Router-on-a-stick network diagram: the internet reaches an ISP gateway, then a bare-metal OPNsense firewall whose single trunk interface carries tagged VLANs to a managed layer 2/3 switch, which feeds four Proxmox nodes joined in a Corosync and Ceph high-availability cluster ring on an isolated VLAN 10.

OPNsense Router-on-a-Stick Lab

Network securityOPNsense · VLANs

A virtualized OPNsense router in Proxmox on PCI-passthrough NICs, with managed VLAN switching, encrypted WAN interfaces, internal firewalls and inter-VLAN routing – enterprise perimeter defence, simulated end to end.

The diagram documents all four nodes of the Proxmox cluster, joined in a Corosync and Ceph high-availability ring on an isolated VLAN.

OPNsense
VLANs
Firewall
Virtualization