Routing and Firewall Policy Matrix
Exact Site A zone outcomes, narrow required permits, mandatory denies, service objects, and the evidence required before a firewall rule is accepted.
Site A starts from deny-by-default between routed zones. Every permit identifies its ingress interface, named endpoints, protocol, ports, purpose, and adjacent negative test; an unspecified flow remains denied.
Target Policy, Not Live State
Site A remains at Phase A2. The final routed VLANs and rules are commissioned in
A4. The historical broad LAN/transit allow in opnsense/config is obsolete and
must not be applied at cutover; target automation still needs explicit
interfaces, aliases, NAT, and rules.
Result Vocabulary
| Result | Meaning |
|---|---|
| Allow — narrow | A named source alias may reach a named destination alias on recorded protocols and ports only |
| Allow — client WAN | Client-initiated internet egress through OPNsense NAT; no unsolicited matching WAN ingress |
| Deny | An explicit block or the default deny applies |
| No route | The traffic plane has no OPNsense interface, gateway, NAT, or static route |
| Closed until phase | No rule exists until the workload phase defines endpoints and ports |
An Allow — narrow cell never means source network → destination network: any. If aliases, protocol, and ports are missing, the flow is denied.
Site A Zone Matrix
| Source | Required allows | Mandatory denies or closed paths |
|---|---|---|
| WAN | Established return traffic; approved published DMZ services through matching NAT and firewall rules | OPNsense admin, Proxmox, IPMI, UOS, OpenBao, and every unpublished internal service |
| VLAN 10 Network Mgmt / IPMI | sa-uos-01; approved DNS, NTP, and update endpoints | General client access and direct WAN exposure |
| VLAN 20 Proxmox Management | DNS, NTP, update repositories, and declared service dependencies | IoT, Guest, and undeclared service networks |
| VLAN 30 VM Services | Declared consumers and dependencies only | Publication to an entire client or management subnet without a service rule |
| VLANs 40/50 Kubernetes | None before A11 | Every pre-opened Kubernetes node or VIP flow before a cluster exists |
| VLAN 70 DMZ | Declared internal dependencies only; approved WAN publication per service | Management, storage, and other internal networks by default |
| VLAN 80 Monitoring | Collector aliases may poll explicit exporter targets | Broad monitored-node access back into monitoring and undeclared targets |
| VLAN 90 Backup / Replication | Declared host-to-PBS and PBS replication flows only | General management, client, and application traffic |
| VLAN 100 named admin aliases | Required OPNsense, VLAN 10, and VLAN 20 management services; normal client WAN | Blanket access to every management endpoint or port |
| VLAN 100 other trusted clients | Normal client WAN and declared application services | Implicit management access solely because the client is trusted |
| VLAN 110 IoT | Local DNS, NTP, client WAN, and explicit local controller or service exceptions | General access to VLANs 10, 20, 30, 60, 70, 80, and 90 |
| VLAN 120 Guest WiFi | Local DNS and client WAN | All RFC1918/internal destinations, including management and storage |
| VLAN 25 Corosync | Peer traffic inside VLAN 25 | No route to OPNsense, WAN, or another VLAN |
| VLAN 60 Storage | Approved consumers directly attached inside VLAN 60 | No route to OPNsense, WAN, VLAN 65, or another VLAN |
| VLAN 65 Ceph cluster | None at Site A; reserved and not carried | Every Site A flow |
| VLAN 999 Native sink | None | No IP subnet, gateway, DHCP, clients, or OPNsense interface |
Required Service Objects
Objects make repeated infrastructure flows explicit. Creating an object does not create an allow rule; the matrix decides which source may use it.
| Object | Destination | Protocol and port | Allowed source class |
|---|---|---|---|
| Local DNS | Current local OPNsense resolver; later 10.10.30.10/.11 | TCP/UDP 53 | Approved client and infrastructure zones |
| NTP | Approved local or external time source | UDP 123 | Approved infrastructure and client zones |
| OPNsense admin | 10.10.10.1 | HTTPS/API service only | Named admin and recovery aliases |
| Proxmox admin | VLAN 20 host aliases | TCP 22 and 8006 | Named admin aliases |
| UOS admin | 10.10.10.40 | TCP 11443 | Named admin aliases |
| Monitoring exporters | Explicit monitored-node aliases | Exporter-specific port, such as TCP 9100 for node_exporter | VLAN 80 collector aliases |
| Backup services | Explicit host and PBS aliases | Protocol and port recorded with the backup service | VLAN 90 aliases only |
DHCP terminates on the local OPNsense client-VLAN interface and needs no inter-zone rule. UOS device traffic between VLAN 10 peers is same-subnet Layer 2 traffic.
Mandatory Negative Tests
| Test source | Test destination | Expected result |
|---|---|---|
| WAN | OPNsense admin, Proxmox, IPMI, UOS, and OpenBao | Denied; no matching inbound NAT |
| VLAN 110 | Representative VLAN 10 and VLAN 20 endpoints | Denied at OPNsense |
| VLAN 120 | Representative RFC1918 address in each internal routed class | Denied while public internet still works |
| VLAN 70 | Management and storage targets | Denied unless a named dependency exists |
| Non-admin VLAN 100 client | Management service outside its alias | Denied |
| Any routed VLAN | VLAN 25 and VLAN 60 endpoints | No route through OPNsense; local peers remain unaffected |
| Any Site A source | VLAN 65 or VLAN 999 | No routed path or addressable endpoint |
| VLANs 40/50 before A11 | Any dependency | Denied because phase rules do not exist |
Rule Construction Contract
Every pass rule records the ingress interface, source alias, destination alias, protocol, destination port, service owner, positive probe, adjacent negative probe, and activation phase. OPNsense rules belong on the interface where traffic enters the firewall.
No Diagnostic Broad Allows
Never add a broad /16 pass, an any-to-any inter-zone rule, or a gateway on
VLAN 25 or 60 to make a test succeed. Undefined flows stay denied until the
service contract is approved.
Use the Network Validation Runbook to prove the matrix and Packet-Flow Troubleshooting to isolate a failed path.
Site B Boundary
Site B remains parked and unchanged. Do not copy Site A VLAN 999 or clean-slate rules into Site B; its OPNsense/Netgear/USG design retains VLAN 253.