Skip to content

Runbook 03 — Interfaces + VLANs (the 6 zones)

Goal: create the six zone VLANs on vtnet0, assign them as named interfaces with their gateway IPs, all enabled. The MGMT VLAN (tag 10) takes over the 10.20.10.1 management address from the untagged LAN, which is then removed.

Prereqs: runbook 02 validated.

Zone / VLAN / IP reference (authoritative)

VLAN tag = subnet third octet (mnemonic). Firewall is .1 in every zone.

Zone VLAN tag Interface name IPv4
MGMT 10 MGMT 10.20.10.1/24
SERVERS 20 SERVERS 10.20.20.1/24
DMZ 30 DMZ 10.20.30.1/24
WORKSTATIONS 40 WORKSTATIONS 10.20.40.1/24
IOT 60 IOT 10.20.60.1/24
GUEST 90 GUEST 10.20.90.1/24

⚠️ Switch & AP alignment: these tags must match what your managed switch trunks to the Proxmox host and what your APs broadcast per-SSID. Configure the switch trunk ports and per-SSID VLANs to these tags so clients land in the right zone.

1. Create the VLAN interfaces

Interfaces → Devices → VLAN → + (repeat for each row above): - Parent: vtnet0 (the field is labeled just "Parent") - VLAN tag: the tag from the table (10, 20, …) - VLAN priority: 0 (a dropdown — leave the default "Best Effort (0)") - Device: leave blank — OPNsense auto-generates the device name (a vlan0.<tag>-style or vlanNN string, depending on version). It's cosmetic; everything later references the friendly name you set in §2, never the raw device. - Description: e.g. vlan_mgmt

Create all six.

2. Assign + name them

Interfaces → Assignments: for each new VLAN, in the "Assign a new interface" row pick the VLAN device and type the zone name in the Description field there, then + Add (you can set the description at add-time; the internal name becomes optN). Then click into each assigned interface and set: - Enable interface: on - Description: the zone name (MGMT, SERVERS, …) — this is what rules reference. - IPv4 Configuration Type: Static IPv4 - IPv4 address: the .1 from the table, and set the mask to /24 (the prefix dropdown next to the address). ⚠️ It must be /24, not /32 — a /32 gives the firewall no connected route for the zone, so DHCP clients can't reach the gateway. (Easy to fat-finger; verify every zone reads …/24 afterward.) - IPv6 Configuration Type: None — this build is IPv4-only; IPv6 is turned off firewall-wide in runbook 02 ("Turn off IPv6" checked). - Leave everything else default. Save, then Apply changes.

Do this for all six zones.

MGMT takes over management. The untagged LAN currently holds the 10.20.10.1 management address (runbook 02). Assign the MGMT VLAN (tag 10) as 10.20.10.1/24 as above, move your management client onto the tagged MGMT VLAN, confirm the GUI is reachable at https://10.20.10.1 over it, then remove the untagged LAN assignment (Interfaces → Assignments → delete LAN) so the gateway address lives only on the tagged interface. Do the move from the Proxmox console (qm terminal 9140) as a fallback in case you lose GUI access mid-change.

3. Block-by-default posture (set now, rules come in runbook 06)

New optN interfaces have no allow rules, so they default-deny — good. Don't add any allow rules yet; we build the full per-zone rule set in runbook 06 after DHCP/DNS (04) and VPN (05) exist, so the rules can reference real gateways/aliases.

Management access right now is via the MGMT interface (10.20.10.1), which carries the default LAN allow rule inherited from the untagged LAN it replaced, so you don't lose the GUI. Runbook 06 replaces that with the proper MGMT rule set (WG-admin-only reach).

4. Aliases (create the building blocks for later rules)

Firewall → Aliases → + — create these now; rules in 06/07/09 reference them:

Name Type Content
RFC1918 Network(s) 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (literal — whole private space)
ZONES_ALL Network(s) the six interface networks: MGMT net, SERVERS net, DMZ net, WORKSTATIONS net, IOT net, GUEST net
MGMT_NET Network(s) the MGMT net interface entry
SERVERS_NET Network(s) the SERVERS net interface entry
FREEIPA Host(s) 10.20.20.2 (internal IPA DNS) — pin after runbook 10
IPA_PORTS Port(s) 88, 464, 389, 636, 53, 443, 2049
NFS_PORTS Port(s) 2049

⚠️ IPA_PORTS: the LDAPS port is 636, not 635 (easy typo). The full set is Kerberos 88, kpasswd 464, LDAP 389, LDAPS 636, DNS 53, HTTPS 443, NFSv4 2049. Double-check the alias after entry — a stale 635 silently breaks secure LDAP to FreeIPA.

Use the interface-network entries, not typed CIDRs, for the zone-based aliases. In the alias content field, start typing the zone name and pick the autocompleted "<Zone> net" entry (stored internally as __optN_network). These track the interface's actual subnet, so renumbering never leaves an alias stale. RFC1918 stays literal — it isn't tied to an interface.

(Host IPs like FreeIPA/fileserver/Jellyfin get pinned in runbooks 09–11; update the relevant host aliases there.)

Validation

  • [ ] All 6 zone interfaces show up, enabled, with the correct .1/24.
  • [ ] Interfaces → Diagnostics → ARP/NDP or the dashboard shows the 6 VLAN interfaces present (auto-named, e.g. vlan0.10-style — exact string varies by version).
  • [ ] From the firewall (Diagnostics → Ping, source = a zone interface) you can ping that interface's own .1. (No clients yet, so cross-zone pings won't work — that's fine.)
  • [ ] GUI reachable at https://10.20.10.1 over the tagged MGMT VLAN; the untagged LAN assignment has been removed.
  • [ ] Aliases saved and applied with no errors.

Then → runbook 04 (DHCP + DNS).