Skip to content

Networking

Covers the full network setup for what I use — firewall, VLANs, DNS, reverse proxy, and remote access. Built on OPNsense (26.7) with TP-Link Omada switching and a layered DNS stack. Nothing inbound is opened on the firewall: remote access goes out through a Cloudflare tunnel to NPM, with Tailscale as the independent second way in.

  • OPNsense OPNsense

    DNS stack, VLANs, AdGuard Home, Tailscale, and macvlan configuration.

  • Nginx Proxy Manager NGINX Proxy Manager

    The one reverse proxy for everything: LAN names on a private CA, and the target of the Cloudflare tunnel.

  • Cloudflare Cloudflare

    Remote access without port forwarding: one tunnel to NPM behind Cloudflare Access.

  • TP-Link Omada

    TP-Link Omada controller for managing switches and access points.

  • Pi-hole Pi-hole

    DNS-based ad blocker. Superseded by AdGuard Home — kept for reference.

  • Tailscale Tailscale

    Tailscale on the servers (client setup, exit nodes, ACLs). Tailscale on the firewall (tailnet DNS, exit node) is under OPNsense.