professional-service-best-practices/terraform-deployment-opnsense
22
0
Fork 0
generated from professional-service-best-practices/best-practice-template
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Deploy a OPNsense Firewall on STACKIT
10 commits 1 branch 0 tags 54 KiB
  • HCL 100%
Find a file
Exact
markus.brunsch c4f28a5a99
All checks were successful
CI / Check License Header (push) Successful in 3s
Details
CI / TruffleHog Secrets Scan (push) Successful in 5s
Details
CI / Terraform CI (push) Successful in 8s
Details
added image file
2026-07-27 08:33:46 +00:00
.forgejo Update .forgejo/workflows/default-ci.yaml 2026-07-27 08:32:27 +00:00
.gitignore Initial commit 2026-06-23 13:58:11 +00:00
.terraform-version Initial commit 2026-06-23 13:58:11 +00:00
.terraform.lock.hcl Initial commit 2026-06-23 13:58:11 +00:00
00-provider.tf init 2026-06-23 16:06:55 +02:00
01-config.tf init 2026-06-23 16:06:55 +02:00
02-opnsense-image.tf init 2026-06-23 16:06:55 +02:00
03-opnsense-network.tf init 2026-06-23 16:06:55 +02:00
04-opnsense-appliance.tf init 2026-06-23 16:06:55 +02:00
CHANGELOG.md Initial commit 2026-06-23 13:58:11 +00:00
LICENSE init 2026-06-23 16:06:55 +02:00
MAINTAINERS.md init 2026-06-23 16:06:55 +02:00
opnsense.qcow2 added image file 2026-07-27 08:33:46 +00:00
README.md Update README.md 2026-07-27 08:29:40 +00:00

README.md

OPNsense Terraform Deployment

Terraform script to deploy an OPNsense firewall into STACKIT Cloud.

Deployment overview:

The Terraform deployment consists of:

  • WAN Network
  • LAN Network
  • pfSense firewall VM + disk volume
  • FloatingIP for firewall VM
  • deactivating port security on firewall ports

Default Configuration

Interfaces

  1. vtnet0 WAN
  2. vtnet1 LAN

NAT

Masqurade (Outbound NAT) Traffic from LAN to WAN

Password

Set default password for admin to STACKIT123!

Interface Access

Disabled Referer-Check Enable allow all wan adresses to connect to the WebUI

Now you can enter the WebUI via the FloatingIP on port 443 the default login is admin:STACKIT123!

How to Use

Requirements:

  • Terraform installed
  • Access to a STACKIT project
  • STACKIT Service Account Key

Follow these steps to implement the template:

  1. Clone the repository:

    git clone https://professional-service.git.onstackit.cloud/professional-service-best-practices/terraform-deployment-opnsense
cd terraform-deployment-opnsense

  2. Configure the variables:

    • Create a 01-config.tf file or set environment variables as described in the Configuration section below.

  3. Create & Save a STACKIT Service Account Token and place it in the secrets.json file.

  4. Initialize and apply:

    terraform init
terraform plan
terraform apply

Configuration

The following variables can be configured.

Variable Name Description Type Default Value Required
project_id The STACKIT project ID. string null Yes
region The region where resources will be created. string eu01 No
zone The STACKIT Availability Zone string eu01-3 No
flavor Intel Gen3 Flavor c3i.2 string c3i.2 No