OPNsense Grundkonfiguration

System: Settings: Administration

(x)  Enable HTTP Strict Transport Security                  
TCP port 4444
(x) Disable web GUI redirect rule             
(x) Disable DNS Rebinding Checks                      
(x) Enable Secure Shell                
(x) Permit root user login      
(x) Permit password login                              
SSH PORT 2222 

System: Gateway: Configuration

WANGW 192.168.4.254
Interface: WAN
(x) Upstream Gateway

Interfaces: WAN

( ) Block bogon networks
( ) Block private networks
IPv4 Configuration Type:  Static IPv4
192.168.4.2xx/24
GW: WANGW

Interfaces: Assignments

em2: DMZ
em3: SERVER

Interfaces: SERVER

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 10.0.10.1/24

Interfaces: DMZ

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 10.88.2xx.1/24

Services: Dnsmasq DNS & DHCP

DHCP Range: 172.17.2xx.100 bis 172.17.2xx.200

Interfaces: LAN

Enable (x)
IPv4 Configuration Type: Static IPv4
IPv4 address: 172.17.2xx.1/24

Hinweis

Am Client DHCP Adresse neubeziehen

Firewall

Firewall: Settings: Advanced

Disable reply-to: (x) Disable reply-to on WAN rules

Firewall: NAT: Source NAT

Mode: Manual outbound NAT rule generation

Sequence	Interface	Source	Source Port	Destination	Destination Port	Translate Source IP	Translate Source Port	Category	Description
100	WAN	LAN net	*	*	*	(leer)	*	Basis	LAN ins Internet
110	WAN	SERVER net	*	*	*	(leer)	*	Basis	SERVER ins Internet
120	WAN	DMZ net	*	10.88.0.0/16 (invert)	*	(leer)	*	Basis	DMZ ins Internet, kein NAT zu den anderen DMZs

Firewall: Rules

Interface	Protocol	Source	Port	Destination	Port	Gateway	Schedule	Description
DMZ	IPv4 *	DMZ net	*	*	*	*	*
SERVER	IPv4 *	SERVER net	*	*	*	*	*
LAN	IPv4 *	LAN net	*	*	*	*	*

Interface	Protocol	Source	Port	Destination	Port	Gateway	Schedule	Description
WAN	IPv4 TCP	HOST	*	WAN address	2222	*	*
WAN	IPv4 TCP	HOST	*	WAN address	4444	*	*
WAN	IPv4 ICMP	*	*	*	*	*	*

System: Gateways: Configuration

Parameter	Wert
Name	DNSGW
Interface	WAN
Address Family	IPv4
Priority	255
IP Address	192.168.HS.88
Upstream Gateway	( )

System: Routes: Configuration

Parameter	Wert
Disabled	No
Network Address	10.88.0.0/16
Gateway	DNSGW - 192.168.4.88
Description	UNSERE DMZs

Systemnamen setzen

System: Settings: General

• Hostname: opnsense
• Domain: it213.xinmen.de

Zertifikat einpflegen

Zertifikat holen

• wget https://web.samogo.de/certs/it213.xinmen.de.tgz

Entpacken

• tar -xvzf it2*.xinmen.de.tgz

Zertifikat

fullchain.pem

Private Schlüssel

privkey.pem

Hostname IP Test

• host opnsense.it2XX.xinmen.de

opnsense.it2XX.xinmen.de has address 192.168.HS.2XX

System: Trust: Certificates

• +
  • Import existing Certificate
  • Description: star.it2XX.xinmen.de

Certificate data

Hier muss der Inhalt von fullchain.pem rein.

Private key data

Hier muss der Inhalt von privakey.pem rein.

Dann sichern

System: Settings: Administration

• SSL Certificate: star.it2XX.xinmen.de

Dann Zertifikat testen

• https://opnsense.it2XX.xinmen.de:4444/