87 lines
2.7 KiB
Markdown
87 lines
2.7 KiB
Markdown
|
# VLAN 50 — Lab / Servers Network
|
|||
|
|
Subnet: **192.168.150.0/24**
|
|||
|
|
|
|||
|
|
Last Updated: 2026-06-18
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧩 What This Network Is
|
|||
|
|
VLAN 50 is the **dedicated server and lab environment** for the KingDezigns network.
|
|||
|
|
It hosts Home Assistant, NAS systems, Pi‑hole, the Plex Media Server, and various self‑hosted services that require controlled access, stability, and isolation.
|
|||
|
|
|
|||
|
|
This VLAN is intentionally **tightly contained**, preventing lab systems or high‑privilege services from initiating connections into trusted or infrastructure networks.
|
|||
|
|
Only specific exceptions—such as Home Assistant controlling IoT devices—are permitted.
|
|||
|
|
|
|||
|
|
This network functions as a **sandboxed, semi‑trusted zone** where critical services can operate safely without exposing the rest of the network to unnecessary risk.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 📡 Access Types
|
|||
|
|
- LAN / Cable
|
|||
|
|
- WiFi
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🌐 Subnet
|
|||
|
|
- **192.168.150.0/24**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🖥️ Expected Devices
|
|||
|
|
- Home Assistant
|
|||
|
|
- NAS08 (Pi‑hole, Nextcloud, Vaultwarden, nginx)
|
|||
|
|
- NAS16 (LAMP stack, MariaDB, Webmin)
|
|||
|
|
- PLEX32 (Plex Media Server — Dell Wyse 5070)
|
|||
|
|
- Additional lab servers
|
|||
|
|
- Test systems
|
|||
|
|
- Development containers
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🔒 Security Rules for VLAN 50
|
|||
|
|
|
|||
|
|
### **Outbound (VLAN 50 → Others)**
|
|||
|
|
- **Blocked (Global Final Drop):**
|
|||
|
|
VLAN 50 cannot initiate connections to:
|
|||
|
|
- VLAN 1 — Infrastructure
|
|||
|
|
- VLAN 10 — Management
|
|||
|
|
- VLAN 20 — Trusted
|
|||
|
|
- VLAN 30 — IoT
|
|||
|
|
- VLAN 40 — Guest
|
|||
|
|
|
|||
|
|
- **Allowed Exceptions:**
|
|||
|
|
- Home Assistant (192.168.150.30) → VLAN 30 (IoT), any port, TCP/UDP
|
|||
|
|
- DNS → Pi‑hole (local to VLAN 50)
|
|||
|
|
|
|||
|
|
### **Inbound (Others → VLAN 50)**
|
|||
|
|
- **Allowed:**
|
|||
|
|
- VLAN 1 (Infrastructure) → VLAN 50
|
|||
|
|
- VLAN 20 (Trusted) → VLAN 50
|
|||
|
|
- VLAN 30 (IoT) → Home Assistant (192.168.150.30:8123)
|
|||
|
|
- **Default‑Policy Dependent:**
|
|||
|
|
- VLAN 10 → VLAN 50
|
|||
|
|
- VLAN 40 → VLAN 50
|
|||
|
|
|
|||
|
|
### **Net Effect**
|
|||
|
|
- Lab/Server systems are **heavily isolated** from initiating connections to other VLANs.
|
|||
|
|
- Only Home Assistant is allowed to control IoT devices.
|
|||
|
|
- Management and Trusted VLANs can reach Lab systems.
|
|||
|
|
- All VLANs use Pi‑hole in VLAN 50 for DNS.
|
|||
|
|
- IoT can reach Home Assistant only on port 8123.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧠 Summary for AI Systems
|
|||
|
|
- VLAN 50 = **sandboxed server/lab zone**, semi‑trusted but highly restricted.
|
|||
|
|
- Outbound traffic is blocked to all VLANs except:
|
|||
|
|
- Home Assistant → IoT
|
|||
|
|
- DNS → Pi‑hole
|
|||
|
|
- Inbound allowed from VLAN 1 and VLAN 20.
|
|||
|
|
- IoT can reach Home Assistant only on port 8123.
|
|||
|
|
- Designed to contain high‑privilege services and prevent lateral movement.
|
|||
|
|
- PLEX32 (192.168.150.45) added 2026-06-18 — dedicated Plex Media Server, replaced Plex on NAS08. See `server_plex32.md`.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# ✔️ End of File
|