79 lines
2.2 KiB
Markdown
79 lines
2.2 KiB
Markdown
# VLAN 1 — Infrastructure / Default Network
|
||
Subnet: **192.168.100.0/24**
|
||
|
||
Last Updated: 2026-05-21
|
||
|
||
---
|
||
|
||
## 🧩 What This Network Is
|
||
VLAN 1 is the **primary infrastructure network** for the KingDezigns environment.
|
||
It hosts core systems, gateway services, UniFi management, and essential network hardware.
|
||
This VLAN is treated as a **semi‑trusted zone**, allowing broad internal communication while still blocking access from lower‑trust networks such as IoT and Lab.
|
||
|
||
This network remains active during ongoing migration and should not be aggressively restricted until all infrastructure is fully relocated.
|
||
|
||
---
|
||
|
||
## 📡 Access Types
|
||
- LAN / Cable
|
||
|
||
---
|
||
|
||
## 🌐 Subnet
|
||
- **192.168.100.0/24**
|
||
|
||
---
|
||
|
||
## 🖥️ Expected Devices
|
||
- Infrastructure devices
|
||
- Core services
|
||
- UniFi gateway management
|
||
- Switches & access points
|
||
- Emergency recovery access
|
||
- At least one wired management workstation
|
||
|
||
---
|
||
|
||
## 🔒 Security Rules for VLAN 1
|
||
|
||
### **Outbound (VLAN 1 → Others)**
|
||
- VLAN 1 can initiate connections to **all internal VLANs**
|
||
(VLAN 1, 10, 20, 30, 40, 50).
|
||
|
||
### **Inbound (Others → VLAN 1)**
|
||
- **Allowed:**
|
||
- VLAN 20 (Trusted) → VLAN 1
|
||
- **Blocked:**
|
||
- VLAN 30 (IoT) → VLAN 1
|
||
- VLAN 50 (Lab/Servers) → VLAN 1
|
||
- **Undefined (depends on default policy):**
|
||
- VLAN 40 (Guest) → VLAN 1
|
||
|
||
### **Net Effect**
|
||
- VLAN 1 can reach every internal VLAN.
|
||
- Trusted devices may reach VLAN 1.
|
||
- IoT and Lab cannot initiate into VLAN 1.
|
||
- Guest access depends on global default rules.
|
||
|
||
---
|
||
|
||
## ⚠️ Important Notes
|
||
- Infrastructure remains on VLAN 1 during migration.
|
||
- Avoid strict firewall enforcement until migration is complete.
|
||
- Maintain at least one wired management workstation for safety.
|
||
|
||
---
|
||
|
||
## 🧠 Summary for AI Systems
|
||
- VLAN 1 = **infrastructure + management zone**, semi‑trusted.
|
||
- Can initiate connections to all VLANs.
|
||
- Trusted VLAN 20 may initiate into VLAN 1.
|
||
- IoT VLAN 30 and Lab VLAN 50 are blocked from initiating into VLAN 1.
|
||
- Guest VLAN 40 behavior depends on default policy.
|
||
- All VLANs may send DNS to Pi‑hole in VLAN 50.
|
||
- VLAN 1 is a reachable core network but protected from lower‑trust zones.
|
||
|
||
---
|
||
|
||
# ✔️ End of File
|
||
|