My new Nework Setup

It may be risky to publish my network layout, but because I got a new PFSense router and I like to talk about my homelab and the things I'm tinkering with I'm writing this gemlog post. Maybe it's some inspiration for someone.

*EDIT*: I switched to OPNSense from PFSense CE on my mainrouter on 26 March 2025, because PFSense CE updates do seem to take a very loooooong time!

It's always a mess to switch out such an integral and central part of a homelab like a router, so I did a lot of planning and research this time to get it right.

Network Layout

OPNSense router (mainrouter)

*EDITED on 26 Mar 2025*

This is the center of my network, which does all the firewalling, DNS, DynDNS, DNSBL Blocking with the internal ubound DNSBL, DHCP and all the VLAN routing and setup.

I still use the ISC DHCP server because the Kea DHCP server doesn't inject new connected device names to the unbound DNS server. A feature that I need for my Incus Cluster when I spin up new containers, tear them down again and other things.

OPNSense is always ahead of the OPNSense business edition, so you can be sure to get frequent updates, unlike with PFSense CE.

IPv6

*EDITED on 26 Mar 2025*

I set up IPv6 for all of my VLANs which SLAAC. But the IPv6 addresses are not inserted into the Unbound DNS server, so IPv6 is just used for outbound connections to the outside of my local net.

*DONE*

I'll add ULAs (Unique local addresses) later to put them in my static DNS list for my stable servers in my homelab.

Glovary Firewall N100 Router Appliance

I bought this thing on Amazon (yes I know, but it's convenient) and here's a link:

Glovary PFSense Router

OpenWRT WiFi router (wlanrouter)

My WRT1900ACS WLAN died a few weeks ago, so I replaced it with a little travel WLAN router which also runs OpenWRT, which didn't work with 2 separate WLANs. But after an upgrade from the vendor it now supports my 2 WLANs under different VLANs (VLAN70 and VLAN80). It was a cheap buy, but it does it's job as I want it.

It simply serves as a dumb router for my two WLANs: One for my insecure IoT devices and one which is secure for my mobile things like laptops and smartphones. The insecure WLAN does not connect to the internet.

VLANs

I've set up 7 VLANs to separate my specific network segments:

All of these VLANs/subnets are locked down as much as possible with the mainrouter firewall.

What do you think?

I'm really satisfied with my setup now and I think it's easily expandable. But of course I'm no expert and just a hobbyist. Fiddling around with the firewall was a little unusual to me at first and there may be some buggy rules that don't work as intended. But at least everything works.

If you have any opinions, suggestions, comments or advice please send me an email or if you wish so follow me on Mastodon/ActivityPub '@fab@pleroma.envs.net' and contact me there.

All in all - Have fun!

-fab-

--

Back to index

Homepage

Send me a gemini-mention!

Or write me an email.

Proxied content from gemini://redterminal.org/gemlog/2024-02-02-My_new_Nework_Setup.gmi

Gemini request details:

Original URL
gemini://redterminal.org/gemlog/2024-02-02-My_new_Nework_Setup.gmi
Status code
Success
Meta
text/gemini;lang=en
Proxied by
kineto

Be advised that no attempt was made to verify the remote SSL certificate.