← All projects

Network Engineer

OPNsense Segmented Network

Multi-VLAN home/lab network with strict inter-segment policy on OPNsense — workstation, lab, IoT and DMZ tiers, each with explicit allow rules.

  • OPNsense
  • Suricata IDS
  • Unbound DNS
  • VLAN 802.1Q
  • WireGuard

Architecture

allowdenydenyreturn onlyInternetOPNsenseVLAN 10 · WorkstationVLAN 20 · LabVLAN 30 · IoTVLAN 40 · DMZ

Overview

Designed a four-segment network on OPNsense to separate trust zones. The IoT segment cannot initiate connections to the workstation segment, and the DMZ can only respond to inbound traffic — never originate it.

Suricata is enabled in IDS mode on the WAN and IoT interfaces, with high-severity alerts forwarded to a syslog collector for correlation.

Policy highlights

  1. Default-deny inter-VLAN, with named alias-based allow rules for each documented flow.
  2. Unbound resolves on a dedicated VLAN with DoT upstream; clients cannot bypass it without a firewall denial.
  3. WireGuard road-warrior peers land on a restricted segment with the same workstation-equivalent ACL.