2.4 Management server (P1)

In this step, we’ll provision the Mgmt-server VM in PVE. We’ll fully explain its purpose and configure it later in Module 3, but creating it now gives us a dedicated administrative workstation—with console and network access—from there, you’ll access the OPNsense web UI to complete and finalize the configuration.

2.4.1 Deploy Mgmt-server

1. Clone the 900 Template-Debian template and provision your first VM: Right-click the template ➜ Clone. In the dialog, set:

   • VM ID: 200

   • Name: Mgmt-server

   • Mode: Full Clone

   
   

2. After the clone has been created, modify the following VM settings in your virtualization platform. For Proxmox:

   • Increase VM memory: Memory ➜ Memory (MiB): 4096

   • Increase disk size: Hard Disk (scsi0) ➜ Disk Action ➜ Resize, enter the number of GiB to increase by (recommended minimum total size: 80 GiB).

   • Temporally change the network bridge to vmbr10 (we’ll switch it to vmbr30 later to place this system in the management network): Network Device (net0) ➜ Bridge: vmbr10

   
   

3. Start the Mgmt-server VM and login as root.

   
   

4. Change this VM’s hostname to:

   hostnamectl set-hostname mgmt-server
   sed -i 's/\btemplate-debian\b/mgmt-server/g' /etc/hosts

   
   

5. Install additional software on the Mgmt-server, such as Git and xRDP:

   sudo apt update
   sudo apt install -y xrdp git default-jre-headless
   sudo systemctl enable --now xrdp

   
   

6. Copy the SSH key pair generated in Section 2.2.2 (both the public and private keys) to the /root/.sshand /home/rte/.ssh directories on the Mgmt-server (you may delete the SSH keys from your local machine afterwards).

2.4.2 Configure OPNsense part 2

1. From the Mgmt-server, open a browser, and sign in to the OPNsense web GUI at https://10.10.10.1. Run the setup wizard and follow the prompts.

   Important: During the initial configuration, uncheck Block RFC1918 Private Networks on the WAN interface. You can keep most settings at their defaults, or adjust them based on your existing configuration. If you already changed the root password, you can skip that step.

   
   

2. Check for updates and install them if any are available.

   
   

3. Rename interfaces for clarity: go to Interfaces, select the interface (e.g., LAN), enter the naming convention below in the Description field, then click Save and Apply Changes.

   • LAN = CLIENTS_NET

   • OPT1 = SENSITIVE_NET

   • OPT2 = MGMT_NET

   
   

4. Verify DNS service: Services ➜ Unbound DNS ➜ General and verify if Unbound is enabled for All (recommended) network interfaces.

   
   

5. Set and verify the DHCP configuration. Go to Services → Dnsmasq DNS & DHCP → General and select the CLIENT_NET, MGMT_NET, and SENSITIVE_NET interfaces.

   Then go to Services → Dnsmasq DNS & DHCP → DHCP ranges and verify that each network has the correct DHCP start and end addresses configured.

   • CLIENTS_NET: 10.10.10.10 - 10.10.10.100

   • SENSITIVE_NET: 10.10.20.10 - 10.10.20.250

   • MGMT_NET: 10.10.99.10 - 10.10.99.100