Security Trust Zones & Permitted Flows
Target default-deny policy for WAN, management, services, workloads, DMZ, monitoring, backup, trusted, IoT, guest, storage, and inter-site traffic.
Trust follows function, not proximity. OPNsense mediates every routed transition, local switches carry only approved Layer 2 segments, and each permitted flow is narrow enough to name its source, destination, and service purpose.
Approved Target Policy, Not the Current Automation State
The repository's historical broad OPNsense baseline does not implement the 2026-07-26 Site A target. Final automation still must add the routed VLANs, aliases, DHCP, Unbound, NAT, default-deny rules, and tests that prove unrouted or retired VLANs are absent.
Trust-Zone Model
| Zone | Networks | Default posture | Intended access |
|---|---|---|---|
| WAN | ISP-facing interfaces | Deny inbound | Explicit DMZ publication and later WireGuard only |
| Network management | VLAN 10 | Restricted management | UOS, DNS, NTP, updates, approved recovery access |
| Proxmox management | VLAN 20 | Restricted administration | Approved admins, DNS/NTP, repositories, declared dependencies |
| VM services | VLAN 30 | Service-specific allow | Declared clients reach named services only |
| Kubernetes | VLANs 40 and 50 | Closed until platform phase | Control-plane, node, ingress, and load-balancer flows added explicitly |
| DMZ | VLAN 70 | Isolated | Published services plus declared internal dependencies |
| Monitoring | VLAN 80 | Collector-initiated | Collectors poll explicit endpoints; no broad reverse access |
| Backup | VLAN 90 | Protocol-specific allow | PBS backup, replication, and approved migration traffic |
| Trusted clients | VLAN 100 | Trusted user zone, not admin-equivalent | Internet and declared services; management remains explicit |
| IoT | VLAN 110 | Restricted client zone | Internet, DNS, NTP, and explicit local exceptions only |
| Guest | VLAN 120 | Internet-only client zone | Internet and local DNS; deny private ranges |
| Corosync and storage | VLANs 25, 60, and Site B 65 | Unrouted Layer 2 | Directly attached members only |
| Native sink | Site A VLAN 999 | No service access | Trunk native VLAN and disabled ports only |
| Inter-site | WireGuard 10.255.0.0/24 | Explicit routed permits | Named replication, management, and control flows |
Management and Storage Never Face the WAN
OPNsense administration, Proxmox, IPMI, UOS, OpenBao, Corosync, storage, and switch management are never published to the internet. WAN inbound is denied unless an approved DMZ service or WireGuard rule states otherwise.
Permitted-Flow Matrix
| Source | Destination | Permitted flow class | Everything else |
|---|---|---|---|
| WAN | DMZ service on VLAN 70 | Explicit NAT and matching firewall rule for an approved service | Deny |
| Approved admin aliases on VLAN 100 or recovery hosts | OPNsense, VLANs 10 and 20 | Named administration endpoints only | Deny unmanaged access |
| VLAN 10 devices | UOS, DNS, NTP, update services | Device control, name/time, and software updates | Deny general client reachability |
| VLAN 20 hosts | Admin services, DNS/NTP, repositories | Host administration and declared dependencies | Deny undeclared service access |
| Declared client zones | Named VLAN 30 services | Service-specific destination and port | Deny lateral access across the zone |
| Kubernetes VLANs 40 and 50 | Required platform endpoints | Closed until the Kubernetes phase defines exact flows | Deny |
| VLAN 70 services | Internal services | Explicit application dependency only | Deny general internal access |
| VLAN 80 collectors | Monitored endpoints | Explicit polling and ingestion flows | Deny broad endpoint-to-collector initiation |
| Proxmox hosts and PBS on VLAN 90 | PBS and replication peers | Backup, restore, replication, approved migration | Deny non-backup use |
| VLAN 100 clients | Internet and declared internal services | Trusted-client application access | No implicit access to every management endpoint |
| VLAN 110 clients | Internet, DNS, NTP, exceptions | Minimum device operation | Deny other private destinations |
| VLAN 120 clients | Internet and local DNS | Guest egress and name resolution | Deny all private ranges |
| WireGuard peers | Named cross-site endpoints | DNS replication, PBS copies, OpenBao transit, later UniFi L3 adoption | Deny other cross-site traffic |
IPv6 and mDNS reflection remain off until equivalent explicit policies are designed. Trusted does not mean unrestricted, and a VLAN boundary alone is not a permit.
Unrouted Planes
No Gateway Means No Firewall Exception
VLAN 25, VLAN 60, Site B VLAN 65, and Site A VLAN 999 have no gateway, OPNsense interface, DHCP, NAT, or static route. Site A VLAN 65 is reserved and not carried. A request to route one of these networks is an architecture change, not a routine allow rule.
| Plane | Members | Permitted behavior | Prohibited behavior |
|---|---|---|---|
| Corosync, VLAN 25 | Local Proxmox cluster nodes | Site-local heartbeat | WAN, WireGuard, client, or routed access |
| Storage / Ceph public, VLAN 60 | Direct storage clients and servers | Site-local storage client traffic | General routed access |
| Ceph cluster, Site B VLAN 65 | Site B OSD nodes | Replication, backfill, heartbeat | Routing to VLAN 60 or any other zone |
| Native sink, Site A VLAN 999 | Trunk native state and disabled ports | No endpoint traffic | IP address, gateway, DHCP, or workload |
Service-Specific Permit Anchors
These known application ports refine the zone matrix; they do not create blanket access to the containing VLAN.
| Service | Source | Destination | Protocol / port | Purpose |
|---|---|---|---|---|
| DNS queries | Approved local client VLANs | Local Technitium resolvers | UDP/TCP 53 | Name resolution |
| DNS AXFR | Site B DNS replicas | sa-dns-01 | TCP 53 | Pull authoritative zones |
| DNS NOTIFY | sa-dns-01 | Site B DNS replicas | UDP 53 | Signal zone changes |
| Technitium cluster API | Named DNS/OPNsense peers | Named Technitium nodes | TCP 5380 | Configuration and catalog synchronization |
| UOS administration | Approved admin sources | sa-uos-01 | TCP 11443 | Controller UI and API |
| UniFi inform | Adopted UniFi devices | sa-uos-01 | TCP 8080 | Device adoption and inform |
| UniFi STUN | Adopted UniFi devices | sa-uos-01 | UDP 3478 | Device communication |
| OpenBao API | Approved consumers and transit peer | sa-bao-01 / sb-bao-01 | TCP 8200 | Runtime secrets and transit unseal |
step-ca | Admin VLANs 10, 20, and 100; Site B DNS VMs | 10.10.30.30 | TCP 9000 | Internal certificate issuance |
| ACME DNS-01 | Approved certificate clients | Let's Encrypt and Cloudflare APIs | TCP 443 outbound | Certificate issuance without inbound exposure |
OpenBao port 8200 never faces the internet and must not leave its local segment while TLS is disabled. Networking contains the address plan; service dependencies explains which permitted paths are required during startup.
Service Dependencies & Startup Order
Runtime and configuration dependencies across routing, secrets, UniFi control, DNS, storage, backups, and platform services, including committed boot order and degraded behavior.
Disaster Recovery Objectives, Ownership, RPO & RTO
Recovery mechanisms, technical ownership, implementation state, and objective gaps for network configuration, workloads, secrets, DNS, UniFi control, and whole-site failure.