Installation

Management

Conceptual Definition

IP Band Definition

NAT system

• WireGuard to WAN

• WireGuard to LAN

• WireGuard to LAN with HAProxy (for TLS Termination)

Common

SSH Setting

• Add port forwarding

• Interface: WAN
• Protocol: TCP
• Destination: WAN address
• Destination port range: 8120 \~ 8120
• Destination IP redirection: Single host or network – 127.0.0.1/32

• Redirect destination port: 8120

• Test

ssh -p8120 [email protected]

DNS rebinding check

• Uncheck rebinding to access the dashboard in various ways, such as DDNS, private DNS, and IP access with NAT settings

IPv6 settings

• WAN gateway DHCP6 is activated, but no IP address is being assigned.

• IPv6 configuration type of initial configuration LAN Interface: Tracking Interface = WAN

• Configure IPv6 for the LAN interface on the DHCP service side

  • DHCP Server

Masquerading for VPN to WAN

• interface

• Background of use
• When a WireGuard client sends a ping to 8.8.8.8, the packet’s source IP address is the client’s WireGuard internal IP address. Address(e.g. 10.0.X.X).
• When the packet reaches 8.8.8.8, 8.8.8.8 attempts to send a response packet back to 10.0.
• However, routers on the Internet do not know the route to 10.0.
• Application result
• Masquerading replaces the source IP address of every packet leaving the OPNsense server's WireGuard interface with the public/external IP of the OPNsense server. Temporarily “modify”
with the address.
• OPNsense records this conversion, and when it receives a response packet from 8.8.8.8, it recodes the destination IP address of this response packet back inside WireGuard of the original client. Returns it to the IP address(10.0.X.X) and passes it to the client through the tunnel.
• This is the act of hiding the client's private IP address behind the server's public IP address. color="yellow_bg">It is called “masquerading”

• Masquerading is altering the source address. In other words, it is a type of SNAT.

• (default) Firewall > NAT > Outbound: Automatically create outbound NAT rules, Create hybrid outbound NAT rules When selected, Masquerading rules are automatically created for all activated interfaces

• (Highlite) Firewall > Rules: Add inbound rule for interface VPN1

  • Pass rule to allow the [1]blocked section below.

    – WireGuard to WAN

    > 💡
    $$
    \text{Client} \xleftrightarrow{[L3]tunnel/snat} \text{VPN Interface (Original Src)} \xrightarrow{[1]blocked} \text{WAN Interface (Dst)} \xrightarrow{[2]passed} \text{Internet}
    $$

  • Firewall > Rules

Interface

Interface > Assignment

• Enter the name you want to display in the description and add

Interface > [Interface Alias]

• WAN
• IPv4 configuration type: DHCP
• IPv6 configuration type: DHCPv6
• LAN
• IPv4 configuration type: Static IPv4
• IPv6 configuration type: Tracking Interface or None
• IPv4 address: (Set to not overlap with other LAN DHCP bands)
  • ex)
  • 192.168.1.1/24
  • 192.168.2.1/24
  • 192.168.3.1/24

• Assign DHCP:

  – TUN (tunnel)
  – IPv4 Configuration Type: None
  – IPv6 Configuration Type: None

Interface > Device > Bridge

If physical ports are insufficient, physical ports can be increased by abstracting the interface. (= L2 switch)

• ex:

  – LAN1: 192.168.1.1/24 → Bridge0: 192.168.1.1/24
  – LAN2: 192.168.2.1/24 → Bridge0: 192.168.1.1/24
  – LAN3: 192.168.3.1/24 → Bridge0: 192.168.1.1/24

• Bridge registration

• Bridge Allocation

• Interface configuration: Static IPv4 assignment (but after cleaning up existing interface configuration to avoid conflicts)

Interface > Device > VLAN

$$
\text{VLAN Interfaces} \xrightarrow{‘802.1Q’Tagging} \text{LAN} \xrightarrow{Trunk} \text{AP} \xrightarrow{Segmentation} \text{Clients}
$$

• In the subnetwork, interfaces are distinguished using VLAN tagging (802.1Q)
• Use multiple subnets on LAN1, which is actually received ex:
• LAN1: 192.168.1.1/24
• LAN1_VLAN10: 192.168.10.1/24

