Firewall

Two OPNsense firewalls in high availability (CARP), fw1 and fw2.

Any port opening goes through a ticket and is reviewed by the network team. Rules are exported to GitLab every night.

Zone	Default policy
Internet → DMZ	deny, except HTTP/HTTPS to web1 and web2
Staff → servers	deny, except through the bastion
Servers → Internet	allow, logged