Messages

1

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: Today at 01:23:12 am »

Yeah, that did not work. Like, everything "worked" except Internet access. Only thing I did not ADD were any OUTGOING NAT rules, but I assumed I did not need. Apparently I did. I tried doing auto nat and hybrid.
Through the OPNSense to the SG350XG, I could connect to all LAN devices on each Network, all was fine.. But nothing outgoing.

2

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: November 20, 2024, 05:59:45 pm »

I added IP Aliases, also WAN set for PPPoE and grabs default IP/Gateway x.x.x.182;

x.x.x.177
x.x.x.178
x.x.x.179
x.x.x.180
x.x.x.181
x.x.x.182 [Default WAN IP]

NAT One-To-One BiNAT, Each WAN IP translates to it's own LAN Network;

x.x.x.177 NAT 192.168.1.0
x.x.x.178 NAT 192.168.2.0
x.x.x.179 NAT 192.168.3.0
x.x.x.180 NAT 192.168.4.0
x.x.x.181 NAT 192.168.5.0
x.x.x.182 NAT 192.168.6.0

Will Outbound NAT will be negotiated via Hybrid NAT rules/ BiNAT setup?
Is there a way to specify outgoing as a whole, I.E. 'anything' on 192.168.1.0
outbounds x.x.x.177, 192.168.2.0 outbounds x.x.x.178 and so on? I assume I would
need to make those Outbound entries... to email servers and http servers.

I will assume that I give LAN Interface on OPNSense an IP of 172.16.1.1
I create 6 Static Routes to the SG350XG Networks using 172.16.1.2 [SG GE 1/1 Interface IP]
as the Gateway.
This way anything Incoming on a specific WAN IP will be NAT'd to the specific LAN Network
which is forwarded to the SG350XG via the Static Routes for the Networks
   192.168.1.0 255.255.255.0 172.16.1.2
   192.168.2.0 255.255.255.0 172.16.1.2
And so on.

Do I need to set up a Gateway at all on the OPNSense?   

3

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: November 19, 2024, 09:33:10 pm »

BUMP

4

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: November 08, 2024, 05:20:40 pm »

I do not understand your meaning, vanity IP’s? I just mean that if I were to connect to WAN https x.x.x.177 it would forward to LAN 192.168.1.443:443, so essentially I wanna run a https server. This would be part of a pay subscription?

Oh wow I am an idiot. You were referring to the 192.168.1.443, which I was mistaken in saying, I am slow today. Alright cool I’ll look into getting this all done. Thanks all.

5

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: November 08, 2024, 05:06:44 pm »

192.168.1.43:443 I am sorry, yeah I just got giddy with typing you are correct. Also NGINX would be running on a Docker container on that IP.

6

24.7 Production Series / Re: Some questions before transitioning Cisco ISR/NGFW to OPNSense

« on: November 08, 2024, 05:01:24 pm »

I do not understand your meaning, vanity IP’s? I just mean that if I were to connect to WAN https x.x.x.177 it would forward to LAN 192.168.1.443:443, so essentially I wanna run a https server. This would be part of a pay subscription?

7

24.7 Production Series / Some issues configuring OPNSense w/ PPPoE+STATIC IP Block+Internet Conectivity.

« on: November 08, 2024, 03:59:27 am »

Hi there

I’ve used OPNS a while back and had 0 issues with it but my layout was quite simple. At that same time I was using Cisco ISR + FTD (NGFW) for my more complicated setup but wanted to move it all over to just OPN.
I won’t get to crazy details of my setup but will mention the most basic needs;

I have 5 usable static ips, each static wan ip has its own network. I.E. 207.108.x177 is 192.168.1.0, 207.108.x 178 is 192.160.2.0 and so on. Obviously I need NAT for WAN to LAN (ip) direction  for specific ip’s and port services etc but also want a NAT for the WAN to NETWORK as a whole.
Just curious if this is possible.
So, I’d need NAT x.x.x.177 is 192.168.1.0 but then NAT x.x.x.177 Port 443 to let’s say 192.168.1.443 for NGINX.

8

General Discussion / Re: VLAN Implementation, unsure.

