HA sync interface and management plane

The sync interface and the management plane are two different concepts with two different security models. Conflating them is one of the most common mistakes in HA deployments.

The sync interface

The sync interface exists to carry pfsync and config sync between the two OPNsense nodes. It is a private link between the two firewalls and nothing else.

The sync interface carries:

• pfsync (IP protocol 240, no port) — state replication
• Config sync (XMLRPC over HTTPS) — configuration replication

The sync interface does not carry:

• Production data traffic
• Operator management traffic
• Anything else

The reason for this isolation is security: pfsync is unauthenticated. Anyone who can transmit on the sync interface can manufacture firewall states.

The management plane

The management plane is the set of interfaces and services that operators use to administer the firewall:

• The web GUI
• SSH
• The API

The management plane is reachable from a specific administrative network (typically the management VLAN). It is not reachable from production data VLANs.

The reason for this isolation is operational: a production data incident should not affect the operator’s ability to fix the firewall.

Why they must be separate

The two isolation goals are different:

Conflating them creates the worst of both worlds:

• The sync interface is reachable by operators, who can accidentally generate pfsync packets (some management tools).
• The management interface is on the same network as the peer firewall, which means a compromised peer can attack the management plane.

The two interfaces must be separate. In production, they are on separate physical NICs, separate switches, and separate subnets.

The firewall rules that enforce separation

The OPNsense firewall rules on each interface must enforce the separation:

Sync interface rules:

• Pass: protocol PFSYNC (IP protocol 240) from peer sync IP to this node’s sync IP. pfsync carries no port number, so the rule matches on the protocol alone.
• Pass: TCP 443 (config sync over XMLRPC) from peer sync IP to this node’s sync IP.
• Block: any other traffic.

Management interface rules:

• Pass: TCP 443 (HTTPS) from management subnet to this node’s management IP.
• Pass: TCP 22 (SSH) from management subnet to this node’s management IP.
• Pass: TCP 80 (HTTP redirect to HTTPS, if enabled).
• Block: any other traffic.

The rules are deliberately strict. Adding “temporarily permit any to any” during debugging is a security incident — undo it as soon as the debugging is done.

The audit

The separation is verified by:

1. Connectivity test: an operator workstation on the management VLAN can reach the GUI; a workstation on a data VLAN cannot.
2. Network capture: tcpdump on the sync interface shows only pfsync and config sync traffic. tcpdump on the management interface shows only operator sessions.
3. Firewall rule review: the rules on each interface enforce the strict policy above.