Networking
Orientation to the homelab network model, traffic boundaries, address and policy references, validation runbooks, and packet-flow troubleshooting.
Site A uses one stateful Layer 3 boundary: OPNsense routes and filters every routed VLAN, while the three UniFi switches provide only Layer 2 transport. Site B remains a separate, parked design; WireGuard will connect the sites with routed traffic after both local networks are stable.
Current State: Site A Phase A2
The UCG Max, XG6, and AP bootstrap island is live on 192.168.0.0/23. OPNsense,
UOS, and OpenBao are staged behind it, but the final 10.10.x fabric is not yet
deployed. Site B and WireGuard remain parked.
Network Model
| Layer or function | Owner | Responsibility |
|---|---|---|
| WAN, NAT, and firewall policy | OPNsense | Internet edge, routed VLAN gateways, inter-zone policy, DHCP, initial DNS, and future WireGuard |
| Campus switching | UniFi at Site A; Netgear and UniFi at Site B | VLAN admission, access ports, trunks, PoE, and local Layer 2 forwarding |
| Host attachment | Proxmox Linux bridges | Connect VM interfaces to approved VLANs without making the host a router |
| Inter-site connectivity | OPNsense WireGuard peers | Route selected traffic between 10.10.0.0/16 and 10.20.0.0/16 without NAT |
Routing Boundaries Are Deliberate
Never stretch Layer 2, a Proxmox cluster, or Ceph between sites. Corosync and storage networks remain local and unrouted. Site A switches do not own production gateways.
Find the Right Reference
VLANs and Routing
Find every segment, per-site prefix, gateway owner, DHCP scope, and local-only exception.
Routing and Firewall Policy
Read the deny-by-default zone matrix, narrow permits, and mandatory negative tests.
Address Space and Lifecycle
Follow site supernets and the move from bootstrap addresses to final networks.
Address Allocation Rules
Apply role-based address bands, stable host octets, and host-interface rules.
DHCP and IPAM Operations
Allocate addresses, manage reservations, prevent conflicts, and reconcile runtime state.
DNS Architecture
Trace client resolution, authoritative zones, replication, and the staged resolver cutover.
WireGuard Routing
Review the parked inter-site design, allowed traffic classes, and activation gates.
Complete IP Tables
Look up final per-host, per-service, and per-VLAN addresses without repeating them here.
Prove and Troubleshoot
Network Validation Runbook
Collect pass/fail evidence for VLANs, gateways, DHCP, DNS, NAT, policy, RSTP, and WireGuard.
Packet-Flow Troubleshooting
Trace representative client, management, storage, DNS, denied-zone, and cross-site paths.
Traffic Boundaries
| Traffic plane | Routing behavior | Design intent |
|---|---|---|
| Management and service VLANs | Routed through local OPNsense policy | Make every zone crossing visible to one stateful firewall |
| Corosync (VLAN 25) | Site-local, no gateway | Keep cluster heartbeat independent of routed services |
| Storage / Ceph public (VLAN 60) | Site-local, no gateway | Attach consumers directly and keep bulk data off the firewall |
| Ceph cluster (VLAN 65) | Site B local-only; reserved and not carried at Site A | Isolate OSD replication and never route it to VLAN 60 |
| Backup / Replication (VLAN 90) | Routed with narrow policy | Support backup and future cross-site replication |
| Native sink (VLAN 999) | Site A only; no subnet, gateway, DHCP, or clients | Send unexpected untagged trunk traffic to a dead end |
From Design to Implementation
Network reference pages define the stable intent. The Site A Port Map owns physical links and port profiles, OPNsense owns interfaces and firewall implementation, and Build Phases owns the decision-gated migration sequence. Use the interactive network tools when a visual view is faster than a table.
Blast Radius & Recovery Matrix
How WAN, edge, switching, storage, control-plane, DNS, backup, and inter-site failures propagate, what remains available, and which recovery path applies.
VLANs and Routing
Canonical per-site VLAN prefixes, gateway ownership, local-only networks, DHCP scopes, and special transit or sink VLANs.