« on: November 15, 2023, 11:11:24 pm »

Also I assume each Vlan will all use the  same default opnsense PPPOE WAN IP as their Internet address. Unless specified.

9

General Discussion / Re: VLAN Implementation, unsure.

« on: November 15, 2023, 10:12:53 pm »

Ah alright that makes sense. Yeah we will go Trunk. That makes sense, I wouldn’t need to set the Switch Port to anything as it will be a trunk port anyway, and the remaining Ethernet ports on the switch will look to its assignments to which vlan, on the trunk. Cool.

I assume LACP is like multiple physical links as backups of main trunk fails, like redundancy? Either way, this is for home I am just having fun with a little “advanced” setup. 

10

General Discussion / Re: VLAN Implementation, unsure.

« on: November 15, 2023, 07:58:08 pm »

Alright, yeah I think what I will do is use the OPN as the "router" and create the Trunk... Upon looking, it seems my Cisco SG500X can indeed do LACP but being that is all new to me, I may for now, keep it simple Trunk will will indeed look into it.
The OPN is running via VM on Proxmox so I only have 2 Interfaces [lan/wan] so this LACP would be assigned on the LAN Interface..

After I create the 3 vlans on OPN, and then the Trunk and assign those vlans to/through the Trunk, on my Switch I will use Port GE 1 as the Trunk port, assign/allocate vlan1-3 to it, and then on the remaining 47 Ports, just assign them to their vlans.
Would the GE 1 on the Switch need to be a L3 or keep it L2, but keep it out of any vlan and just assign it [interface/trunk] to the GE 1.

11

General Discussion / Re: VLAN Implementation, unsure.

« on: November 15, 2023, 06:21:43 pm »

Or would I create all 3 vlans on the OPNSense and create a tunnel from LAN to Switch and leave in L2 but assign groups of interfaces on Switch to each vlan and let OPNSense do the routing/directing?

12

General Discussion / VLAN Implementation, unsure.

« on: November 15, 2023, 05:48:19 pm »

Morning.

Currently my OPNSense has a STATIC WAN IP via PPPoE and then 1 DHCP Server, 192.168.5.0.

I was wanting to split my network into 3 vlans, using a L3 Switch, as such;
vlan1 - 192.168.1.0 Home Wifi [will connect to wifi router]
vlan2 - 192.168.2.0 Home Ethernet [any devices physically plugged in]
vlan2 - 192.168.3.0 Home Servers [OMV, Email Servers etc]

Currently said Switch [connecting to LAN of OPNSense] is in L2, all connecting to 192.168.5.0, but I want to restructure my network.
Would I create the 3 vlans as mentioned on the L3 and then create a 4th network [from opnsense to L3] or could vlan1 be an extension of Opnsense DHCP?
I would assume having the network from opnsense to l3 would be it's own network outside of the 3 vlans. Bring that the vlans would be L3, I assume the automatic "communication" of the inter-vlan wouldbe automatic (so like 192.168.2.88 could ping 192.168.3.55 without static routes cause the L3 would already know?).

This will obviously get deeper as I do have a block of static IP's that need to be directed to specific LAN Ip's, but for now I wanna establish the ground rules.

13

General Discussion / Re: Chaning existing NIC 1 and 2 to accomidate imported backup

« on: November 15, 2023, 05:40:34 pm »

Forgot to respond. That worked, I thank you. How do I make this resolved?

14

General Discussion / Re: Chaning existing NIC 1 and 2 to accomidate imported backup

« on: November 01, 2023, 09:35:19 pm »

Amazing! I did not know I could do this! Now that you mention it, I recall doing such thing/s on my Ciscp ASA and FirePower Firewalls. Thank you. I will let ya know.

15

General Discussion / Chaning existing NIC 1 and 2 to accomidate imported backup

« on: November 01, 2023, 05:30:49 pm »

So, currently this new PC I am trying to convert to Opnsense Firewall has re0 and re1 as NIC's... All is good. I go into GUI and I load my existing backup from a different system and the NIC's have changed to nothing that is even on this new system... Can I simply change the NIC's names on new system from its vnet1 to re0 and so on or does it not work that way, cause it is a new system new hardware.