๐ก HomeLab OPNsense Topology: WAN, LAN, DMZ โ Executive Summary
Technical architectural analysis, practical configuration manifests, and deployment instructions for HomeLab OPNsense Topology: WAN, LAN, DMZ.
L2 โ NIC Definition
L3 โ IP band definition
Total
| Interface name | type | NAT main purpose | Band Allocation | Use and Description |
| WAN | WAN | Destination | DHCP | External Internet use / Exposure of VPN instances and external services (VLAN040, VLAN041) |
| LAN1 | LAN | Redirection |
192.168.1.0/24
|
Network device management |
| LAN2 | LAN | โ |
192.168.2.0/24
|
For emergency use |
| LAN3 | LAN | โ |
192.168.3.0/24
|
For emergency use |
| LAN1\_V010 | VLAN | Redirection |
192.168.10.0/24
|
Physics Hosts (Harvester) |
| LAN1\_V020 | VLAN | Source |
192.168.20.0/24
|
Wireless Client (WiFi) |
| LAN1\_V021 | VLAN | Source |
192.168.21.0/24
|
Wireless Client (Overseas VPN) |
| LAN1\_V030 | VLAN | Redirection |
192.168.30.0/24
|
Internal Services: Harvester LB |
| LAN1\_V040 | VLAN | Redirection |
192.168.40.0/24
|
External Service: Cloudflare Tunnel |
| LAN1\_V041 | VLAN | Redirection |
192.168.41.0/24
|
External services: Harvester LB, Cloudflare Proxy |
| โ | Ghost Address | Destination |
192.168.118.0/24
|
Physical equipment internal services: NAT, Unbound DNS |
| LAN1 | VIP | Destination |
192.168.119.0/24
|
Physical equipment internal services: HAProxy, Unbound DNS |
| VPN1 | VPN | Source |
10.0.X.X/24
|
WireGuard Instances/Peers |
VPN Band Definition
- WG Instance / Peers
- CIDR:
10.0.X.X/24 - Instance:
10.0.X.X/24(instance address is10.0.X.X, peer addresses are assigned sequentially)
VLAN band definition
- VLAN definition
Interface name parent interface VLAN ID Band Allocation Use and Description LAN1 โ โ 192.168.1.0/24Network device management vlan01.010 LAN1 10 192.168.10.0/24Physics Hosts (Harvester) vlan01.020 LAN1 20 192.168.20.0/24Wireless Client (WiFi) vlan01.021 LAN1 21 192.168.21.0/24Wireless Client (Overseas VPN) vlan01.030 LAN1 30 192.168.30.0/24Internal Service (VPN Only) vlan01.040 LAN1 40 192.168.40.0/24External Service (Cloudflare Tunnel) vlan01.041 LAN1 41 192.168.41.0/24External Service (Cloudflare Proxy)
Virtual network band definition
- Considering convenience and necessity, two types of virtual networks are needed.
References and Guidelines (NOTE)
When configuring DNAT, external access works well using Ghost IP, but without VIP, internal to external calls are not smooth. In the end, a VIP declaration is needed
Ghost Address Band: OPNSense Interface that does not exist anywhere (convenient as it does not need to be defined separately)
- When using the
function, you can redirect by declaring it as a destination even if there is no actual interface, so there is no need to useVIP.
VIP Band: A virtual interface recognized by OPNSense.
-
In plugins, etc., the existence of a Socket Connection is required.
-
DNS maps to the virtual address of the defined band.
-
The subnets below do not actually exist, and if you define and declare them for convenience, it is convenient for future maintenance.
- OPNSense DNAT โ VIP Net:
192.168.118.0/24 - HAProxy DNAT โ VIP Net:
192.168.119.0/24
Leave a Reply