Add IoT+local services ACL template; fix offline DNS resilience guidance

Browse Source

New ACL template: "IoT VLAN — isolated + access local services via FQDN"
- Permits DNS to the configured resolver (so FQDNs resolve to LAN IPs)
- Permits traffic to the servers VLAN subnet only (NAS, Home Assistant, etc.)
- Blocks all other RFC1918 — users, cameras, management stay isolated
- Permits internet
- serverSubnet param auto-suggested from the vlans list if a VLAN named
  "Servers" exists; otherwise user enters it

Template description explains the full picture:
- How FQDN access works through the ACL (DNS → LAN IP → ACL permits it)
- Offline resilience: ctrld must be on OPNsense (not management PC) to
  survive internet outages; split-horizon in DNS tab makes *.lan resolve
  from local dnsmasq without any internet dependency
- Servers VLAN security: lock down servers VLAN inbound ACL by port
  so IoT can only reach specific service ports, not all server traffic

Strict IoT template description tightened — now clearly says "zero LAN
access" so users pick the right template for their use case.

Modal: serverSubnet field added alongside existing ctrldIp/nvrIp/pbxIp
params; preview correctly passes serverSubnet to the build function.

https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6

...

This commit is contained in:

Claude

2026-03-23 17:00:43 +00:00

parent 5c8536effd

commit 020162c1c8

2 changed files with 95 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

Avaya_5952_setup.py

+1 -1

File diff suppressed because one or more lines are too long