This is a set of notes for the 87/117 All Seasons Mansion home network. I have made this in case I forget or Leena needs someone to help in configuring it. It is expected that once we move to Koh Samui, this network will change pretty dramatically (see the page on Villa Makalena network). Once we move to Villa Makalena we will release the condo and decommission the condo network using its parts to build the Villa Makalena network. When that happens, this page will need to be retired.
In any such environment, things will be changing over time. I will do my best to keep this page updated so that it describes the current state, but may occasionally make references to older configurations in case someone who is configuring this network finds older artifacts. In such a case, I would not want someone to go down useless rabbit holes.
This page focuses on the Condo. And we are getting ready to build the Villa Makalena network, so I have extracted the common concepts between the 2 networks to the Rachelski Home Network page. Read that before coming back here to understand what is unique about the condo network.
For a deeper look at how this network is put together (the homelab network, VLANs, IPv6 and its known weaknesses), see Condo Network Design.
This section lists the key devices used in the home.
This device was provided by AIS and is used to connect the household to the ISP. While it does have wifi capabilities, they have been turned off. It has a network address of 192.168.1.1 and generally cannot be reached from within the network except via direct connection via CAT6 cable. I have paid extra money each month to AIS to have the fiber circuit have an IPv4 address although it is dynamically allocated. Without this, AIS puts this behind a telco-grade NAT controller (CGNAT) that makes it very hard to connect into my NAS or my cloud server to connect via wireguard to the router. This allows connections to be established coming INTO the house. I have also had AIS configure this modem into bridging mode to avoid a double NAT. For all intents and purposes, this device is pretty invisible to the network and all traffic is relayed to 192.168.200.1 (the Wifi router)
The credentials have been changed from default and match those used by the household wifi router described below.
TODO: These credentials will need to be added to BitWarden. When in doubt, check the credentials for DiskStation Admin
The Wifi network itself is currently run by a pair of Asus ZenWIFI AX routers that form a mesh network inside the condo. As this condo is very long internally with a lot of cement and steel in the walls, a single router is incapable of providing comprehensive coverage.
The network exposed in the house is using IP 192.168.200.0/24 CIDR range. The primary router and its web-based interface can be found at 192.168.200.1 with the Admin credentials in BitWarden for this device under the URL http://192.168.200.1
There is a second device in the office bedroom that extends the range of this network. However, this device is basically invisible from a network perspective. The 2 devices speak to each other over a dedicated 5 GHZ wifi channel.
The network exposes a WiFi network over 2 channels: 2.5 GHZ and 5 GHZ. A 3rd 5 GHZ channel functions as a control channel linking the meshed devices.
There are currently no rules or guidelines established on which channel a household device would connect to. But this is likely to change in the future. It is common knowledge within the household of how to join the network:
SSN: I70 (a very long highway stretching over most of the U.S.)
SSID Password: rachelski
This router is also running DDNS services that are currently using the www.asus.com DDNS service. However, this is not really linked into the existing DNS name management at this time. The NAS is also running a DDNS service to ensure that the name mrachelski.synology.me is always pointing to a valid external IP address. However, I am running an active project to remove this in the future. See DNS Registrar for more details.
My latest philosophy is that such DDNS services are network services and should be located to a network device (the Asus router or the net-1 firewall host) to reduce the blast raduis of a NAS failure. If a service (in the DNS zone) is using this DDNS route, it will be CNAME'ed to mrachelski.synology.me
The WiFI router has a pretty complex port forwarding configuration with a number of protocols being routed to the NAS. As of the time of this writing ALL services forwarded are routed to the NAS. This list has grown over time, but is now shrinking due to a cleanup project. This port forwarding table is getting more simple as I remove services from the NAS and onto the ranch k8s cluster. However, www.rachelski.net:80 and www.rachelski.net:443 are both forwarded to the diskstation NAS where it has an internal proxy to route SNI names to docker services.
Before Home Automation is rolled out heavily, it is common for there to be 30-35 devices connected to the network.
The router is also performing DHCP chores, but local DNS is delegated to an instance of Technitium at 192.168.200.53:53. This Technitium instance also provides DNS name resolution for the internal rachelski.internal network that all internally named services now use.
The following is an overview of the key services provided within this network. This is critical for understanding when doing network troubleshooting. Please see the primary rachelski-home-network page for a complete overview
This page is focused on services specific to the All Seasons Mansion condo network.
The Asus Zen WIFI AX has a wireguard server turned on that allows me to remotely access the home network when out on the public internet.
Much like the DNS server, it turned out to be a bad idea to use the DHCP service from the NAS. While this service is turned on on the NAS, it is not used. But, I have been afraid to turn it off in case I missed some configuration.
DHCP services are provided by the ZenWIFI router at this time.