Messages

With Cloudflare, there are no ports to be opened, since the whole Cloudflare connection is going inside out - Cloudflare provides a client to connect to their servers and then use this tunnel to direct traffic to your internal network and services. That is, the take up the part of terminating HTTP(S) traffic on their end (including certificates), doing the reverse proxy and direting the traffic through a "kind of VPN" tunnel to your network.

Thanks for that explanation. I thought it was the other way around 🙈

Can I ask if I even need to think about DMZ with my planned setup? I wont use VLAN since I use two different dedicated ports on the firewall for my two servers.

I have rules that allow internet for them, but not connect locally (followed https://homenetworkguy.com guide). Is this a DMZ? 🤔

I use this rule on all my interfaces more or less as a standard:

(https://photos.app.goo.gl/HWNak1ELHYHaeqr59)

Would this rule be good practice for my truenasscal that host the nginx proxy for example?

[Whats next?]

Usually, you would just use a reverse proxy like Caddy or HAproxy (there are howtos for those in the tutorial section) to redirect requests to any web backend by name). Using it this way, you do not need to know any ports, just the DNS names for the servers. The reverse proxy does the TLS termination and also fetches the certificates via ACME.sh (preferably via wildcard domains). You would open up ports 80 and 443 on your OpnSense, while the web UI is put on another arbitrary port.

By setting up a separate DMZ VLAN for the backend web server(s), you would then make sure that if one is getting hacked, they cannot get through to your valuable ressources on LAN. Since OpnSense has access to all VLANs, you can put the backends anywhere.

For this to work, you must (these are quite some tasks):

1. Divert the OpnSense web UI to other ports.
2. Set up a working DMZ VLAN with separation from your LAN to put your web server into.
3. Configure the reverse proxy.
4. Set up certificate generation.
5. Configure DNS names to point to your OpnSense instance (potentially involving DDNS).

Cloudflare works differently, AFAIK. They use a reverse tunnel from your web service to Cloudflare, which works much like a VPN. This way, nobody using your web service ever gets to know your real IP or contacts it via ports 80/443. This has the advantage to work even if you are behind CG-NAT, where you cannot set up an open port to work from the outside in in the first place. Your web backend can exist in a separate DMZ VLAN as well in this scenario. Since the connection is done from you to Cloudflare and not the other way around, you also do not have to deal with (D)DNS or expose anything directly to the internet.

For this to work, you must set up:

1. A working separate DMZ VLAN which can access the internet. You place your web server in that DMZ.
2. Cloudflare reverse proxy with certificates.

I have been working on the server settings and opnsense settings and taking time to read and looking at youtube videos on this/network topics to understand what I am doing more. I still feel lost but have some things pinned down. Have started mapping everything in a excel to keep track of my network.

I want to use the last solution you write. Its somewhat what I had before on my normal home asus router, which was very simple on that one.

What I have done is put my server on a dedicated port on the firewall. Have made a subnet(?) for that to be on - 192.168.20.1 IP within the interface settings (dhcp server adress might be the technical term? 🤷�♂️).

Not sure if I need dhcp on that interface since I will only have my server running there with a static ip - if possible.

I will also place my truenas scale server which handles nginx on a dedicated port on the firewall. With its own subnet(?), 192.168.10.1.

In my mind this would be as different "VLAN" but hardcoded with the ports instead to keep it simpler for me to handle in the beginning and also easier on the firewall ports for maximum speed.

Whats next?
1) So in my mind I now have to figure out how to open ports for traffic to flow to my truenas server from WAN, to be able to get traffic from Cloudflare as before (what was called portforward on the asus router).

2) Then I need to open ports from my truenas server to my hosting server for traffic to flow between them - so that Nginx can handle the proxy.

Am I on to it/close or totally lost? 🤔😅

Questions
1) if above is somewhat correct. Where in all this do I configure DMZ?
2) do I need dhcp on the two server ports/interfaces since it will only be on server on each dedicated port in the firewall?

You must have forgotten to disable (and save) ISC DHCP for one or more interfaces.

Could be. I will double check to save and see how it behaves in the future. Thanks again for all our help :) (I have not gotten the time to dig in to the other topic you helped me with yet 😇)

I am using latest opnsense (updated today) and when its rebooting isc takes over - even after saving and using dnsmasq while building my network.

