Watched video over Veeam Sire - Clean Room we have just covered a network refresh, Core - Edge Switch - AP but wanted to make use of old HP Switch 2920 with 10gb Gbic to rear this will be my clean room with referb of Arcserve UDP Server refresh install Windows Server 2025. Been looking at options on Firewall OPNsense Connection to both LAN that is Production - Clean Room to opt for Lenovo m720q with riser attached 2 x 10gb ports will configure 10gb Prod - 10gb Clean has any one created firewall rules for such connection or used firewall device to cover on / off question as my build as TrueNAS with NFS share this needs access over both connections. Any solutions to what members have done with such solution. Education secondary 6th form school
Veeam 12 Clean Room Firewall Connection
+4I'd keep production and the clean room on separate VLANs/subnets, with OPNsense as the only routed path between them. The HP 2920 can handle switching, but don't let it route around the firewall.
Start with default deny between the networks. Check for an existing LAN-to-any pass rule. For NFSv4, one narrow exception might be a recovery host reaching the TrueNAS IP on TCP 2049. Place that rule above the block to the production subnet. Don't open the entire clean room subnet to reach storage. To turn access off, disable the pass rules and clear matching states so active connections close.
I'd pay particular attention to how TrueNAS connects. If it has an interface on each network, NFS traffic may bypass OPNsense entirely. Firewall rules wouldn't enforce isolation on that path. Separate NFS exports, host permissions and storage management help, but a NAS shared with production remains a dependency during a ransomware recovery.
Is TrueNAS connected directly to both networks, or will clean-room NFS access route through OPNsense? That changes how I'd build the rules.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.