Messages

La mia opinione: accesso alla GUI da remoto solo tramite VPN. Se proprio non fosse tecnicamente possibile, accesso con 2FA e magari solo da indirizzi IP pubblici "trusted".

Or something like this: https://store.gl-inet.com/collections/all-wifi-devices/products/gl-ar300m-mini-smart-router if you only need a VPN client running up to 20..50 Mbps (depending on VPN type). Unfortunately OPNsense doesn't run on it.

let us know when it's time and let's test the experimental Wireguard kernel module.
Then we will see if everything will be good.

2nd to this. Thanks Franco.
--
Stay safe.

Ciao,
altra verifica... se c'è un solo IP fisso in WAN le porte utilizzate dal firewall per la sua amministrazione sono diverse dalla 80 e 443?

P.S.: Le 2 regole di "NAT:Port Forward" hanno Source/Interface WAN, Destination/Address "WAN address" e NAT/IP l'IP del server wordpress.

I managed a couple of APU2s with a data line greater than 100/100 Mbps. In my cases moving the firewalls to DMZ improved significantly the situation.

Another option is this: https://fit-iot.com/web/products/fitlet2/
Quite reliable, not so cheap.

I'd vote for Supermicro, having 3 in production. Like 2x10Gb ports and IPMI.

Hello,

you should add an "IP Alias" with the same netmask of your WAN subnet.
Then you can use it as you need.

Una possibilità è quella di riservare un IP nel servizio DHCP e poi applicare la regola a tempo per quell'IP di origine.

Hello,

it is possible.
You simply need to configure the proper WAN Gateway (WAN1 or WAN2) to a rule belonging to your LAN interface.

Asymmetric routing (https://en.wikipedia.org/wiki/Talk%3ARouting#Symmetric_and_Asymmetric_Routing).
Ping (ICMP) can handle it, all other protocols not.

Hi Gary,
if you stay with drop all (default) rule you don't actually need any other inbound rules.
As a net admin, however, I need to remote admin all my firewalls and if there is no VPN at least one rule allowing the firewall remote admin is needed. In this case access can be "shielded" using DNSBLs and IPBLs.

You need an .iso image to install OPNsense as VM: OPNsense-19.1.4-OpenSSL-dvd-amd64.iso.bz2

Same here. Production environment on ESXi v6.7, VMware tools are properly working despite the warning.

Ciao,

in realtà se la banda WAN è importante (sopra i 100 Mbps) e la banda richiesta dalla VPN è quella della WAN allora la velocità di connessione influenza non poco la scelta dell' hardware. Stesso discorso se sono richiesti servizi IDS/IPS.
Infine: budget?