This describes the network components in the condo network. This network is definitely limited by the fact that the we cannot practically run any network cabling between rooms. As such, it has to work around a series of limitations.
Specifically, the ASUS ZenWifi mesh routers provide all wifi services to the house. But the main router is also functioning as the gateway to the internet. In other words, the Fiber gateway (which is itself a router turned into a bridge) is plugged into the primary ZenWifi router. In addition, there are a few devices hard-wireds directly into that router:
The office is the home of the ZenWifi mesh AP and it also has 2 devices plugged into it:
The 2 ZenWifi devices are connected via a 5GHz wireless backhaul. Meaning that all access from the homelab to the internet is traversing this backhaul.
My intention is to configure the opnsnse router running in a VM on net-1 to be the front door to the homelab and all homelab equipment can be placed on separate VLANs and subnets from the rest of the home traffic. This is, of course, quite different from what I intend to do in Villa Makarena, but will function as a very good way for me to practice using the router as such.
ISP Gateway - ZenWifi router - NAS
| - Kodi2 Settop box
|
|
ZenWifi Mesh AP - net-1 router - homelab
The Zenwifi wirelss and wired network is hosted on 192.168.200.x and it is not further sub-divided in any way.
As mentioned above, the entry to this network is the net-1 racckmount computer which has a number of highspeed ports in the 2.5 and 10GB sizezs. The ports are mapped out as follows:
This simply documents the VLANS I have in the network.
The ISP appears to only hand out /64 addresses. As such, we will go ahead and allocated a ULA for the network and carve that up into smaller chunks for each subnet (which I will generally align with the VLAN). In short, we will use the IPv6 version of NAT (referred to as NAT66) so that each VLAN can have its own legal ipv6 /64 subnet. (Remember, this is a convenience as VLAN and IP subnets are at different layers in the ISO stack).
I will then run DHCPv6 on the OpnSense router along with a NAT66 service to map to the ISP assigned range. This process is described fairly well on this page
As part of those instructions, I used a ULA generator to secure: fddc:99dd:ece7::/48. While I was super pleased to be randomly allocated such a cool ULA, it turns out that ULA's don't really work in a dual-stack network. So, I will utilzie a fantastic workaround referenced lower in that article and replace the ULA address fddc:99dd:ece7::/48 with a similarly unusable address on the internet 3fff:99dd:ece7::/48. Long story short:
My pseudo-ULA is:
3fff:99dd:ece7::/48
There are several weaknesses in this network that I expect to address with the Villa Makarena network. The are as follows:
dns-1) runs on net-1 and the secondary (dns-2) on ranch-2, so losing one host no longer takes DNS down. The two servers don't yet sync their zones with each other, so a change made on one has to be made on the other as well. I expect at some point to repurpose the Raspberry Pi running Kodi to function as a DNS server and this will be directly connected to the primary ZenWifi router.