (due to the aforementioned iDrac exploit issues). |
||
| ⚫ | |||
Endpoint networks can be configured as needed but OpenVPN may be preferred for this usecase as LUG/users can dynamically change routes/receive DHCP updates. |
|||
=== pfsync === |
|||
{| class="wikitable" |
|||
!Subnet |
|||
|- |
|||
|10.10.250.0/24 |
|||
|} |
|||
Interface used for High Availability (HA) sync between the 2 firewalls. |
|||
Cannot communicate with any other subnet. |
|||
| ⚫ | |||
== OPNSense == |
== OPNSense == |
||
Latest revision as of 22:42, 1 July 2026
For Layer 1 network details, see Docs/Cables.
For Layer 2 network details, see Docs/Switches.
OPNsense is our router/firewall.
We have two OPNsense devices, Lasagna and Ravioli.
Network
Management (OOB)
| Subnet |
|---|
| 10.10.0.0/24 |
OOB Management services like Dell iDRAC / HP iLO and internal networking hardware.
Management cannot communicate with LAN/WAN.
Generally, Management should be restricted from everything else.
OOB services tend to be super vulnerable, there are dozens of premade scripts that instapwn iDRACs and give you a root shell by just pointing them at the IP address.
Because of this, the iDRAC web login interface should only be accessible to anyone you're okay having root on the server.
LAN
| Subnet |
|---|
| 10.10.1.0/24 |
Servers and Virtual Machines.
LAN cannot communicate with Management.
WAN
| Subnet | Main WAN IP |
|---|---|
| 141.219.180.64/27 | 141.219.180.69 |
Our public IP subnet under Tech's 141.219.0.0/16 block.
The plan is to use reverse-NAT to map the public IPs to select internal IPs, since we won't have enough IPs for every VM.
OpenVPN
| Subnet |
|---|
| 10.10.10.0/24 |
OpenVPN can be used as a secondary admin/user option compared to wireguard or can be used for homelab routing. This allows devices on a members network to communicate directly with lug devices, depending on what is configured on the user side and the server's side.
Wireguard
| Subnet |
|---|
| 10.10.11.0/24 |
10.10.11.0/25 - Wireguard admin range (access to LAN+Management)
10.10.11.128/25 - Wireguard user range (access to only LAN)
All members can request 'user' wireguard configurations to connect to LUG infrastructure. These 'user' configs are restricted to LUG's LAN network only. (due to the aforementioned iDrac exploit issues).
Neither wireguard config should have access to the internet and are not intended for standard VPN traffic through LUG as an exit.
Endpoint networks can be configured as needed but OpenVPN may be preferred for this usecase as LUG/users can dynamically change routes/receive DHCP updates.
pfsync
| Subnet |
|---|
| 10.10.250.0/24 |
Interface used for High Availability (HA) sync between the 2 firewalls.
Cannot communicate with any other subnet.
OPNSense
<Rules for access, updates, generating wireguard configs, etc>