OPNsense Grundkonfiguration: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (3 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 67: | Zeile 67: | ||
| Type || Host(s) | | Type || Host(s) | ||
|- | |- | ||
| − | | Content || 192.168.HS. | + | | Content || 192.168.HS.XX |
|- | |- | ||
| Statistics || ( ) | | Statistics || ( ) | ||
| Zeile 83: | Zeile 83: | ||
| WAN || IPv4 || TCP || HOST || * || WAN address || 4444 || * || WebGUI | | WAN || IPv4 || TCP || HOST || * || WAN address || 4444 || * || WebGUI | ||
|- | |- | ||
| − | | WAN || IPv4 || ICMP || * || * || * || * || * || Ping | + | | WAN || IPv4 || ICMP || * || * || * || * || * || Ping generell von Aussen |
| + | |- | ||
| + | | LAN || IPv4 || * || LAN network || * || * || * || * || LAN to any | ||
| + | |- | ||
| + | | DMZ || IPv4 || * || DMZ network || * || * || * || * || DMZ to any | ||
| + | |- | ||
| + | | SERVER || IPv4 || * || SERVER network || * || * || * || * || SERVER to any | ||
|} | |} | ||
| Zeile 121: | Zeile 127: | ||
=Zertifikat einpflegen= | =Zertifikat einpflegen= | ||
;Zertifikat holen | ;Zertifikat holen | ||
| − | *wget https://web.samogo.de/certs/ | + | *wget https://web.samogo.de/certs/it2XX.xinmen.de.tgz |
;Entpacken | ;Entpacken | ||
*tar -xvzf it2*.xinmen.de.tgz | *tar -xvzf it2*.xinmen.de.tgz | ||
Aktuelle Version vom 31. August 2026, 13:50 Uhr
System: Settings: Administration
(x) Enable HTTP Strict Transport Security TCP port 4444 (x) Disable web GUI redirect rule (x) Disable DNS Rebinding Checks (x) Enable Secure Shell (x) Permit root user login (x) Permit password login SSH PORT 2222
System: Gateway: Configuration
WANGW 192.168.HS.254 Interface: WAN (x) Upstream Gateway
Interfaces: WAN
( ) Block bogon networks ( ) Block private networks IPv4 Configuration Type: Static IPv4 192.168.HS.2XX/24 GW: WANGW
Interfaces: Assignments
em2: DMZ em3: SERVER
Interfaces: SERVER
Enable (x) IPv4 Configuration Type: Static IPv4 IPv4 address: 10.0.10.1/24
Interfaces: DMZ
Enable (x) IPv4 Configuration Type: Static IPv4 IPv4 address: 10.88.2xx.1/24
Services: Dnsmasq DNS & DHCP
DHCP Range: 172.17.2xx.100 bis 172.17.2xx.200
Interfaces: LAN
Enable (x) IPv4 Configuration Type: Static IPv4 IPv4 address: 172.17.2xx.1/24
Hinweis
- Am Client DHCP Adresse neubeziehen
Firewall
Firewall: Settings: Advanced
Disable reply-to: (x) Disable reply-to on WAN rules
Firewall: NAT: Source NAT
Mode: Manual Source NAT rule generation
| Interface | Version | Protocol | Source | Port | Destination | Port | Translate Source IP | Translate Source Port | Description |
|---|---|---|---|---|---|---|---|---|---|
| WAN | IPv4 | * | LAN network | * | * | * | Interface address | * | LAN ins Internet |
| WAN | IPv4 | * | DMZ network | * | ! 10.88.0.0/16 | * | Interface address | * | DMZ ins Internet, kein NAT zu den anderen DMZs |
| WAN | IPv4 | * | SERVER network | * | * | * | Interface address | * | SERVER ins Internet |
Firewall: Aliases
| Parameter | Wert |
|---|---|
| Enabled | (x) |
| Name | HOST |
| Type | Host(s) |
| Content | 192.168.HS.XX |
| Statistics | ( ) |
| Description | Arbeitsstation des Teilnehmers |
Firewall: Rules
Alle Regeln mit Action: Pass und Direction: in, Interface WAN.
| Interface | Version | Protocol | Source | Port | Destination | Port | Gateway | Description |
|---|---|---|---|---|---|---|---|---|
| WAN | IPv4 | TCP | HOST | * | WAN address | 2222 | * | SSH auf die Firewall |
| WAN | IPv4 | TCP | HOST | * | WAN address | 4444 | * | WebGUI |
| WAN | IPv4 | ICMP | * | * | * | * | * | Ping generell von Aussen |
| LAN | IPv4 | * | LAN network | * | * | * | * | LAN to any |
| DMZ | IPv4 | * | DMZ network | * | * | * | * | DMZ to any |
| SERVER | IPv4 | * | SERVER network | * | * | * | * | SERVER to any |
System: Gateways: Configuration
| Parameter | Wert |
|---|---|
| Name | DNSGW |
| Interface | WAN |
| Address Family | IPv4 |
| Priority | 255 |
| IP Address | 192.168.HS.88 |
| Upstream Gateway | ( ) |
System: Routes: Configuration
| Parameter | Wert |
|---|---|
| Disabled | No |
| Network Address | 10.88.0.0/16 |
| Gateway | DNSGW - 192.168.4.88 |
| Description | UNSERE DMZs |
Systemnamen setzen
System: Settings: General
- Hostname: opnsense
- Domain: it213.xinmen.de
Zertifikat einpflegen
- Zertifikat holen
- Entpacken
- tar -xvzf it2*.xinmen.de.tgz
- Zertifikat
fullchain.pem
- Private Schlüssel
privkey.pem
- Hostname IP Test
- host opnsense.it2XX.xinmen.de
opnsense.it2XX.xinmen.de has address 192.168.HS.2XX
System: Trust: Certificates
- +
- Import existing Certificate
- Description: star.it2XX.xinmen.de
- Certificate data
Hier muss der Inhalt von fullchain.pem rein.
- Private key data
Hier muss der Inhalt von privakey.pem rein.
- Dann sichern
System: Settings: Administration
- SSL Certificate: star.it2XX.xinmen.de