Messages

Hello!
I've attached a short network diagram that would better explain my needs, but I will try to also write and explain them:

At this moment, I am using a private network the IPs from the local 10.20.0/16 network on the ax0 interface and just creating a NAT entry for every IP/subnet I'm trying to access. (example: 10.20.0.20 -> 1.2.3.20) that the ISP is routing to me through the WAN static IP they assigned.

My goal here is to create a new network on ax1 and be able to freely assign an IP from the public subnet (1.2.3.0/24). Their advice was simple: disable NAT and just assign the subnet to a network and it should work.

I cannot do that because I can't change the configurations of the whole legacy machines (that are assigned 10.20.0.0/16 IPs with NAT)

I have created a new network on the ax1 interface and configuring it with the public subnet would not give me internet, but if I configure it with any other private network (RFC1918) would work without any issues.

Do I need to disable NAT for the entire router for this setup to work? I need both a private network (ax0) that I can use internally with some NAT entries here and there for public projects and a stictly public network (ax1) that I can assign public IPs to the new machines. I can also work with an alternative to NAT, that would translate the address from the private network (ax0) to the public network (ax1)

Thank you so much for the time you took to untangle this mess of a setup and for every answer!

Thanks so much for the great info.

Indeed, every client will be a unique server. I already created a child VLAN to my LAN that separates them from my  machines, firewall included. The issue I'm facing is mostly about how can I better isolate the servers from each other, 10.20.30.5 to 10.20.30.6 for example.

Creating a unique VLAN for every single client sounds like an automation nightmare.

Hello,

From a security point of view with OPNsense, what is the best way to stop users asigning themselves IPs in a /24 VLAN ?

I have a /24 local network that has a 1:1 NAT to a public /24 subnet. I'm planning to host a few vps on that network and each vps will be owned by a different client. I always thought that nothing can stop a client from assigning themselves as many local IPs as they wish. Having an ARP table and allowing only specific mac/ip pairs to have access to the network is one solution but I'm feeling that this might not be the best one.

What would you do in my case ? How can I properly do this IP management ?