Watched video over Veeam Sire - Clean Room we have just covered a network refresh, Core - Edge Switch - AP but wanted to make use of old HP Switch 2920 with 10gb Gbic to rear this will be my clean room with referb of Arcserve UDP Server refresh install Windows Server 2025. Been looking at options on Firewall OPNsense Connection to both LAN that is Production - Clean Room to opt for Lenovo m720q with riser attached 2 x 10gb ports will configure 10gb Prod - 10gb Clean has any one created firewall rules for such connection or used firewall device to cover on / off question as my build as TrueNAS with NFS share this needs access over both connections. Any solutions to what members have done with such solution. Education secondary 6th form school
Veeam 12 Clean Room Firewall Connection
Best answer by eblack
I'd keep production and the clean room on separate VLANs/subnets, with OPNsense as the only routed path between them. The HP 2920 can handle switching, but don't let it route around the firewall.
Start with default deny between the networks. Check for an existing LAN-to-any pass rule. For NFSv4, one narrow exception might be a recovery host reaching the TrueNAS IP on TCP 2049. Place that rule above the block to the production subnet. Don't open the entire clean room subnet to reach storage. To turn access off, disable the pass rules and clear matching states so active connections close.
I'd pay particular attention to how TrueNAS connects. If it has an interface on each network, NFS traffic may bypass OPNsense entirely. Firewall rules wouldn't enforce isolation on that path. Separate NFS exports, host permissions and storage management help, but a NAS shared with production remains a dependency during a ransomware recovery.
Is TrueNAS connected directly to both networks, or will clean-room NFS access route through OPNsense? That changes how I'd build the rules.
+4I'd keep production and the clean room on separate VLANs/subnets, with OPNsense as the only routed path between them. The HP 2920 can handle switching, but don't let it route around the firewall.
Start with default deny between the networks. Check for an existing LAN-to-any pass rule. For NFSv4, one narrow exception might be a recovery host reaching the TrueNAS IP on TCP 2049. Place that rule above the block to the production subnet. Don't open the entire clean room subnet to reach storage. To turn access off, disable the pass rules and clear matching states so active connections close.
I'd pay particular attention to how TrueNAS connects. If it has an interface on each network, NFS traffic may bypass OPNsense entirely. Firewall rules wouldn't enforce isolation on that path. Separate NFS exports, host permissions and storage management help, but a NAS shared with production remains a dependency during a ransomware recovery.
Is TrueNAS connected directly to both networks, or will clean-room NFS access route through OPNsense? That changes how I'd build the rules.
The connection of TrueNAS is another issue to it self same would be for any cross connection used with OPNsense wanted with two interfaces with IP address to make point to point connections, bridge connection from my understanding does not offer that.
The import of backups on the NFS worked well but it gives option of live restore or restore to Hyper-V or ESX there is no option on this for Proxmox as we have instance of all three.
The TrueNAS would connect via OPNsense but it could be physically unplugged from Production to Sire Clean Room but want to understand the implication of attack on Linux Systems.
Then need to understand when Veeam 13 says use your own AV scan but does not provide details is it possible to cover a scan with Bitdefender do you place a command within the file system of VM as its local install, then this would be before VM is spun up, if the VM is started without network connection you could still run a scan in Bitdefender but would not have the latest update, Veeam have there own solution but it's another cost to low budget in the education sector. Not done research on this at present
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.