Page 8 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
Review whether a FlowSchema distinguishes requests by user, namespace or neither. Keep flow grouping separate from the priority-level concurrency allocation and from application authorization.
Read the guide
Distinguish a normal Service’s cluster-IP answer from a headless Service’s selected-Pod address set. Review named-port SRV answers with the client that will consume them.
Read the guide
Separate routing-mesh reachability from host-mode task placement. Review the external load-balancer target population against the service’s actual publication mode.
Read the guide
Discover supported Axis live-stream adjustments and review their starting values before changing an ongoing RTSP session. Keep the documented storage-profile incompatibility explicit.
Read the guide
OPNsense documents denial of all Stunnel connections when CRL checking is enabled without a valid CRL. Review list availability and the consuming tunnel before the change.
Read the guide
The OPNsense control-plane guide requires a separate class and marks WFQ and QFQ usable for its weighted design. Review that allocation alongside existing pipe bandwidth.
Read the guide
OPNsense warns against manually adding routes managed by services such as OpenVPN. Compare the intended route owner with the active table before creating a static entry.
Read the guide
The OPNsense IPS reference distinguishes alerting from packet drops and documents Netmap interface and offload prerequisites. Check the capture branch before interpreting a prevention result.
Read the guide
The selective WireGuard guide warns that local DNS can continue through normal WAN routing. A same-subnet resolver also lies outside the documented firewall port-forward interception path.
Read the guide
The OPNsense Dnsmasq guide distinguishes a static reservation from static range mode. Review dynamic-client eligibility separately, including the documented DUID requirement for IPv6 reservations.
Read the guide