Add and validate the Reforger guest firewall #26

New issue

Open

opened 2026-08-23 17:07:59 +00:00 by stanta · 0 comments

stanta commented

2026-08-23 17:07:59 +00:00

Owner

Outcome

Limit same-VLAN and host-local access to the Reforger VM while preserving its documented game ports.

Current state

DayZ and Reforger share VLAN 90. Same-VLAN traffic can bypass OPNsense, and the Reforger guest firewall remains pending.

Work

Inventory required Reforger TCP and UDP ports.
Define guest or PVE firewall ownership.
Preserve management and recovery access.
Apply rules in a staged window.
Test public game access and blocked lateral paths.

Validation

Required public game ports work.
Unapproved same-VLAN paths are blocked.
Management and rollback paths pass.

References

iac/DEDICATED-SERVER.md
AGENTS.md

## Outcome Limit same-VLAN and host-local access to the Reforger VM while preserving its documented game ports. ## Current state DayZ and Reforger share VLAN 90. Same-VLAN traffic can bypass OPNsense, and the Reforger guest firewall remains pending. ## Work - [ ] Inventory required Reforger TCP and UDP ports. - [ ] Define guest or PVE firewall ownership. - [ ] Preserve management and recovery access. - [ ] Apply rules in a staged window. - [ ] Test public game access and blocked lateral paths. ## Validation - [ ] Required public game ports work. - [ ] Unapproved same-VLAN paths are blocked. - [ ] Management and rollback paths pass. ## References - `iac/DEDICATED-SERVER.md` - `AGENTS.md`

stanta added the

labels

2026-08-23 17:07:59 +00:00