3.5 KiB
3.5 KiB
20250721-Meeting
- 19.08.2025 Termin fuer Firewall Migration
General
- Interfaces need to be defined on each device. They are not synced
Current Firewall
| Name | Ethernet | VLAN | Network | Gateway | DHCP | Comment |
|---|---|---|---|---|---|---|
| WAN | eth1 | none | 62.245.142.26/29 | 62.245.142.25 | none | Mnet 500 Mbit Fiber |
| LAN | eth0 | 1 | 172.22.0.0/22 | 172.22.3.254 | 172.22.0.10 - 172.22.3.199 | |
| GA | eht2 | 400 | 172.22.4.0/24 | 172.22.4.254 | 172.22.4.100 - 172.22.4.199 | Gebaeudeautomation |
| DMZ | eth4 | none | 172.22.5.0/24 | 172.22.5.254 | DMZ? | |
| Homematic | eht2 | 600 | 172.22.6.0/24 | 172.22.6.254 | 172.22.6.100 - 172.22.6.199 | Home? |
| W-LAN CQSE_VPN | eth2 | 147 | 192.168.147.0/24 | 192.168.147.254 | 192.168.147.100 - 192.168.147.199 | Was |
| eht3 | HA Sync if |
New Firewall
| Name | Ethernet | VLAN | Network | Gateway | DHCP | Comment |
|---|---|---|---|---|---|---|
| WAN | igc1 | none | 62.245.142.26-27/29 | 62.245.142.25 | none | Mnet 500 Mbit Fiber |
| LAN | igc0 | 1 | 172.22.0.0/22 | 172.22.3.254 | 172.22.0.10 - 172.22.3.199 | |
| GA | parent: igc2 | 400 | 172.22.4.0/24 | 172.22.4.254 | 172.22.4.100 - 172.22.4.199 | Gebaeudeautomation |
| DMZ | igc3 | none | 172.22.5.0/24 | 172.22.5.254 | DMZ? | |
| Homematic | parent: igc2 | 600 | 172.22.6.0/24 | 172.22.6.254 | 172.22.6.100 - 172.22.6.199 | Home? |
| W-LAN CQSE_VPN | parent: igc2 | 147 | 192.168.147.0/24 | 192.168.147.254 | 192.168.147.100 - 192.168.147.199 | Was |
| ax0 | 10.0.0.0/31 | / | / | HA Sync if |
WAN
- External WAN: 62.245.142.26/29
- WAN gateway: 62.245.142.25
- WAN broadcast: 62.245.142.31
- WAN not-used addresses: 62.245.142.27-30
OPNsense Cluster
Master
MGMT: 172.22.3.252/24 WAN: 62.245.142.28/29 WANsbx: 10.11.12.2/24 pfSync: 10.0.0.1/31
Slave
MGMT: 172.22.3.253/24 WAN: 62.245.142.27/29 WANsbx: 10.11.12.3/24 pfSync: 10.0.0.2/31
Virtual IP
WANsbx IP: 10.11.12.4/24 WAN IP: 62.245.142.26/29 LAN IP address: 172.22.3.254/24
Switches
cqse-sw-1og-1.cqse.lan
- IP: 172.22.3.200
- untagged in MGMT VLAN
- carries 3 VLANs on igc2: GA, Homematic, WLAN-CQSE_VPN
- Trk1: 49-50 (Sw2Sw Trunk)
- Port 1: Sophos Node1 eth0
- Port 2: Sophos Node2 eth0
- Port 3: Sophos Node1 eth2
- Port 4: Sophos Node2 eth2
cqse-sw-1og-2.cqse.lan
- IP: 172.22.3.201
- untagged in MGMT VLAN
- carries 3 VLANs on igc2: GA, Homematic, WLAN-CQSE_VPN
- Trk1: 49-50 (Sw2Sw Trunk)
cqse-sw-3.cqse.lan
- IP: 172.22.5.200
- All ports in DMZ