https://julien.merieau.ch/tags/unbound/Recent content in Unbound on Julien MérieauHugoen-gbTue, 25 Aug 2026 14:57:33 +0200https://julien.merieau.ch/posts/2025/01/seral-part.-1c-basic-opnsense-configuration/Sat, 25 Jan 2025 00:00:00 +0000https://julien.merieau.ch/posts/2025/01/seral-part.-1c-basic-opnsense-configuration/<aside class="prereq"> <p class="prereq-label">Prerequisites</p> <ul> <li>OPNsense installed and reachable at <a href="http://10.66.10.1">http://10.66.10.1</a> — <a href="https://julien.merieau.ch/posts/2025/01/seral-part.-1a-opnsense-router-1-10-gbps/">1–10 Gbps</a> or <a href="https://julien.merieau.ch/posts/2025/01/seral-part.-1b-opnsense-router-25-gbps/">25 Gbps</a></li> <li>You know which NIC is LAN (<code>igb0</code> on the m720q, <code>igc0</code> on the 25 Gbps box)</li> </ul> </aside> <p>Do you know what <strong>VLANs</strong> are?<br> No???</p> <p><img src="https://julien.merieau.ch/images/seral-1c/oh_merde.gif" alt="Philippe Etchebest saying oh merde — time to learn VLANs" loading="lazy"> </p> <p>Never too late: <strong><a href="https://www.guru99.com/vlan-definition-types-advantages.html">quick refresher</a></strong>.</p> <h2 id="network-plan">Network plan</h2> <p>Segment the LAN so uses stay isolated and blast radius stays small. Five VLANs:</p> <ul> <li><strong>VLAN_Guests</strong> — fully isolated: no talk to other VLANs, <strong>internet via VPN only</strong>. Useful when people visit.</li> <li><strong>VLAN_Admin</strong> — containers, VMs, hypervisor services. A private cloud, basically.</li> <li><strong>VLAN_Secure</strong> — same idea as guests, with extra distrust. Do not mix risky devices with the rest.</li> <li><strong>VLAN_Personal</strong> — PCs, consoles, phones.</li> <li><strong>VLAN_IOT</strong> — IoT. By default they talk neither to each other nor to the internet.</li> </ul> <p>Copy this and adapt the tags if you want:</p>