Dutch is not a serious language. Or so I hear …

My boss designed a whole decomm system with wait periods and shit built into an app.
He still tells me, “You can just shut that down and delete it”.
I don’t. I make that jerk use his own system. “Put in a decomm, and I’ll take care of it.”

We left that shit running and blocked it with ACLs on the switch.
The guests are kinda black-box stuff to us. Don’t want to mess with em.

In this case, all we did was disable some ACLs. The machines are still running.
But ya. The point is to preserve whatever is actually needed. So don’t nuke it before they can scream.

Ya man. Google it. I’m not that creative. Did not make it up.

Wow. I really hate reposts and cross-posts, and I block the accounts that make them.
I sort of thought I was alone in that, figured other people must enjoy that crap.
I am amazed to see my exact viewpoint expressed here a couple hundred times over.

As to the point the post makes, I’m new to moderation, and I read the post because that seemed like a subject I should review.
The post looks like useless hand wringing to me.

I don’t see anything worth concern with lemmy moderation.
I’ve pissed off a couple mods in my time on lemmy and gotten banned. Every one of them was a community I have disagreements with, and its fine that we don’t talk.
I don’t feel I have ever been treated unfairly. In fact, the only mod action I ever disagreed with on lemmy was reversed after I discussed it with him on YPTB.

Cool. Yes, this looks reasonable. It looks logical.

So, my main recommendation is consider the use of virtual bridges to manage the network instead of passthrough. And I recommend installing and using the OVS style virtual bridge.
https://pve.proxmox.com/wiki/Open_vSwitch

This gives you flexibility going forward. Say you want to run something out in the DMZ instead of behind the firewall, well you just attach that VM to the DMZ bridge instead. And it gives you an easy way to provision network for VMs. You just attach them to the LAN bridge.

(RoaS is a terrible name. Router on a Stick. It means your router is on the same switch as its clients, and all the communications go up and down that one port. It’s a perfectly legit way to manage a network, but sorta ugly and not what you are doing with your fancy 3-port rig. :)

I own 2 OpenWRT routers. Fun little things. Love em.
But running a virtual firewall is a perfectly reasonable goal. OpenWRT doesn’t have the feature set that OPNsense has.
They are not the same sort of product. Lot of common ground, but not the same thing.

There’s a few things we don’t know here.

• Are you hosting more VMs on Proxmox that need network via a virtual switch?
• Are you providing network to other physical devices as well via a switch, so you need to output to that?
• Do you want OPNsense to be your gateway and assign IPs, or do you have a router?
• As you have 3 NICs and sound like you want to use them, let’s assume you aren’t doing RoaS, but this could all be done on one (very busy) NIC.

There’s nothing wrong with your plan, but that’s not how I would do it.
I don’t pass through NICs. I bond them or I bridge them.
In a virtual world, this sort of task is done with virtual switches. OVS switches at my job.
OVS is a lot easier to use than oldskool linux bridges that come installed with Proxmox. There’s already a dropdown in Network where you can build with OVS objects, but you need to add the package.
apt install openvswitch-switch

• MGT. For your setup, I might consider (the onboard!) eth3 as my mgt NIC. That might be handy some day if you have to remove that card. Your server will still be online.

• DMZ WAN. I would run the WAN line straight to eth1. Add eth1 to a ‘dmz’ virtual switch. Add the OPNsense WAN leg to this dmz virtual switch, so the OPNsense (and nothing else) can directly talk to the upstream router.

• LAN Virtual. Create a ‘protected network’ virtual switch. Add the OPNsense LAN leg to this virtual switch. VMs can be a member of this downstream protected network and access any services provided by the OPNsense.

• LAN Local. If you need to share the OPNsense protected network back out to other devices, add eth2 to to the protected network switch, and ethernet cable out from eth2 to a dumb switch. Plug other external devices into the dumb switch, and they will be downstream from and protected by your OPNsense, accessing its services.

Feel free to ignore me here. I build a lot of big things, so I use enterprise-scale techniques. There’s nothing wrong with your pass-through plan.
And … you can do this! I have a somewhat similar setup on my laptop with HyperV, so I can distribute wired (work VPN) and wireless (everything else) internet to guest VMs and the main OS. I made two virtual switches in HyperV.

• The first switch gets exclusive access to my NIC attached to my VPN device. This is the OPNsense WAN leg.
• The second switch is the OPNsense LAN leg and VMs are members.

Good luck!

I think because I got into NextCloud to “de-google”, I just accepted some maintenance load.
My intent was to manage my documents. The CORE office suite works sufficiently. Now I update my resume (and manage a few other documents) on my own website, no google.
I uploaded a bunch of music. The music apps are kinda crappy, but they also work sufficiently.
I never got around to setting up email for NextCloud. Looks like maybe I never will.
My searxng instance in my homelab died, and I nuked it. I think when I rebuild, its going on this VPC.

I see NextCloud here quite a bit. What I don’t see discussed is the cloud hosting option.
Hetzner has two NextCloud offerings.
They have a storage service backed by NextCloud. I think that’s new. I don’t use that.

They also have have NextCloud available as an installable app from their service.
This is what I use. https://docs.hetzner.com/cloud/apps/list/nextcloud/
I had to actually follow the directions to get it running.
And I have to patch it occasionally. Mostly, it takes care of itself.

I use the cheapest 1vcpu VPC.
Yes my NextCloud service is a bit sluggish sometimes. But I’m paying like $6/month.
I’m pretty happy with it for storing music and updating my resume.
Maybe if I had the more demanding use cases like some commenters, I might not like it so much.

Over and over its the same story. AI makes everything dumber.

I will try that! Actually, I’ve accidentally done that shit in Prod. I connected our 10g and our 1g networks with a virtual switch in a Proxmox server. I undid it shortly after that, but it caused a network storm that impacted customers in 2 datacenters.

Everyone had Doom, because it was shareware. You could play the first 7 levels or some shit for free. Given that most people died well before that, it was a pretty good deal. Doom was on every computer.
Much respect to your old man passing the torch. Game on, friend.

Fiber is unidirectional. The long run shit has two cables, for up and down. The graphic was supposed to show one of those two cables being cut. (I don’t think it shows that very well.)

Ya it came from an exercise about STP Loop Guard. Cool.

Thanks! I’m about 2/3 the way through my CCNA. Just passed the CCST Network and Cybersecurity. Finished something called Cisco Meraki Engineer or some such shit today. I’m considering doing testing for Cisco Meraki Solutions Specialist later, as it appears I’ve covered all those topics, but the CCNA is my real goal. Mostly, I need to learn mgt protocols now, OSPF and BGP. I’m workin my ass off.

Did you do any old Classic Mac gaming? Do you remember Pathways Into Darkness?
I don’t think it had mouselook. It was all keys. Damned difficult game that I finished right as I was becoming a mouser on other more modern games.

That’s a fuken UNIT. Cool!

Well, I’m pretty sure it left us in a yard sale when we moved out of state.
By then I was all about my TI 99/4a. Rockin my tape drive. Writing my first games in line-number BASIC.