AZiT

Firewall

An OpenBSD firewall with eight separated networks, a default-deny policy, and a VPN that fails closed.

Needs Nothing else: start here.

  1. 1Before you startHardware, networks, addresses, and how to read the guide.
  2. 2Install OpenBSDA minimal OpenBSD on the firewall, reachable over SSH from the admin laptop, with doas and forwarding.
  3. 3Interfaces and VLANsSSH locked down, one file per network, then online and patched.
  4. 4DHCP, DNS and timeAddresses, names and the clock for every network, from the firewall.
  5. 5pf: default deny, named rulesThe firewall policy, a safe way to load it, and logs that name the rule.
  6. 6WireGuard and the kill switchEvery connection through the tunnel, and nothing at all when it is down.
  7. 7Exceptions: the PS5 and guestsTwo networks leave directly, without weakening the kill switch for the rest.