Watched video over Veeam Sire - Clean Room we have just covered a network refresh, Core - Edge Switch - AP but wanted to make use of old HP Switch 2920 with 10gb Gbic to rear this will be my clean room with referb of Arcserve UDP Server refresh install Windows Server 2025. Been looking at options on Firewall OPNsense Connection to both LAN that is Production - Clean Room to opt for Lenovo m720q with riser attached 2 x 10gb ports will configure 10gb Prod - 10gb Clean has any one created firewall rules for such connection or used firewall device to cover on / off question as my build as TrueNAS with NFS share this needs access over both connections. Any solutions to what members have done with such solution. Education secondary 6th form school
Veeam 12 Clean Room Firewall Connection
Best answer by eblack
@freddo, I think the overlapping subnets are what you're running into.
Both production and the clean room use 10.0/24. Having VLAN 10 on each side isn't necessarily a problem, but opnsense can't route normally between two networks using the same subnet. Changing the default route won't fix that.
I wouldn't bridge the management interface. That extends Layer 2 connectivity between production and the clean room, which works against the isolation you're trying to keep.
I'd leave production on 10.0/24, put the clean room on a different subnet, and use opnsense to allow only the traffic needed to reach TrueNAS. Make sure there's a return path from the TrueNAS side. For NFSv4, TCP 2049 is usually enough for the NFS service itself. NFSv3 may need additional RPC ports, so check which version you use.
Hope that helps!
+4I'd keep production and the clean room on separate VLANs/subnets, with OPNsense as the only routed path between them. The HP 2920 can handle switching, but don't let it route around the firewall.
Start with default deny between the networks. Check for an existing LAN-to-any pass rule. For NFSv4, one narrow exception might be a recovery host reaching the TrueNAS IP on TCP 2049. Place that rule above the block to the production subnet. Don't open the entire clean room subnet to reach storage. To turn access off, disable the pass rules and clear matching states so active connections close.
I'd pay particular attention to how TrueNAS connects. If it has an interface on each network, NFS traffic may bypass OPNsense entirely. Firewall rules wouldn't enforce isolation on that path. Separate NFS exports, host permissions and storage management help, but a NAS shared with production remains a dependency during a ransomware recovery.
Is TrueNAS connected directly to both networks, or will clean-room NFS access route through OPNsense? That changes how I'd build the rules.
The connection of TrueNAS is another issue to it self same would be for any cross connection used with OPNsense wanted with two interfaces with IP address to make point to point connections, bridge connection from my understanding does not offer that.
The import of backups on the NFS worked well but it gives option of live restore or restore to Hyper-V or ESX there is no option on this for Proxmox as we have instance of all three.
The TrueNAS would connect via OPNsense but it could be physically unplugged from Production to Sire Clean Room but want to understand the implication of attack on Linux Systems.
Then need to understand when Veeam 13 says use your own AV scan but does not provide details is it possible to cover a scan with Bitdefender do you place a command within the file system of VM as its local install, then this would be before VM is spun up, if the VM is started without network connection you could still run a scan in Bitdefender but would not have the latest update, Veeam have there own solution but it's another cost to low budget in the education sector. Not done research on this at present
+4@freddo Yes, you can use Bitdefender to scan before the restored VM starts. Install Bitdefender Endpoint Security Tools (BEST) on the Windows mount server. Veeam mounts the disks from the backup there and scans the mounted files.
Veeam already includes a BEST entry in AntivirusInfos.xml. On the Windows mount server, the file is under:
%ProgramFiles%\Common Files\Veeam\Backup and Replication\Mount Service
Check the executable path against your BEST installation. At the Secure Restore step, select "Scan restore points with the existing antivirus software". If you have multiple antivirus products installed, check their order in the XML file. Veeam uses the first of those listed.
I'd update BEST through the clean room's restricted Internet connection before scanning. The recovered VM can stay offline.
I tried Bridge connection on from Production < > Clean but this does not work, as we have VLANs on both sides expect this to be the case.
The interface are
Mgmt (LAN)
Int0 VLAN 10. CLEAN
Int1 VLAN 10. Production
Int bridge clean - production
Production TrueNAS NFS 192.168.10.20
Clean Veeam 13 - 192.168.10. 30
Routing on both Prod - Clean
Vlan10
IP 192.168.10.1
Would routing be the issue on clean is there any way to pass traffic on Clean with more than one vlan what command would close of routing is this main route to ISP gateway to firewall
route 0.0.0.0 0.0.0. 0 192.168.2.1
Sorry for my lack of knowledge done my research as much as possible, it would be easy to just pull out the 10gb fibre from Production Link and insert into Clean. But wanted some form of control on firewall on Bridge connection.
Should my Bridge be done with my Mgmt interface
+4@freddo, I think the overlapping subnets are what you're running into.
Both production and the clean room use 10.0/24. Having VLAN 10 on each side isn't necessarily a problem, but opnsense can't route normally between two networks using the same subnet. Changing the default route won't fix that.
I wouldn't bridge the management interface. That extends Layer 2 connectivity between production and the clean room, which works against the isolation you're trying to keep.
I'd leave production on 10.0/24, put the clean room on a different subnet, and use opnsense to allow only the traffic needed to reach TrueNAS. Make sure there's a return path from the TrueNAS side. For NFSv4, TCP 2049 is usually enough for the NFS service itself. NFSv3 may need additional RPC ports, so check which version you use.
Hope that helps!
+4
Let us know what you land on using when its done. :)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.