Very annoying. Found this thread when googling for a way to permantly delete isc in my opnsense. Cant find any way other than disable the service which then reloads after reboot on my machine :(

Hi,

I am just starting my life time goal to have a somewhat serious network at home and to host my own websites.

I have just installed opnsense firewall as the first node from the fiber. I then connect a newvly installed ubuntu server in to the firewall.

My plan, after some googleing and reading, is to create a separate VLAN and DMZ for that server.

What makes it a bit tricky is that I have a truenas scale server with NGINX and proxy thrue cloudflare. So before this I just pointed cloudflare to my public IP and then my asus router would portforward that to my truenas scale server with NGINX to point the traffic to my website server.

Taken this in to account my NGINX would be on separate VLAN not DMZ. To keep it "internal" and more safe. But not sure how it would be able to direct traffic to my new website server within the other VLAN with DMZ setup.

My question is perhaps to broad, since I dont really know where to start this. Do anyone have a guide on this specific thing? Or can point me in the right direction?

Or would you recommend any other (more secure) setup for my website server?

Best regards,

Flamur

I take that back about the switch. I can access my switch also(!) - if I just remembered to type in the stupid IP I set it to!

I will pause this for now - my brain is foggy and I make stupid mistakes.

Everything works now 🥳 Thanks again 🙏

That should be two different issues:

- The switch should be on the same (V)LAN, so OpnSense is not involved in the traffic between your PC and the switch on the same subnet - prerequisite for a connection is that the switch IS on the correct VLAN and that is has the correct IP configuration (either static or via DHCP).

- If you can pass traffic via OpnSense, but not connect to the GUI on its LAN interface, it sure looks like firewall rules. As I already said, there is an "allow all" rule for the first LAN only. For every other (V)LAN, you will have to create rules yourself.

Many thanks for your patiance and help with this! Its very much appreciated! 🙏

I will look into the VLAN settings (ip settings) in the switch to see if I have messed it up with all the back and fourth I have been doing. Would you say that the config report earlier would be ok to start with for my simple pourpose to get this firing?

The firewall rules has a bigger learning curve so I just try to mimic the youtube guide. He seemed to cover all these things. Not sure what I am missing.

However I can confirm I can connect to the opnsense GUI. I had choosen the wrong interfarces under "Listen interfaces" under settings - administration, as the guide goes through. Now I can connect to the firewall again also... so slowly getting this going I guess.

I will try to understand my switch a bit more. It has me a bit stressed at the moment to just trying out more or less guessing 😬

Again! Thanks very much for your help. You are a hero member indeed! 🫡

I think I found the issue. It seems DHCP is the root problem here as you mention - thanks!

The guide I followed maybe somewhat outdated, and looking in the opnsense DHCP manuals I found that the ics DHCP is EOL.

I activated the DNSMASQ DHCP for my VLAN interface and now I get IP and can go online to google.se etc.

However I cant reach neither my switch 192.168.10.3 (as set in the VLAN 10 in the switch ip settings) nor access opnsense on 192.168.10.1 as set in the VLAN settings in opnsense.

Is this still related to DHCP or rather firewall rule? 🤔

You could rule out DHCP issues by setting a static IP and trying if that works. Ping from a CLI from both sides to both the OpnSense and the PC IP.

You need to have these correct:

1. VLAN association of both ports (including VLAN tags)
2. IP addresses and subnets on both OpnSense and PC (failing DHCP can be a part of that problem)
3. Firewall rules

I tried setting a static IP on the "laptop" (old windows touchpad with chromeos flex on it, so not optimal for this I guess). Then I get connected! 🥳 But without internet connection and I couldnt reach the switch GUI or opnsense gui.

Maybe you are on to something?

I used static ip 192.168.10.5 and 255.255.255.0 and gateway 192.168.10.1 (what I believe is the opnsense VLAN ip set in opnsense).

"To expire old network leases on ChromeOS Flex, you can either disconnect and reconnect to the network or restart the device. If you need to permanently remove saved networks, you can "forget" them in the network settings"

So it seems this is done when I move the ethernet cable between the ports automatically.

Anything else I can double check?

That depends on whether you really assigned your LAN or another LAN-type interface to your new VLAN. Additional LANs do not have the default "allow any" rule in them, so you probably would need additional firewall rules for any other interface than LAN. Also, if that is another interface, it obviously has another subnet, DHCP must be set up a.s.o.

