Networking

VLANs and Routing

Canonical per-site VLAN prefixes, gateway ownership, local-only networks, DHCP scopes, and special transit or sink VLANs.

VLAN IDs align across sites, but their active use is site-specific. OPNsense owns routed gateways; Corosync and storage planes stay local with no gateway. Site A also uses VLAN 999 as a native sink and omits the Site B-only VLAN 253 transit.

Canonical VLAN Plan

VLANPurposeSite A prefix and stateSite B prefix and state
10Network Mgmt / IPMI10.10.10.0/24; OPNsense 10.10.10.110.20.10.0/24; OPNsense 10.20.10.1
20Proxmox Management10.10.20.0/24; OPNsense 10.10.20.110.20.20.0/24; OPNsense 10.20.20.1
25Corosync heartbeat10.10.25.0/24; no gateway10.20.25.0/24; no gateway
30VM Services10.10.30.0/24; OPNsense 10.10.30.110.20.30.0/24; OPNsense 10.20.30.1
40Kubernetes Nodes10.10.40.0/22; OPNsense 10.10.40.110.20.40.0/22; OPNsense 10.20.40.1
50K8s LB / VIPs10.10.50.0/24; OPNsense 10.10.50.110.20.50.0/24; OPNsense 10.20.50.1
60Storage / Ceph public10.10.60.0/24; no gateway10.20.60.0/24; no gateway
65Ceph cluster10.10.65.0/24; reserved and not carried10.20.65.0/24; no gateway
70DMZ10.10.70.0/24; OPNsense 10.10.70.110.20.70.0/24; OPNsense 10.20.70.1
80Monitoring10.10.80.0/24; OPNsense 10.10.80.110.20.80.0/24; OPNsense 10.20.80.1
90Backup / Replication10.10.90.0/24; OPNsense 10.10.90.110.20.90.0/24; OPNsense 10.20.90.1
100Lab / Trusted Client10.10.100.0/22; OPNsense 10.10.100.110.20.100.0/22; OPNsense 10.20.100.1
110IoT10.10.110.0/24; OPNsense 10.10.110.110.20.110.0/24; OPNsense 10.20.110.1
120Guest WiFi10.10.120.0/24; OPNsense 10.10.120.110.20.120.0/24; OPNsense 10.20.120.1
253UniFi WAN transitAbsent; 10.10.253.0/24 reserved10.20.253.0/24; OPNsense .1, USG Pro WAN .2
999Native sink / quarantineNo subnet, gateway, DHCP, or clientsNot used

Site A Has One Layer 3 Owner

OPNsense owns every routed Site A .1. The three UniFi switches remain Layer 2 only. VLANs 25 and 60 have no gateway; VLAN 65 is not carried; VLAN 999 has no IP configuration.

Routing Classes

ClassVLANsBehavior
Routed zones10, 20, 30, 40, 50, 70, 80, 90, 100, 110, 120OPNsense provides the local gateway and applies stateful policy
Local-only data planes25, 60Direct attachment only; no default gateway or inter-site route
Site B local-only Ceph plane65Direct Ceph cluster attachment; never route to VLAN 60
Reserved Site A Ceph plane65Prefix reserved, but the VLAN is not carried
Site B legacy transit253OPNsense-to-USG Pro WAN handoff only
Site A native sink999Untagged trunk traffic reaches a non-routed dead end

VLAN 4040 is a retired Site A Layer 3 transit proposal and must not be configured. The Site A port profiles that determine tagged carriage are on the Site A Port Map; Site B carriage is on the Site B Port Map.

Site A DHCP Scopes

OPNsense serves DHCP only where dynamic Site A clients exist. Infrastructure uses static addresses or documented reservations.

VLANScopeDNS during target-LAN commissioningDNS after Technitium cutover
10010.10.100.50-10.10.103.199Local OPNsense interface10.10.30.10, 10.10.30.11
11010.10.110.50-10.10.110.199Local OPNsense interface10.10.30.10, 10.10.30.11
12010.10.120.50-10.10.120.199Local OPNsense interface10.10.30.10, 10.10.30.11

Site B Remains Parked

The active Site A campaign does not revise Site B VLAN or DHCP behavior. Exact Site B implementation work waits for a separate, owner-approved campaign.

Networking

Orientation to the homelab network model, traffic boundaries, address and policy references, validation runbooks, and packet-flow troubleshooting.

Routing and Firewall Policy Matrix

Exact Site A zone outcomes, narrow required permits, mandatory denies, service objects, and the evidence required before a firewall rule is accepted.