Project Argus — Phase 1: Inter-VLAN Flow Audit & Required Allowlist

Status: Inferred/required allowlist — built from source-of-truth configs (DNS, Traefik, Ansible inventory, Blackwall design post) and a no-credential port scan. Must be validated against live OPNsense + MikroTik firewall rules before policy is changed.

1. Sources consumed

2. VLAN / subnet inventory

3. Known hosts by VLAN

VLAN 10 — Services (10.67.10.0/24)

VLAN 20 — Storage (10.67.20.0/24)

VLAN 30 — DMZ (10.67.30.0/24)

VLAN 40 — Infrastructure (10.67.40.0/24)

VLAN 45 — Management (10.67.45.0/24)

4. Required inter-VLAN allowlist (inferred)

This matrix is the intended/required state derived from service architecture. Each row should be cross-checked against live OPNsense/MikroTik rules and observed traffic before becoming policy.

5. Service-level port map (from Traefik + scan)

6. Unknowns that must be confirmed

1. Live firewall state on OPNsense — are there still temporary allow-all rules between VLANs? Between 10.0.0.0/16 and the new VLANs?
2. MikroTik VLAN routing/L3 configuration — is the switch doing any inter-VLAN routing, or is all L3 handled by OPNsense?
3. DHCP / wireless VLANs (50/60/70) — no static inventory exists; clients must be discovered from OPNsense DHCP leases or MikroTik MAC table.
4. TrueNAS service ports — scan shows 80/443; need to confirm SMB/NFS/AFP/iSCSI ports and initiator subnets.
5. Pangolin tunnel details — exact ports, whether newt-1 or matrix-1 hosts the tunnel, and whether it ingresses to DMZ or Services.
6. Management-plane access path — is the OPNsense WebUI currently bound to 10.67.0.1/16 on bge0 as described in Blackwall, or has it been moved to VLAN 45?
7. MikroTik MAB state — is MAB configured already, and which ports are in which VLAN?

7. Live data-collection playbook

Run these commands and save outputs into a argus-phase1-evidence/ directory. This is the evidence needed to turn the inferred matrix above into a validated allowlist.

7.1 OPNsense (blackice-1, 10.67.45.1)

Via SSH or console as a read-only admin:

# Firewall rules (filter + nat)
pfctl -sr
pfctl -sn

# Stateful table and interface list
pfctl -ss | head -n 500
ifconfig -a

# Routes
netstat -rn

# DHCP leases (shows client VLAN assignment)
cat /var/dhcpd/var/db/dhcpd.leases

# Config backup (XML) — inspect offline for rules, aliases, interfaces
# WebUI: System > Configuration > Backups
# Or CLI: cp /conf/config.xml /tmp/config.xml and pull via scp

7.2 MikroTik CRS328 (gridlink-1, 10.67.45.2)

Via SSH/Winbox/console:

# Layer-2 / VLAN fabric
/interface bridge print detail
/interface bridge vlan print detail
/interface bridge port print

# Layer-3 / IPs
/ip address print
/ip route print

# Firewall/filter on RouterOS (if any L3 is done here)
/ip firewall filter print
/ip firewall nat print

# DHCP server/leases per VLAN
/ip dhcp-server lease print
/ip dhcp-server print

# MAB / RADIUS if configured
/interface dot1x server print
/radius print

# Switch port-to-MAC mapping
/interface bridge host print

7.3 Linux service hosts

Run on every managed host (Ansible can do this once SSH keys are available):

# Listening sockets
ss -tlnp
ss -ulnp

# Established inter-VLAN conversations (run during active period)
ss -tn state established '( dport != :22 )' | head -n 200

# Local firewall rules (if host-level filtering exists)
sudo iptables -L -n -v
sudo nft list ruleset 2>/dev/null

# Active Docker networks / published ports
sudo docker network ls
sudo docker ps --format 'table {{.Names}}\t{{.Ports}}'

7.4 TrueNAS (datafortress-1)

• WebUI: Network → Interfaces, Sharing → SMB/NFS, Services → list active services.
• CLI (if root SSH enabled):

  ifconfig
  netstat -rn
  midclt call sharing.smb.query
  midclt call sharing.nfs.query
  

7.5 Proxmox (arasaka-1)

# VM network attachments per bridge/VLAN
qm config <vmid> | grep -E 'net|bridge|tag'
# Or bulk:
pvesh get /nodes/arasaka-1/qemu --output-format json | jq '.[] | {vmid,name}'

8. Recommended Phase 1 execution order

1. Collect evidence — run section 7 commands and store in argus-phase1-evidence/.
2. Map current rules — translate OPNsense pfctl -sr and MikroTik /ip firewall filter print into a plain-text “current allowlist”.
3. Diff current vs required — identify every current rule that is broader than the matrix in section 4.
4. Draft firewall policy changes — create OPNsense aliases and rules (and MikroTik filter rules if it does L3) that match the required matrix.
5. Staged enforcement — add rules as log only first; observe for 7 days; then switch to block for over-permissive rules.
6. Validate exit criteria (from Argus brief):
   • Temporary inter-VLAN allow-all rules removed except documented exceptions.
   • At least one wired MAB path validated end-to-end.
   • At least one wireless RADIUS-backed auth path validated end-to-end.
   • CA operational for first certificate use case.
   • MAB ports constrained by firewall policy, not trusted on MAC alone.

9. Suggested artifact repository

Create a new GitLab repo (e.g. homelab/argus) and commit:

argus/
├── phase1/
│   ├── allowlist.md                 # this file
│   ├── evidence/
│   │   ├── opnsense-pfctl-sr.txt
│   │   ├── opnsense-config.xml
│   │   ├── mikrotik-filter.rsc
│   │   ├── mikrotik-bridge-vlan.txt
│   │   └── linux-ss-tlnp/           # one file per host
│   └── policy/
│       ├── opnsense-aliases.json    # proposed aliases
│       └── opnsense-rules.csv       # proposed rules

10. Immediate next action

The single most useful thing to do next is pull the live OPNsense and MikroTik configs. Without them, section 4 remains a design document. With them, it becomes a migration plan.

If you can place an SSH key into this session or run the section 7 commands and paste the outputs, I can turn the inferred matrix into a concrete rule-by-rule diff.

This page is published as a PGP clearsigned document. You can verify it like this:

gpg --keyserver hkps://keys.openpgp.org --recv-keys CA98D5946FA3A374BA7E2D8FB254FBF3F060B796
curl -fsSL 'https://eddiequinn.xyz/sigs/posts/drafts/project-argus/data/argus-phase1-allowlist.txt' | gpg --verify