Opnsense on trustserv.de

Homelab Rebuild Part 8: Running My Own Certificate Authority

Mon, 17 Aug 2026 11:30:00 +0200

The annoyance Link to heading

Every internal service with a web interface greets you with a certificate warning. Firewall, NAS, backup server, access point — same picture everywhere, one click to dismiss each time.

It isn’t just tedious. It trains you to click warnings away, and eventually you’ll dismiss one that mattered. Exactly the reflex you don’t want to build.

The fix is your own certificate authority. One root certificate installed on your devices, and from then on the browser trusts everything issued by it.

Homelab Rebuild Part 5: The First VLAN

Sat, 15 Aug 2026 20:40:00 +0200

Why telephony of all things Link to heading

After part 4 everything is in place: a firewall that can enforce rules, and a host for services. Now comes the first VLAN of my own — and I deliberately started with the case where the least can go wrong.

If the landline dies, it doesn’t matter. I have a Swiss phone and a German phone. A networking experiment whose worst outcome is that one handset doesn’t ring is the ideal first test. That was the selection logic: not the most important service first, the most harmless one.

Homelab Rebuild Part 3: Sliding the Firewall In

Sat, 15 Aug 2026 20:00:00 +0200

The awkward part Link to heading

The hardware from part 2 was sitting on the desk. The network kept running. And that’s exactly the uncomfortable spot: the uplink isn’t my hobby project, it’s the way to the internet. If I break it, it’s broken.

So the task wasn’t “set up OPNsense”, it was “set up OPNsense without hours of downtime in between”.

Prepare before it counts Link to heading

The first step had nothing to do with the network: the firewall got assembled in my room, hooked up to the workstation, and fully configured. LAN on 10.0.1.1, DHCP set up, base rules in place, everything clicked through.

Homelab Rebuild Part 2: Hardware for the Firewall

Sat, 15 Aug 2026 19:28:21 +0200

The question Link to heading

Part 1 settled what I wanted: a dedicated firewall to take over routing, so the Banana Pi R4 could become a pure switch and access point. What wasn’t settled was the hardware.

My requirement sounded simple at first. Init7 gives me symmetric 10 Gbit here, at the same price as 1 Gbit. If I’m buying a box anyway, it should pass as much of that through as possible. On top of that I wanted to try deep packet inspection — mostly because companies run it and I want to understand how it behaves.