Rework Hub & Spoke Example

mauritz.uphoff commented

2026-07-22 12:10:02 +00:00

Owner

The Hub & Spoke example (https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/src/branch/main/examples/opnsense-hub-and-spoke) needs to be reworked.

Changes required:

Remove the static route defined at
examples/opnsense-hub-and-spoke/001-hub-project/030-network.tf
Line 43 in eaa194f
resource "stackit_routing_table_route" "fw_network_wan" {
this is not needed in the current design.
Remove the route defined at
examples/opnsense-hub-and-spoke/001-hub-project/030-network.tf
Line 29 in eaa194f
resource "stackit_routing_table_route" "fw_network" {
as well, unless a VM is deployed into the Hub Firewall's LAN network. In this use case, routes are set at the spoke project level instead.

Documentation:

Create documentation covering the initial OPNsense setup, including interface configuration and Management UI setup.
Ideally, also provide Ansible automation for the OPNsense setup, optionally including Squid proxy configuration (for host whitelisting) and basic firewall rules.
Document that OPNsense HA mode is currently not supported due to platform restrictions, and that we are waiting for an L3 Load Balancer to enable a load balancer sandwich topology.

The Hub & Spoke example (https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/src/branch/main/examples/opnsense-hub-and-spoke) needs to be reworked. Changes required: - Remove the static route defined at https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/src/commit/eaa194f54bed279c80684f814b7500481f9952d8/examples/opnsense-hub-and-spoke/001-hub-project/030-network.tf#L43 this is not needed in the current design. - Remove the route defined at https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/src/commit/eaa194f54bed279c80684f814b7500481f9952d8/examples/opnsense-hub-and-spoke/001-hub-project/030-network.tf#L29 as well, unless a VM is deployed into the Hub Firewall's LAN network. In this use case, routes are set at the spoke project level instead. Documentation: - Create documentation covering the initial OPNsense setup, including interface configuration and Management UI setup. - Ideally, also provide Ansible automation for the OPNsense setup, optionally including Squid proxy configuration (for host whitelisting) and basic firewall rules. - Document that OPNsense HA mode is currently not supported due to platform restrictions, and that we are waiting for an L3 Load Balancer to enable a load balancer sandwich topology.

sven.schmidt was assigned by mauritz.uphoff

2026-07-22 12:10:17 +00:00

sven.schmidt added the due date 2026-07-28

2026-07-22 12:20:29 +00:00

marc.adrian commented

2026-07-23 07:26:29 +00:00

Owner

@sven.schmidt as discussed. The following issues needs to be addressed as well:

(docs) Documentation about setting up the Mgmt Interface
(fix) Currently there is no known way to pass Mgmt Access via Public IP to WebUI. (Public Client IP -> Public IP Mgmt NIC -> Mgmt IP) Outbound it routes via Default Route (WAN) -> No Connection possible
- Temp fix: Set default route to Mgmt GW and navigate through WebUI
- Tested several rule sets (e.g. rules[new] and rules) including setting a rule for 443 with Gateway or reply-to -> Both not working
- Tested priority changes of gateways -> not working

@sven.schmidt as discussed. The following issues needs to be addressed as well: - (docs) Documentation about setting up the Mgmt Interface - (fix) Currently there is no known way to pass Mgmt Access via Public IP to WebUI. (Public Client IP -> Public IP Mgmt NIC -> Mgmt IP) Outbound it routes via Default Route (WAN) -> No Connection possible - Temp fix: Set default route to Mgmt GW and navigate through WebUI - Tested several rule sets (e.g. rules[new] and rules) including setting a rule for 443 with Gateway or reply-to -> Both not working - Tested priority changes of gateways -> not working

sven.schmidt referenced this issue

2026-07-23 12:44:39 +00:00

OPNsense Mgmt Interface: Public WebUI Access Not Working #52

marc.adrian referenced this issue

2026-07-24 13:15:44 +00:00

OPNsense Mgmt Interface: Public WebUI Access Not Working #52

sven.schmidt commented

2026-07-27 10:47:20 +00:00

Owner

The issue described above was investigated and resolved in #52.

As part of this rework, the README should be updated to document the identified root cause and the validated configuration for public WebUI access through the dedicated MGMT interface, including the required return path via the MGMT gateway.

It also has to be evaluated whether this configuration can be standardized and deployed reproducibly through Ansible as part of the OPNsense IaC setup.

The issue described above was investigated and resolved in #52. As part of this rework, the README should be updated to document the identified root cause and the validated configuration for public WebUI access through the dedicated MGMT interface, including the required return path via the MGMT gateway. It also has to be evaluated whether this configuration can be standardized and deployed reproducibly through Ansible as part of the OPNsense IaC setup.

sven.schmidt modified the due date from 2026-07-28 to 2026-08-04

2026-07-28 10:57:17 +00:00

sven.schmidt commented

2026-07-28 10:57:56 +00:00

Owner

Moved the due date due to higher-priority topics

sven.schmidt referenced this issue from a pull request that will close it,

2026-08-04 06:31:50 +00:00

refactor(opnsense) #57

sven.schmidt commented

2026-08-04 06:33:47 +00:00

Owner

Resolved via #52: static routes removed from the hub and moved to the spoke level, all subnets switched to /24, firewall interfaces standardized (named, x.x.x.100), plus initial-setup/webui-access/limitations/mgmt-standardization docs added.

sven.schmidt closed this issue

2026-08-04 06:33:47 +00:00

Rows
Columns

Rework Hub & Spoke Example #51