VLAN 99 - Management
172.16.99.0/24

VLAN 20 - Servers
172.16.20.0/24

P-WIN-SRV1

OS: Windows Server 2022
IP: 172.16.99.11
Role: Secure Gateway
Ports: 54899, 22

P-WIN-SRV2

OS: Windows Server 2022
IP: 172.16.20.12
Role: KMS (Volume Activation)

P-WIN-SRV3

OS: Windows Server 2022
IP: 172.16.20.13
Role: Enterprise Sub CA
Services: AD CS, IIS

P-WIN-ROOTCA

OS: Windows Server 2022
IP: 172.16.20.15
Role: Offline Root CA
POWERED OFF

P-WIN-SRV4

OS: Windows Server 2022
IP: 172.16.20.14
Role: NPS/RADIUS, WDS/MDT

VLAN 5 - Infrastructure
172.16.5.0/24

VLAN 5 - Infrastructure
172.17.5.0/24

P-WIN-DC1

OS: Windows Server 2022 Core
IP: 172.16.5.10
Role: DC, DNS, DHCP
DNS: 172.17.5.10, 172.16.5.10
AD Site: HQ-Proxmox

REGINLEIF.IO Network Architecture

Home Network / Internet
192.168.1.0/24

IPsec IKEv2 Site-to-Site VPN
UDP 500/4500 + ESP | PKI Certificate Auth
Carries: AD Replication, DNS, Inter-site Traffic

SITE A - HEADQUARTERS
Proxmox VE
172.16.x.0/24 (VLANs 5, 10, 20, 99)

OPNsenseHQ

OS: OPNsense (FreeBSD)
WAN: 192.168.1.240
VLAN 5: 172.16.5.1
VLAN 10: 172.16.10.1
VLAN 20: 172.16.20.1
VLAN 99: 172.16.99.1
IPsec: ipsec.hq.reginleif.io
WG: 10.200.0.1 (RW)

vmbr1
(Linux Bridge - VLAN Trunk)

SITE B - BRANCH OFFICE
Windows Hyper-V
172.17.x.0/24 (VLANs 5, 10, 20, 99)

OPNsenseBranch

OS: OPNsense (FreeBSD)
WAN: 192.168.1.245
VLAN 5: 172.17.5.1
VLAN 10: 172.17.10.1
VLAN 20: 172.17.20.1
VLAN 99: 172.17.99.1
IPsec: ipsec.branch.reginleif.io

hn1
(Private vSwitch - VLAN Trunk)

H-WIN-DC2

OS: Windows Server 2022 Core
IP: 172.17.5.10
Role: DC, DNS, DHCP
DNS: 172.16.5.10, 172.17.5.10
AD Site: Branch-HyperV

VLAN 20 - Servers
172.17.20.0/24

AD Replication Traffic
P-WIN-DC1 ↔ H-WIN-DC2
reginleif.io

Admin PC
(WireGuard Road Warrior)
Tunnel: 10.200.0.10
VLAN 99 Only

WireGuard

AD Replication Path

P-WIN-DC1 (VLAN 5) ↔ vmbr1 ↔ OPNsenseHQ ↔ IPsec ↔ OPNsenseBranch ↔ hn1 ↔ H-WIN-DC2 (VLAN 5)

LEGEND

OPNsense Firewall/Gateway

Windows Server

Virtual Switch/Bridge

IPsec S2S / WireGuard RW

AD Replication (via VPN)

WAN Connection

VLAN 5 (Infrastructure)

VLAN 20 (Servers)

VLAN 99 (Management)

VLAN ASSIGNMENTS

VLAN	Name	HQ Subnet	Branch
1	Default	Blackhole (unused)
5	Infrastructure	172.16.5.0/24	172.17.5.0/24
10	Clients	172.16.10.0/24	172.17.10.0/24
20	Servers	172.16.20.0/24	172.17.20.0/24
99	Management	172.16.99.0/24	172.17.99.0/24

Documentation