WireGuard Inter-Site Routing
The parked routed tunnel design between Site A and Site B, including transit addresses, route ownership, traffic boundaries, and activation gates.
WireGuard will connect the two OPNsense firewalls with routed, selectively permitted traffic. Each site keeps independent Layer 2, Proxmox, and storage domains; the tunnel carries no internal NAT.
Parked Until the Site B Campaign
WireGuard is designed but not part of the active Site A A0-A11 campaign. Bring it up only after Site A is stable and a separate Site B OPNsense migration has placed both firewalls in control of their local site routes.
Tunnel and Route Model
| Property | Site A | Site B |
|---|---|---|
| OPNsense peer | sa-fw-01 | sb-fw-01 |
| WireGuard address | 10.255.0.1/24 | 10.255.0.2/24 |
| Local site summary | 10.10.0.0/16 | 10.20.0.0/16 |
| Remote route | 10.20.0.0/16 through WireGuard | 10.10.0.0/16 through WireGuard |
| Inter-site NAT | None | None |
The 10.255.0.0/24 block is transit space only. Site summary routes make
individual VLAN prefixes reachable without creating parallel route entries for
every segment; OPNsense policy still decides which flows may pass.
The Tunnel Is Not a Datacenter Fabric
Never bridge Layer 2 over WireGuard. Corosync, Ceph cluster replication, and direct storage traffic stay site-local and must not use the tunnel.
Traffic Policy
The tunnel provides reachability, not blanket trust. Rules on each OPNsense peer allow only the application flows that need to cross sites.
| Traffic class | Inter-site state | Reason |
|---|---|---|
| Administrative access to remote management | Narrowly permitted | Support deliberate remote operations |
| Proxmox Backup Server replication on VLAN 90 | Permitted when deployed | Provide cross-site backup replication |
| DNS, NTP, and monitoring | Permitted as required | Support shared infrastructure services |
| Selected VM Services traffic on VLAN 30 | Explicit allow rules only | Avoid turning the site summary into an implicit trust zone |
| Corosync heartbeat on VLAN 25 | Prohibited | Cluster heartbeat remains inside one site |
| Storage / Ceph public on VLAN 60 | Prohibited | Direct local attachment with no gateway |
| Ceph cluster on VLAN 65 | Prohibited | OSD replication remains isolated within Site B |
OPNsense evaluates each pass rule where traffic enters the firewall. A policy
change must identify source, destination, protocol, port, and the corresponding
negative test; a broad /16 allow is not the target design.
Activation Gates
WireGuard becomes eligible only when all of these conditions are true:
- Site A has completed its WAN handoff and its local routed VLANs are stable.
- A separate Site B campaign has placed OPNsense in control of the Site B routes.
- Neither site summary overlaps the transit block, WAN space, or a peer LAN.
- The required inter-site flow matrix and deny cases are recorded before rules are applied.
- Each site retains local DNS and administrative recovery when the tunnel is unavailable.
Validation
Validate the tunnel as a routing and policy boundary:
- confirm
10.255.0.1and10.255.0.2reach each other over the tunnel; - trace one approved flow in each direction and confirm its original source address is preserved;
- prove Corosync, VLAN 60, and VLAN 65 remain unreachable from the remote site;
- test DNS replication and Proxmox Backup Server traffic only after those services exist;
- disable the tunnel and confirm each site retains local routing, DNS, and management.
Related References
- VLANs and Routing: routed and local-only segment classification
- Address Space and Lifecycle: site summaries and reserved transit space
- DNS Architecture: future cross-site zone replication dependency
- Proxmox Backup Server: future backup replication path
- Network Validation Runbook: future tunnel acceptance evidence
- Packet-Flow Troubleshooting: cross-site route and two-sided policy isolation
DNS Architecture and Resolution
Public and internal DNS authority, the staged resolver lifecycle, Technitium placement, cross-site replication, and failure behavior.
Network Validation Runbook
Decision-gated evidence for physical links, VLANs, gateways, DHCP, DNS, NAT, firewall policy, RSTP, and future WireGuard.