#Network
ADR 0008: Exposing personal services directly behind OPNsense and BunkerWeb
Photos and the drive are published without Cloudflare, through a port forward to a BunkerWeb WAF in the DMZ.
ADR 0003: OPNsense on a dedicated box, in the DMZ behind the Freebox Pop
The Freebox stays in router mode; a dedicated OPNsense mini-PC receives all inbound traffic in the DMZ.
ADR 0007: A LAB isolated behind its own firewall
The LAB has its own OPNsense, connected to PROD through a routed transit without NAT.
ADR 0002: Public exposure through Cloudflare Tunnel
The showcase site is exposed through an outbound tunnel, with no inbound port open.
Network
Zoning, firewalls and filtering principles (public version, without addressing).