Skip to content

Migrated from ADR-0004 on 2026-05-02 per ADR-0047. This source file is retained as a reference; the canonical content is in PLAT-0001.

PLAT-0001 — OPNsense as KVM VM (not Docker)

Field Value
Status Accepted
Date 2026-03-31
Author Ben Peries
Sources ADR-0004

Context

The platform requires a NGFW to implement DMZ segmentation. OPNsense was chosen as the NGFW software. The primary compute host is caneast-site1-node3 (CanEast Server) with KVM virtualization and USB NICs.

Decision

OPNsense runs as a KVM VM (caneast-site1-fw1) on caneast-site1-node3. Not Docker.

Interface mapping: - WAN: lan-bridge → REDACTED - LAN: dmz-bridge-0 → REDACTED - MGT: dmz-bridge-1 → REDACTED - ICT: dmz-bridge-2 → REDACTED

Web GUI restricted to LAN and MGT interfaces only.

Alternatives Considered

Docker container (macvlan) — macvlan networking is incompatible with USB NICs. The USB NIC driver does not support promiscuous mode, which macvlan requires. No production-grade Docker image exists for OPNsense. This path was attempted and abandoned.

pfSense — Technically viable but OPNsense has better community support and more frequent updates.

nftables + Suricata (DIY) — No management GUI, no plugin ecosystem, significant operational overhead.

Consequences

  • caneast-site1-node3 is now dual-role: KVM host and firewall host
  • ISP gateway DMZ pointed to REDACTED — firewall rules must be configured before activating
  • Jump box VM (caneast-site1-jmp1) required for management access to DMZ-segmented nodes

References

  • IAM-0001 — Infisical on caneast-site1-node3 (caneast-site1-node3 criticality accumulation)
  • Network bridge design: lan-bridge, dmz-bridge-0, dmz-bridge-1, dmz-bridge-2