Completed
- Selected a Lenovo M90n-1 with an 8th-generation Intel i5, 8 GB RAM, and 256 GB storage.
- Both onboard and USB Ethernet interfaces were detected during setup.
- Installed OPNsense to the internal drive and rebooted without the installer USB.
← Back to Projects
Network Security
Network Segmentation Lab
Building a dedicated OPNsense firewall and a segmented lab while keeping household connectivity on eero.
In DevelopmentProject at a Glance
In Development- Purpose
- Building a dedicated OPNsense firewall and a segmented lab while keeping household connectivity on eero.
- My Role
- Independent lab research, design, and documentation.
- Implementation Status
- OPNsense installation completed; VLAN configuration, access controls, and recovery validation are planned.
- Next Milestone
- Validate isolation, administrative access, adapter reliability, and recovery before publishing results.
Implementation repository: not yet published.
Implementation Status
I have installed OPNsense and confirmed that both Ethernet interfaces are detected. Interface configuration, segmentation, and recovery testing are my next steps.
Planned
- Assign the UGREEN USB Ethernet adapter to WAN and onboard Ethernet to LAN.
- Configure VLANs and access rules using OPNsense and the USW-Lite-8-PoE.
- Validate isolation, administrative access, adapter reliability, and recovery before publishing results.
Proposed Architecture
Upstream: eero Pro 6E
Household devices remain on eero. The lab firewall receives its upstream connection through the USB WAN adapter.
Firewall: Lenovo M90n-1
OPNsense routes and filters lab traffic. Onboard Ethernet carries the proposed LAN VLAN trunk.
Switch: USW-Lite-8-PoE
The managed switch assigns lab devices to VLANs. Connections through this switch are limited to 1 GbE per port.
- Management VLAN — planned
- Applications VLAN — planned
- AI VLAN — planned
- Security test VLAN — planned
The initial design uses double NAT behind eero. Lab access to household devices requires explicit firewall controls; an additional router alone does not establish isolation.
Validation Checklist
All checks are pending. Expected behavior is defined below; measured results and authentic screenshots will be added after testing.
Pending validation
Internet access
A test client receives a lab address, resolves DNS, and reaches an external HTTPS site. Record its address, gateway, and observed result.
Pending validation
Household isolation
Lab clients cannot reach household devices unless an explicit exception permits access. Test both permitted and denied paths.
Pending validation
Cross-VLAN controls
Only documented traffic crosses between lab VLANs. Record source, destination, protocol, expected result, and matching firewall log.
Pending validation
Administrative access
Firewall and switch management are reachable from the designated management network and denied from test networks.
Pending validation
Reboot recovery
After a firewall restart, both interfaces return and the test client regains expected connectivity. Record recovery time.
Pending validation
USB adapter reliability
The WAN adapter remains available during sustained traffic and returns after reconnecting. Record duration, errors, and interruptions.
Pending validation
Configuration recovery
Export a configuration backup and validate restoration during a controlled exercise. Record the recovery procedure and outcome.
Evidence to Publish
Publish sanitized screenshots, the configured topology, a traffic matrix, and a recovery runbook. No throughput, uptime, or security improvement is claimed before measurement.