Then, you would also need to have your client get a new IP address from the other range, which it will not do until after its old lease expires.

If I did correctly, as I understood the youtube guide, I set up VLAN with parent igc1 (the port that goes to the switch) and ID/Tag 10.

Then I go to that interface (name "untrusted") and choose static ip4, 192.168.10.1/24 (the normal LAN interface uses 192.168.1.1/24).

I also followed the guide to setup initial firewall rules to allow traffic for the new untrusted VLAN network.

BUT you mention "old leases expires". I will google to see if I can run something to do this manually to really know its not this that hinders connection on VLAN 10 ("untrusted")

With that switch configuration, your port 5 is "internally" on VLAN 10, but externally, you attached PC can use this as untagged, so business as usual.

You OpnSense on the other hand on port 1 needs to tag its interface with VLAN 10, because the port is tagged. So, for the PC and OpnSense to see one another, you will have to create a VLAN 10 and assign it to be LAN instead of the physical NIC.

In opnsense VLAN 10 is assigned to the LAN port which goes to the switch. I followed the youtube guide on this. So VLAN is assigned to the port in opnsense. Can I have missed something in those steps/settings perhaps in opnsense?

This is the switches config report, maybe it helps to clarify what I have set up:
Running configuration:

; J9777A Configuration Editor; Created on release #YA.15.16.0006
; Ver #06:04.9c.63.ff.37.27:12
hostname "HP-2530-8G"
timesync sntp
sntp unicast
sntp server priority 1 194.58.200.20
time timezone 2
ip default-gateway 192.168.10.1
ip timep dhcp
snmp-server community "public" unrestricted
vlan 1
   name "DEFAULT_VLAN"
   no untagged 5
   untagged 1-4,6-10
   ip address 192.168.1.2 255.255.255.0
   exit
vlan 10
   name "VLAN_10_Opnsense"
   untagged 5
   tagged 1-2
   ip address dhcp-bootp
   exit
spanning-tree
spanning-tree mode rapid-pvst
no tftp server
no dhcp config-file-update
no dhcp image-file-update

Hi everyone,

I'm trying to set up a home network and I've run into some trouble with VLANs.

My setup is:
- OPNsense as the firewall, directly connected to fiber
- HP 2530-8G switch to distribute traffic to a server, access point, and a computer (If I can get this to work that is 😅)

Everything works fine with the default setup. I've followed the official OPNsense documentation and this YouTube guide:

The problem starts when I try to configure VLANs as shown in the video. The guy in the video uses a more professional switch, while mine is older and I'm not even sure if it fully supports the desired needs for this. I'm completely new to this kind of networking—I'm used to basic home routers like Asus—so apologies for any lack of knowledge gaps.

As long as I avoid the VLAN steps, everything runs smoothly.

I've created VLAN 10 in both OPNsense and the switch. Port 1 on the switch connects to the firewall, and Port 5 connects to my computer (running Chrome OS—hopefully that's not causing issues).

I configure the switch via its web GUI using Port 3 (I initially set it up via console and even tried VLAN settings there out of desperation following a guide). According to the video, I should test the VLAN by connecting my computer to Port 5 (assigned to VLAN 10), but when I do that, the computer gets no connection. If I plug it back into Port 3, it works immediately, as I guess this uses the default VLAN setting in the switch.

In the VLAN 10 settings on the switch:
- Port 1 and 2 are set as **tagged**
- Port 5 is set as **untagged**
- The default VLAN is still untagged on the remaining ports

I've tried different IPv4 settings for VLAN 10: disabled, manual, and DHCP. Nothing works - or atleast not as I have tried it.

I've also uploaded all the manuals of the switch (500+ pages) to googles ai and asked for help there, but it only repeats things I've already tried and double-checked.

One thing the AI mentioned is to check: 
"802.1Q: This is the standard protocol for VLAN tagging used by your switch. It must be supported and enabled on the firewall port."
I have no idea how to do that. I've Googled and searched through all the menus in OPNsense but haven't found anything on this or a setting to active this protocal.

I also enabled STP with RPVST mode in the swtich — no change.

Any tips or guidance would be very, very appreciated!

Best regards, 
Flamur (a noob trying for two days straight and starting to loose my mind)