Review same-bridge and same-VLAN lateral filtering #8

New issue

Open

opened 2026-08-23 17:07:49 +00:00 by stanta · 0 comments

stanta commented

2026-08-23 17:07:49 +00:00

Owner

Outcome

Define and enforce lateral filtering where guests can bypass OPNsense on the same bridge or VLAN.

Current state

Traffic between guests on one Proxmox bridge can avoid OPNsense. Current isolation depends on PVE or guest firewalls.

Work

Inventory same-bridge and same-VLAN trust boundaries.
Identify paths that need isolation.
Choose PVE or guest firewall ownership for each path.
Apply and test only approved controls.

Validation

Required service paths still work.
Selected lateral paths are blocked.
Recovery access remains available.

References

AGENTS.md
iac/DEDICATED-SERVER.md
iac/guides/roadmap-phase-2.md

## Outcome Define and enforce lateral filtering where guests can bypass OPNsense on the same bridge or VLAN. ## Current state Traffic between guests on one Proxmox bridge can avoid OPNsense. Current isolation depends on PVE or guest firewalls. ## Work - [ ] Inventory same-bridge and same-VLAN trust boundaries. - [ ] Identify paths that need isolation. - [ ] Choose PVE or guest firewall ownership for each path. - [ ] Apply and test only approved controls. ## Validation - [ ] Required service paths still work. - [ ] Selected lateral paths are blocked. - [ ] Recovery access remains available. ## References - `AGENTS.md` - `iac/DEDICATED-SERVER.md` - `iac/guides/roadmap-phase-2.md`

stanta added the

labels

2026-08-23 17:07:49 +00:00