Thanks for letting me know! Glad it worked out in the end...
Yes my OPNsense guides need a bit of a re-write and more logical structure I think; I've received a lot of great feedback on them I need to incorporate.
Enjoy your new firewall ;)
If you knew what was under the hood you would not say it's "just" customized nginx... It's more like customised, optimized and simplified.
It has many enhancements builtin like automatic certificate generation and renewal, fail2ban, prebuilt optimized configs, and easily enhanced security with crowdsec and even geofencing.
But made way easier than doing that separately with raw NGINX.
It's much more friendly to pickup and run with then raw NGINX.
It can be done, just carefully. You can definitely accidentally block yourself out if you set a firewall rule up incorrectly, or in higher precedence of order for example. OPNsense (like almost every firewall known) processes rules in a "top down" order. So you put your blocks at the bottom!!!
Reverse proxy won't lock you out, essentially that's just slapping HTTPS on a webserver/service like Jellyfin, so you can access it without requiring a VPN.
Here's a reverse proxy explainer, pt 2 is the actual setup!
No worries, hope it helps, let me know if you have questions =)
Never heard of Rayfish but just googled, it's a mesh VPN so probably wouldn't want to push that through a reverse proxy to authelia, it would just slow it down....
I personally use wireguard as my VPN, not tailscale or headscale or any of that but I do understand some people need something that can get around CGNAT or other issues.
What you could try is an inverse sense of match rule, which by default, allows access to the internet but not to other VLANs. This is what I do and is the standard I think that should be the default!
If you read the LAN rules at the link there, it basically has you setup RFC1918 IP space as an alias, and then setup an inverse option the logic is:
Anything that is NOT Private IP space - ALLOW!
So outbound from that vlan/network/subnet to internet --> Allowed!
Then you make separate rules to actually allow whichever VLAN access to the other, that you want.
Thank you for taking a peek!
Let me know if there's something you're looking for. The search function isn't to bad but sometimes the posts can get buried a bit ;)
Oh hello there fellow Canadian blogger! I'm just down the road from you in between Toronto and Montreal (right in the middle actually!)...
I run a tech blog as well, but different focus than yours mostly on c omplete self-hosting, infrastructure and cybersecurity, and media servers.
**We should make some backlinks at some point! **
PS> This site is built off Ghost CMS.
This may help as well, and bridges the gap for some with all the changes from v25.x to v26.x.
Core Lab OPNsense upgrade guide
Your rule looks correct at first glance, but I'll take a peek further. You do need a DHCP pool setup PER VLAN though, so there's that as well.
I use SWAG reverse proxy for this, with Cloudflare for DNS.
Anything that I publicly expose, I have protected with multiple layers up and down my entire stack...
I'm late to the party, but feel my guides can help. I am biased towards them because I wrote them! ;)
It's up to date for v26.x with OPN, that said these guides (3 part series) do need a bit of an overhaul but it does cover VLANs, LAGG/Trunks, DNSmasque and DHCP for each VLAN, with pictures etc...
Yeop, this is the way, the only way to try and retain some semblance of privacy other than not using social media, or a smart phone for that matter!
Step-by-step guide here for the uninitiated on setting up docker compose.
Oh this looks interesting, I'll have to gawk at this a bit! Thanks!
Yyeeeaaahhh this is the part I think that will surprise people the most, the bills combined are what makes things unpalatable IMO...
I too want a safer Canada, but at what cost? The metadata collected will be paramount to a complete digital profile, with the Government knowing LITERALLY everything about every citizen. It's too much...
I switched over last night, migration guide here, it's really easy!
Blocking them locally is one way, but if you're already using cloudflare there's a nice way to do it UPSTREAM so it's not eating any of your resources.
You can do geofencing/blocking and bot-blocking via Cloudflare:
https://corelab.tech/cloudflarept2/
It's literally based off the NAS comparison guide I posted... This is like a text book way to move forward for someone. My solution is like a giant all in one+a NAS, but a lllooottt of people have a decoupled solution.
One of the beautiful things about self-hosting; do what you want.
Welcome to the self-hosting trenches. Don't worry about the "burning yourself" part - in this hobby, we consider those "tactical lessons." Everyone has ah, "re-started" things at least a few times!
Actually, your plan isn't "not very smart"—it’s a classic move we call Decoupling Compute from Storage. It is the most future-proof way to build a Digital Fortress. By separating your "Brain" (HP Mini) from your "Vault" (Asustor), you ensure that if one fails, the other stays standing. This is a great move.
Here's how I see your planned setup:
**The Command Center: HP Z2 Mini - Xeon and Proxmox **
The Xeon 1245-v5 is a beast compared to that Celeron. Running Proxmox here is exactly the right call.
The Strategy: Use that M.2 drive for your Proxmox "Data" (the LXCs and VM boot drives). Services like Immich and Navidrome rely on fast databases; running them on an SSD on the Xeon node will make them feel lightning-fast.
The Gear: With 32GB of RAM, this is what I'd call an "Elite Node." You have plenty of head-room to grow.
**
The Vault: Asustor (Celeron N5105) **
TrueNAS SCALE is "Heavy Armor." Running it on a 2-bay Celeron is like putting tank treads on a scout bike - it’s overkill and eats up the limited RAM that Celeron has to offer.
The OS Choice: I’d strongly suggest OpenMediaVault 8 (OMV) for the Asustor. In my 2026 NAS OS Comparison Guide, I categorize OMV as the "Lightweight Tactical" choice. It’s built on Debian 13, is incredibly lean, and is the best way to turn low-power hardware into a rock-solid network drive. You’ve already tasted the freedom of a custom OS. Going back to ADM now will feel like a "vendor-lock-in" cage. OMV is the perfect middle ground...
**
How they talk to each other **
Wipe the Asustor, install OMV, and set up a simple NFS or SMB share. In Proxmox, you "mount" that network share. Your apps on the HP Mini will "see" the Asustor drives as if they were plugged in locally.
Is it a good idea? Yes . If you ever want more drive bays in the future, you just swap out the Asustor "Vault" for something bigger (like a 6-bay DIY build or a UGREEN box), and your HP Mini "Command Center" never even has to go offline.
I recently broke down the "Battle Card" for why OMV is the king of low-power storage nodes in 2026. You might find the comparison table helpful for your specific hardware: NAS OS Comparison
Yeah honestly CBC Gem isn't expensive in the grand scheme of things (Especially if you get the annual sub on sale) and has pretty good Canadian content!
view more:
next ›