OPNsense Grundkonfiguration

System: Settings: Administration

(x)  Enable HTTP Strict Transport Security                  
TCP port 4444
(x) Disable web GUI redirect rule             
(x) Disable DNS Rebinding Checks                      
(x) Enable Secure Shell                
(x) Permit root user login      
(x) Permit password login                              
SSH PORT 2222 

System: Gateway: Configuration

WANGW 192.168.HS.254
Interface: WAN
(x) Upstream Gateway

Interfaces: WAN

( ) Block bogon networks
( ) Block private networks
IPv4 Configuration Type:  Static IPv4
192.168.HS.2XX/24
GW: WANGW

Interfaces: Assignments

em2: DMZ
em3: SERVER

Interfaces: SERVER

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 10.0.10.1/24

Interfaces: DMZ

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 10.88.2xx.1/24

Services: Dnsmasq DNS & DHCP

DHCP Range: 172.17.2xx.100 bis 172.17.2xx.200

Interfaces: LAN

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 172.17.2xx.1/24

Hinweis

Am Client DHCP Adresse neubeziehen

Firewall

Firewall: Settings: Advanced

Disable reply-to: (x) Disable reply-to on WAN rules

Firewall: NAT: Source NAT

Mode: Manual Source NAT rule generation

Interface	Version	Protocol	Source	Port	Destination	Port	Translate Source IP	Translate Source Port	Description
WAN	IPv4	*	LAN network	*	*	*	Interface address	*	LAN ins Internet
WAN	IPv4	*	DMZ network	*	! 10.88.0.0/16	*	Interface address	*	DMZ ins Internet, kein NAT zu den anderen DMZs
WAN	IPv4	*	SERVER network	*	*	*	Interface address	*	SERVER ins Internet

Firewall: Aliases

Parameter	Wert
Enabled	(x)
Name	HOST
Type	Host(s)
Content	192.168.HS.XX
Statistics	( )
Description	Arbeitsstation des Teilnehmers

Firewall: Rules

Alle Regeln mit Action: Pass und Direction: in, Interface WAN.

Interface	Version	Protocol	Source	Port	Destination	Port	Gateway	Description
WAN	IPv4	TCP	HOST	*	WAN address	2222	*	SSH auf die Firewall
WAN	IPv4	TCP	HOST	*	WAN address	4444	*	WebGUI
WAN	IPv4	ICMP	*	*	*	*	*	Ping generell von Aussen
LAN	IPv4	*	LAN network	*	*	*	*	LAN to any
DMZ	IPv4	*	DMZ network	*	*	*	*	DMZ to any
SERVER	IPv4	*	SERVER network	*	*	*	*	SERVER to any

System: Gateways: Configuration

Parameter	Wert
Name	DNSGW
Interface	WAN
Address Family	IPv4
Priority	255
IP Address	192.168.HS.88
Upstream Gateway	( )

System: Routes: Configuration

Parameter	Wert
Disabled	No
Network Address	10.88.0.0/16
Gateway	DNSGW - 192.168.4.88
Description	UNSERE DMZs

Systemnamen setzen

System: Settings: General

• Hostname: opnsense
• Domain: it213.xinmen.de

Zertifikat einpflegen

Zertifikat holen

• wget https://web.samogo.de/certs/it2XX.xinmen.de.tgz

Entpacken

• tar -xvzf it2*.xinmen.de.tgz

Zertifikat

fullchain.pem

Private Schlüssel

privkey.pem

Hostname IP Test

• host opnsense.it2XX.xinmen.de

opnsense.it2XX.xinmen.de has address 192.168.HS.2XX

System: Trust: Certificates

• +
  • Import existing Certificate
  • Description: star.it2XX.xinmen.de

Certificate data

Hier muss der Inhalt von fullchain.pem rein.

Private key data

Hier muss der Inhalt von privakey.pem rein.

Dann sichern

System: Settings: Administration

• SSL Certificate: star.it2XX.xinmen.de

Dann Zertifikat testen

• https://opnsense.it2XX.xinmen.de:4444/