#Opnsense
ADR 0008: Exposing personal services directly behind OPNsense and BunkerWeb
Photos and the drive are published without Cloudflare, through a port forward to a BunkerWeb WAF in the DMZ.
ADR 0010: A single server, with a virtualised firewall
The Dell T330 runs the hypervisor, the storage and OPNsense as a VM; no cluster and no bastion host for now.
First server in service, first audit
The T330 is running, and so is the firewall; an audit of what exists sets the priorities before adding services.
ADR 0003: OPNsense on a dedicated box, in the DMZ behind the Freebox Pop
The Freebox stays in router mode; a dedicated OPNsense mini-PC receives all inbound traffic in the DMZ.
Network
Zoning, firewalls and filtering principles (public version, without addressing).