Networks
Devices are grouped by how much they are trusted and what they need. Each group is its own network, and the firewall decides what may cross between them.
The networks#
| Network | Subnet | Holds | Internet |
|---|---|---|---|
| Admin | 192.168.1.0/24 | The admin laptop, wired | Through the VPN |
| AP management | 192.168.2.0/24 | The access point only | None |
| Trusted Wi-Fi | 192.168.10.0/24 | Phones, laptop, watch | Through the VPN |
| IoT | 192.168.20.0/24 | A robot vacuum | Through the VPN |
| Guest | 192.168.30.0/24 | Visitors | Direct |
| PS5 | 192.168.3.0/24 | A PlayStation 5 | Direct |
| Media | 192.168.4.0/24 | A Kodi media player: Intel N100, 16 GB RAM, 2 TB NVMe | Through the VPN |
| Servers | 192.168.5.0/24 | The cluster, the UniFi controller, Home Assistant | Through the VPN |
| VPN | a /32 | The WireGuard tunnel | It is the way out |
IPv6 is switched off everywhere, deliberately: one address family means one policy to reason about.