# VLAN 50 — Lab / Servers Network
Subnet: **192.168.150.0/24**

Last Updated: 2026-06-18

---

## 🧩 What This Network Is
VLAN 50 is the **dedicated server and lab environment** for the KingDezigns network.  
It hosts Home Assistant, NAS systems, Pi‑hole, the Plex Media Server, and various self‑hosted services that require controlled access, stability, and isolation.

This VLAN is intentionally **tightly contained**, preventing lab systems or high‑privilege services from initiating connections into trusted or infrastructure networks.  
Only specific exceptions—such as Home Assistant controlling IoT devices—are permitted.

This network functions as a **sandboxed, semi‑trusted zone** where critical services can operate safely without exposing the rest of the network to unnecessary risk.

---

## 📡 Access Types
- LAN / Cable  
- WiFi  

---

## 🌐 Subnet
- **192.168.150.0/24**

---

## 🖥️ Expected Devices
- Home Assistant  
- NAS08 (Pi‑hole, Nextcloud, Vaultwarden, nginx)  
- NAS16 (LAMP stack, MariaDB, Webmin)  
- PLEX32 (Plex Media Server — Dell Wyse 5070)  
- Additional lab servers  
- Test systems  
- Development containers  

---

## 🔒 Security Rules for VLAN 50

### **Outbound (VLAN 50 → Others)**
- **Blocked (Global Final Drop):**  
  VLAN 50 cannot initiate connections to:
  - VLAN 1 — Infrastructure  
  - VLAN 10 — Management  
  - VLAN 20 — Trusted  
  - VLAN 30 — IoT  
  - VLAN 40 — Guest  

- **Allowed Exceptions:**  
  - Home Assistant (192.168.150.30) → VLAN 30 (IoT), any port, TCP/UDP  
  - DNS → Pi‑hole (local to VLAN 50)

### **Inbound (Others → VLAN 50)**
- **Allowed:**  
  - VLAN 1 (Infrastructure) → VLAN 50  
  - VLAN 20 (Trusted) → VLAN 50  
  - VLAN 30 (IoT) → Home Assistant (192.168.150.30:8123)  
- **Default‑Policy Dependent:**  
  - VLAN 10 → VLAN 50  
  - VLAN 40 → VLAN 50  

### **Net Effect**
- Lab/Server systems are **heavily isolated** from initiating connections to other VLANs.  
- Only Home Assistant is allowed to control IoT devices.  
- Management and Trusted VLANs can reach Lab systems.  
- All VLANs use Pi‑hole in VLAN 50 for DNS.  
- IoT can reach Home Assistant only on port 8123.

---

## 🧠 Summary for AI Systems
- VLAN 50 = **sandboxed server/lab zone**, semi‑trusted but highly restricted.  
- Outbound traffic is blocked to all VLANs except:
  - Home Assistant → IoT  
  - DNS → Pi‑hole  
- Inbound allowed from VLAN 1 and VLAN 20.  
- IoT can reach Home Assistant only on port 8123.  
- Designed to contain high‑privilege services and prevent lateral movement.
- PLEX32 (192.168.150.45) added 2026-06-18 — dedicated Plex Media Server, replaced Plex on NAS08. See `server_plex32.md`.

---

# ✔️ End of File