VLAN Matrix | AORXI Homelab

Filter VLANs by site, gateway owner, or role. Site A routes every eligible VLAN through OPNsense; VLANs 25 and 60 remain local-only, VLAN 65 is reserved, and VLAN 999 is an unrouted native sink. VLAN 90 remains routed for PBS replication.

OPNSENSE-OWNED LAYER 3

VLAN and Gateway Ownership

Site A uses an L2 switch fabric with every routed gateway on OPNsense. Site B remains unchanged.

Showing 16 of 16 VLAN definitions

VLAN	Purpose	Site A subnet	Site A gateway owner	Site B subnet	Site B gateway owner
10	Network Mgmt / IPMI	10.10.10.0/24	`sa-fw-01 · 10.10.10.1`	10.20.10.0/24	`sb-fw-01`
20	Proxmox Management	10.10.20.0/24	`sa-fw-01 · 10.10.20.1`	10.20.20.0/24	`sb-fw-01`
25	Corosync heartbeat	10.10.25.0/24	`none`	10.20.25.0/24	`none`
30	VM Services	10.10.30.0/24	`sa-fw-01 · 10.10.30.1`	10.20.30.0/24	`sb-fw-01`
40	Kubernetes Nodes	10.10.40.0/22	`sa-fw-01 · 10.10.40.1`	10.20.40.0/22	`sb-fw-01`
50	K8s LB / VIPs	10.10.50.0/24	`sa-fw-01 · 10.10.50.1`	10.20.50.0/24	`sb-fw-01`
60	Storage / Ceph public · L2 only	10.10.60.0/24 · no GW	`none`	10.20.60.0/24 · no GW	`none`
65	Ceph cluster	reserved · not carried	`none`	10.20.65.0/24	`none`
70	DMZ	10.10.70.0/24	`sa-fw-01 · 10.10.70.1`	10.20.70.0/24	`sb-fw-01`
80	Monitoring	10.10.80.0/24	`sa-fw-01 · 10.10.80.1`	10.20.80.0/24	`sb-fw-01`
90	Backup / Replication	10.10.90.0/24	`sa-fw-01 · 10.10.90.1`	10.20.90.0/24	`sb-fw-01`
100	Lab / Trusted Client	10.10.100.0/22	`sa-fw-01 · 10.10.100.1`	10.20.100.0/22	`sb-fw-01`
110	IoT	10.10.110.0/24	`sa-fw-01 · 10.10.110.1`	10.20.110.0/24	`sb-fw-01`
120	Guest WiFi	10.10.120.0/24	`sa-fw-01 · 10.10.120.1`	10.20.120.0/24	`sb-fw-01`
253	UniFi WAN transitSite A absent	absent · 10.10.253.0/24 reserved	`none`	10.20.253.0/24	`sb-fw-01 → USG Pro`
999	Native sink / quarantineSite A sink	no subnet	`none`	not used	`none`

Site A: every routed VLAN crosses OPNsense. The switches have management IPs on VLAN 10 but no SVIs, DHCP, or static routes. VLANs 25 and 60 have no gateway; VLAN 65 is reserved; VLAN 999 is an unrouted native sink.

Storage: VLAN 60 remains a direct L2 plane at both sites. Never route VLAN 60 to VLAN 65. Site A VLANs 253/4040 are absent; Site B VLAN 253 remains unchanged.