# OPNsense configuration for the paas VM Applied via the OPNsense UI (or API). Fill in the chosen values during setup — this file is the record of what was configured. ## Chosen values (filled during setup) | Item | Value | |---|---| | Virtual IP (alias) used | `188.40.238.163` (WAN alias, pre-existing) | | paas VM LAN IP | `192.168.13.10` (VM 101 "paas" on prox3.younex.de) | | DNS records to set | `tiera.younex.de A 188.40.238.163` · `deploy.younex.de A 188.40.238.163` | ## NAT port forwards (Firewall → NAT → Port Forward) Two rules, both on the WAN interface, destination = the chosen virtual IP: | Interface | Proto | Dest. address | Dest. port | Redirect target | Redirect port | |---|---|---|---|---|---| | WAN | TCP | `` | 80 | `` | 80 | | WAN | TCP | `` | 443 | `` | 443 | - "Filter rule association: add associated filter rule" (default) so the firewall pass rules are created automatically. - Port 80 must stay open — Caddy uses it for the ACME HTTP-01 challenge and http→https redirects. - UDP 443 (HTTP/3): same 443 rule with protocol UDP — **present since the original setup** ("paas http3", rdr confirmed active in pf). The reason HTTP/3 didn't work until 2026-08-20 was NOT this firewall: ufw on the paas VM only allowed 443/tcp, so QUIC died at the host firewall while Caddy advertised h3 via Alt-Svc on every response. bootstrap.sh now opens 443/udp; verified live with `curl --http3-only` → HTTP/3 200. ## LAN access to the sites (pick one) Clients on the LAN cannot reach the WAN VIP by default. Either: 1. **Split DNS (recommended)** — Services → Unbound DNS → Overrides: host overrides for `tiera.younex.de` and `deploy.younex.de` → ``. 2. **NAT reflection** — enable reflection on the two port-forward rules (Firewall → Settings → Advanced → Reflection for port forwards). ## Not configured (deliberately) - No inbound access to Jenkins (`192.168.12.65`) — Jenkins only makes *outbound* SSH connections to the VM. - No SSH port forward from WAN — SSH to the VM stays LAN-only.