• LAN1_VLAN20: 192.168.20.1/24

• VLAN definition

  Interface name	parent interface	VLAN ID	Band Allocation	Use and Description
  LAN1	–	–	192.168.1.0/24	Network device management
  vlan01.010	LAN1	10	192.168.10.0/24	Physics Hosts (Harvester)
  vlan01.020	LAN1	20	192.168.20.0/24	Wireless Client (WiFi)
  vlan01.021	LAN1	21	192.168.21.0/24	Wireless Client (Overseas VPN)
  vlan01.030	LAN1	30	192.168.30.0/24	Internal Service (VPN Only)
  vlan01.040	LAN1	40	192.168.40.0/24	External Service (Cloudflare Tunnel)
  vlan01.041	LAN1	41	192.168.41.0/24	External Service (Cloudflare Proxy)

• Create VLAN

• Device: Automatically created if not entered
• Parent: Host LAN

• VLAN tag: 2 to 4094

• VLAN assignment

• Interface Configuration: Static IPv4 Assignment

• DHCP range settings

This problem can be solved when using openwrt OS.

What is MACVLAN?

$$
\text{ISP DHCP Server} \xrightarrow{Leasing} \text{WAN}\xleftarrow{vMAC} \text{MACVLAN Interfaces}
$$

• In the upper network, interfaces are distinguished using only MAC Address, so each receiving WAN port must have two or more MAC Address
• OPNSense is not supported by default, but since the WAN port configuration is spacious, it is not necessary if you only have an ISP modem port. (Router devices typically have one listening WAN port)

Interface > Device > VXLAN

Mainly used when L2 level combination is required in communication with remote locations.

• ex:
• K8s clustering of cloud infrastructure and on-prem servers, etc.

Interface > Virtual IP (VIP) > Settings

• Considering convenience and necessity, two types of virtual networks are needed.

Ghost Address Band: OPNSense Interface that does not exist anywhere (convenient as it does not need to be defined separately)

• When using the Firewall > NAT > Port Forwarding function, you can redirect by declaring it as a destination even if there is no actual interface, so there is no need to use VIP.

VIP Band: A virtual interface recognized by OPNSense.

• In plugins, etc., the existence of a Socket Connection is required.

• DNS maps to the virtual address of the defined band.

• The subnets below do not actually exist, and if you define and declare them for convenience, it is convenient for future maintenance.

• OPNSense DNAT – VIP Net: 192.168.118.0/24
• HAProxy DNAT – VIP Net: 192.168.119.0/24

Firewall

Firewall > NAT > Port Forwarding

• Basic usage:
• Select WAN interface
• Destination: WAN address
• Redirection address: application endpoint subnet (set to /32 for single server)

• Rule: Automatically maps to WAN firewall rules

• Enforce service port security:

Firewall > Rules

• Except for special purposes, all added Optional Interfaces are allowed for inbound that originates from them.

Firewall > Aliase > GeoIP Setup

• Aliases — OPNsense documentation

In our experience, IPinfo provides much larger and more detailed data sets. If you use a different country from the list, don’t forget to increase Firewall ‣ Settings ‣ Advanced: Firewall Maximum Table Entries higher. As of this writing, the total number of items in the list is approximately 7 million.

• IPinfo GeoIP
• IPinfo GeoIP’s Setup — OPNsense documentation

• steps

  1. Create your IPinfo account: Create your IPinfo account | IPinfo.io
  2. Find your license key: ipinfo.io

  3. Clone the API Token from my dashboard

  4. OPNSense’s GeoIP settings: Insert the following into URL and apply

  5. https://ipinfo.io/data/ipinfo_lite.csv.gz?token=

Add-ons

Common

• DDNS Client

• Dynamic Routing (FRR)

• TFTP Server

• os-tftp
• WOL
• os-wol
• SMTP Server

Backup Option

• git-backup plugin

VPN Server & Client

• pre-installed
• OpenVPN
• IPSec

DHCP Server

• dhcp plugin
• (default)
  • LAN1Interface is set by default.

L7 (Application) Management

• DNS
• (default)

• TLS

  • private TLS:
  • public TLS:
  • TLS Termination

• LoadBalancer

Observability

• Logging
• os-beats
• Monitoring
• os-node_exporter

Restore a Backup

Don’t do anything like setting up a bridge like I did.

• Don’t panic and go to the equipment with a portable monitor and keyboard.
• Select 13) Restore a backup as follows to find and restore an appropriate backup copy from recent records

CLI

• WireGuard