Gateway, routing and IPv6
OPNsense handles network separation, WireGuard, Suricata and Zenarmor. I have also worked through IPv6 source-address and prefix-translation problems.
Felix Bistriker · Personal homelab
BiXCore
BiXCore is the network I built at home, both for the services I use every day and for experimenting with technologies I want to understand better. It has grown into an OPNsense gateway, managed switching and Wi-Fi, Windows Server and PKI, NAS services, and a separate Proxmox firewall lab.
I document what I set up, the problems I ran into and how I worked through them.
NETWORK OVERVIEWOPNsense gateway
The home network and the virtual test environment have separate access policies.
OPNsenseIntel N305 gateway with 10GbE interfaces
Windows ServerActive Directory, certificates and EAP-TLS
Proxmox VEOn-demand firewall and client testing
THE PROJECTS
What I've built
The projects are connected: the network needs working identity and DNS services, and the virtual lab gives me somewhere to test changes without disturbing the systems I rely on.
Active Directory and certificates
Two Windows Server domain controllers, an enterprise CA, NDES and FreeRADIUS support certificate-based access for Windows, Linux and Android clients.
Switching and Wi-Fi
Managed switches, VLANs, UniFi access points and 802.1X. Some of the most interesting work has been investigating LLDP and IPv6 Neighbor Discovery.
DNS, NAS and everyday services
Client DNS, Active Directory lookups, certificates, Docker networking and services hosted on the NAS, including the work needed to recover them after changes.
Windows and Linux administration
Group Policy, certificate enrollment, remote management, deployment tools, Kubuntu integration and monitoring across the servers and workstations.
Proxmox firewall lab
A separate test environment for RouterOS, pfSense, FortiGate, VyOS, Sophos, OpenWrt and IPFire, with Windows and Linux clients and an evolving test checklist.
There is more detail on storage migration, GPU passthrough, monitoring, client enrollment and the individual firewall platforms in the complete project list.
HOW IT WORKS
A working network and a separate place to experiment
The OPNsense gateway, switches, Wi-Fi, directory services and NAS are part of my day-to-day setup. Proxmox is different: I start it when I want to compare firewall systems or test a configuration with Windows and Linux clients.
The lab uses dedicated virtual networks and a separate upstream. I have checked the main connectivity paths and am continuing the tests for traffic that should be blocked.
Everyday network
OPNsense, managed switches and Wi-Fi, Active Directory, PKI, DNS, NAS and remote access.
Network details →Test environment
Proxmox, virtual firewall WAN/LAN networks and Windows or Linux clients. I normally run only the machines needed for a particular test.
Lab setup →Monitoring and recovery
Windows and gateway monitoring, certificate renewal, backups, and fixes for problems that showed up after restarts or updates.
Operations and troubleshooting →TROUBLESHOOTING
Problems I ran into
Some of the most useful work came out of things that stopped working: an IPv6 address that couldn’t reach the internet, a switch blocking a domain controller, a failed storage pool. I’ve written up 21 cases, grouped by the part of the lab they affected. Browse all 21 troubleshooting cases →
OPNsense and IPv6
WAN source selection, dynamic DNS failures, unexpected PF states, WireGuard/NPTv6, the guest portal and LLDP startup settings.
Switching and client identity
Omada Neighbor Discovery, domain-controller EAP-TLS, LDAPS failover, Android SCEP enrollment and Windows management issues.
NAS and infrastructure services
Recovering a missing IPv6 ULA, correcting Docker routes and getting UPS monitoring to work.
Proxmox and virtual machines
VM networking and bridge mistakes, replacing storage, IPv6 Router Advertisements, Intel GPU passthrough and KRDP.
Each case has the symptoms, the checks I made and the fix or follow-up. See all 21 cases →
WHAT'S NEXT
What I’d like to try next
There are several directions I want to take BiXCore: finishing recovery and IPv6 tests, learning other firewall platforms, and trying new security and networking features with real clients.
More firewall platforms
Broader FortiGate tests and evaluation of Palo Alto VM-Series, Juniper vSRX, Check Point, SonicWall and Cisco virtual routing.
RADIUS, NAC and real Wi-Fi clients
A dedicated access point for captive portals, EAP-TLS and PacketFence, plus BGP/FRR experiments in the virtual lab.
IPv6 and recovery
An IPv6-only lab network, real provider prefix-change tests, stronger isolation checks and proper restores of important services.
Zenarmor and encrypted traffic
More work with web and application policies, TLS inspection, reporting and performance on the N305 gateway — including multi-core tests if the feature becomes available.
ABOUT ME
The person behind BiXCore
I'm Felix Bistriker. My professional background is in engineering and electronic security systems, including fire detection, access control and video surveillance. Networking gradually became the part I wanted to explore in more depth, and BiXCore grew out of that interest.