Well. The segmentation is to avoid security holes from Rogue third party devices. If you can access my pc vlan that only exists on my wired pcconnection, then you have indeed broken in to my domain. Letting the things that doesn’t give a shit about security have their own network is just sanity/sanitary.
I mean. Someone will have to maintain the same kind of infrastructure that visa and mastercard does. It would require a monumental amount of investment. Not to mention that it can, under no circumstances, go down during peak use.
I think the packets take one way in, and get routed a different way out.
It looks incredibly convoluted. My best guess is that traffic hits 172.168.1.254 and gets routed out on the internet and doesn’t pass the dmz.
Then i assume there is something wrong in the routes from your lan when returning traffic that got initiated through the internet opnsense. If you can see traffic hit the LAN network, all should be well on the way in.
Perhaps some sessions on the way time out due to low TTL. I’ve experienced drops of traffic when there are too many hops.
Its possible, depending on how you’ve setup your NAT, that the traffic cant return due to coming from a public ip.
Why do you have public ip-span configured as LAN?
AIO coolers aren’t worth it imo. Stay clear of the H-series AIO from Corsair, none of my friends have had proper performing cooling from them.
If I had to choose cooler right now it would be “Thermalright peerless assassin”
Secondly, i would spend a little extra for a cpu with x3d.
Or an arch character where you have to input 10 commands in order to perform a single attack.
Sorry about my confused rambling 😅 Yes, the example was to demonstrate the difference between subnetting and vlan. Albeit simplified. What you said is right.
The poster i was responding to equated subnetting to vlans. I might have misunderstood what they meant though. It sounded like they wanted to use the same subnet per vlan, which wont work if you want them routed in the same gateway.
Reading it again they make it sound like you can’t subnet all of these networks on a switch without vlan, which you definitely can. I could for example connect 4 different devices on the subnet 192 168.10.x/24 and have them reach each other. I could also connect 4 more devices in the same switch but on a different network 192.168.20.x/24 and it would work.
You can’t use the same subnet on different vlans if you ever intend for both of them to reach the internet. In that case you’d need a second router which just defeats the purpose
It has to do with link priority on the server. You’d imagine that a server that receives a packet that has a return address on the same subnet as it self logically would use that interface instead.
A similar thing happens in switches. For example if you have two vlans on a switch and both vlans have an ip assigned, connect a computer to one of the vlans. You will only be able to reach the switch on the non-routed connection. Even if you also are allowed to reach the second vlan through a router/Firewall.
My guess is that the server receives the packet from the client with src .11.101 dst .10.102 and tries to respond over the interface that has .11.102 assigned. The client expects a response from src .10.102 and drops the packet. But I would turn on a packet sniffer in the gateway to see if the returning traffic even passes the Firewall in scenario 1.
Reset the AP to make sure it uses dhcp for its own ip and update firmware from unifi network after adopting the AP again.
Test it by swapping places of the access points to find out if the issue is related to the access points or something else.
OpenVPN connect on both. I load the .ovpn-file that is exported from the server and that’s it.
Personally I would have gone for OpenVPN access server on Debian. Fairly simple and well documented for those starting out.
I have used and worked with OpenVPN connect on android, PC and Mac.
By making a bridge in the opensense interfaces you have created a layer2 network. This means that all the devices connected on that network are broadcasting their Mac addresses and are added to the ARP table on the opensense. Since they all are on the same physical network and the same subnet, none of the traffic will ever hit the layer 3 rules on your opensense.
If you want opensense to handle the rules of the traffic you will need to put the devices on different subnets and separate clans. Create a gateway address for every vlan on the opensense and point your devices to the opensense as their gateway.
It also comes with a dyndns-client built in. Very useful for updating the address of the OpenVPN server.
Soft rules have never applied to the internet.
Things that you wouldn’t do afk, just because “those are the rules”, doesn’t apply when every empathy damaged person in the world with an internet connection can break them.