Deploys a fully preconfigured OPNsense appliance into a Hyper-V lab in a
single execution, re-running safely because every stage detects the current
state before it acts.
Main script:
- Hyper-V platform detection and installation, exiting 3010 only when the
hypervisor itself needs a restart
- Random /20 block selection out of a private base network, divided into /24
networks whose VLAN tag is the third octet of their own network address
- Zone based roles, with five server zones paired by index to five client
zones, plus Management, Infrastructure, DMZ, Storage and Guest
- Generated OPNsense config.xml delivered on a FAT32 VHDX at conf/config.xml
- Generation 2 virtual machine with secure boot disabled and a LAN trunk
carrying VLANs 1-4094
- Marker scoped teardown via RemoveExistingDeployment
Toolkit functions:
- Save-ToolkitModule, Install-HyperVPlatform, Test-PendingReboot
- Expand-CompressedFile, Get-OPNSenseInstallationMedia
- Get-HyperVStorageLocation, Get-HostUpstreamDNSConfiguration
- New-RandomPassword, New-OPNSensePasswordHash
- New-OPNSenseNetworkPlan, New-OPNSenseConfigurationDocument,
Save-OPNSenseConfigurationDocument, New-OPNSenseConfigurationDisk
- Initialize-OPNSenseVirtualSwitch, New-OPNSenseVirtualMachine,
Remove-OPNSenseDeployment
Configuration document covers interfaces, VLANs, Kea DHCPv4 scopes with PXE
options, Unbound, outbound NAT, six firewall aliases and an ordered rule set
that grants management full reach, allows the jump hosts over well known
management ports, forces name resolution to approved resolvers, and pairs the
client and server zones.
Bundles 7-Zip, because the tar.exe included with Windows cannot read a raw
bzip2 stream, and BCrypt.Net-Next for the appliance password hash.
docs: Add readme with execution flow and generated per function reference
docs: Add design specification under .ai/specification
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
