Before you start

Why Networks, on the tour

What you will have#

At the end of this guide: an OpenBSD firewall with eight separated networks, DHCP and DNS for all of them, a default-deny policy where every rule is named in the logs, and every connection to the internet going through a WireGuard VPN that fails closed. Two networks, for a game console and for guests, go straight out by exception.

The other guides build on it. The Cluster and SIEM guide adds the Raspberry Pi boards, the Kubernetes cluster, and the SIEM that collects the firewall's logs and raises alerts; the Access point guide adds the Wi-Fi.

Hardware#

• A small PC with several network ports, supported by OpenBSD. This one is a fanless mini PC with an Intel N100, 8 GB of RAM, a 128 GB NVMe drive and six Intel 2.5 GbE ports, which OpenBSD calls igc0 to igc5. Two ports are enough to start; more ports mean fewer VLANs.
• A USB stick for the installer, and a screen and keyboard for the firewall until SSH works.
• A Wi-Fi access point that supports VLANs, for the Wi-Fi networks (the Access point guide).
• For the cluster and the SIEM (the Cluster and SIEM guide): a DeskPi Super6c with six Raspberry Pi CM5 boards, and an NVMe drive.
• A VPN subscription that supports WireGuard and gives you the details to configure it yourself: a server's public key and address, your tunnel address, and ideally a DNS server inside the tunnel. Most providers do.

The networks#

Each network has its own port or VLAN, and its own /24. The firewall is always .1.

Within each network: .2 to .9 for infrastructure, .10 to .149 for fixed addresses, and .150 to .199 for a DHCP pool, only on networks that need one.

How to read the guide#

• Boxes with a file name are complete files: download or copy them from the box. The name is where the file goes: a path on the firewall, or, marked repository, a path in your Git repository, which the Cluster and SIEM guide sets up.
• Saving a file from a box? Create its folder first (mkdir -p with the path from the box title). Copying with the box's Copy button into a file you create yourself keeps the exact name. If you download instead, the browser drops a leading dot (.sops.yaml arrives as sops.yaml) and saves a second file with the same name as kustomization (1).yaml: rename it to the path in the box title.
• Boxes marked with a place, such as firewall, laptop or k8s-cp1, are commands to run there, as your admin user. On the firewall, commands that need root start with doas.
• Pasting several lines that use doas? Run doas true first. If doas asks for your password in the middle of a pasted block, the next pasted line is taken as the password, and that command is lost.
• Boxes marked "Check" prove the step worked. Do not move on until the check matches.
• The local domain is internal, and the firewall is fw.internal.

Placeholders#

A few values are different for everyone, or private. They appear in the files as @NAME@, highlighted, and the firewall refuses the file until each one is replaced.

What you will probably change#

• Interface names, if your ports are not igc. Run ifconfig on the firewall to see yours.
• The tables at the top of pf.conf: which addresses are admin hosts, where the cluster, controller, media player and Home Assistant live. Rules for things you do not have can simply be deleted.
• Device names and fixed addresses in dhcpd.conf and unbound.conf.

Using these files#

The configuration files are free to use for any purpose (0BSD). The text is CC BY 4.0.

This is how one home network is built. Test changes on your own network before relying on them.