VLAN 50 — Lab / Servers Network

Subnet: 192.168.150.0/24

Last Updated: 2026-06-18

🧩 What This Network Is

VLAN 50 is the dedicated server and lab environment for the KingDezigns network.
It hosts Home Assistant, NAS systems, Pi‑hole, the Plex Media Server, and various self‑hosted services that require controlled access, stability, and isolation.

This VLAN is intentionally tightly contained, preventing lab systems or high‑privilege services from initiating connections into trusted or infrastructure networks.
Only specific exceptions—such as Home Assistant controlling IoT devices—are permitted.

This network functions as a sandboxed, semi‑trusted zone where critical services can operate safely without exposing the rest of the network to unnecessary risk.

📡 Access Types

LAN / Cable
WiFi

🌐 Subnet

192.168.150.0/24

🖥️ Expected Devices

Home Assistant
NAS08 (Pi‑hole, Nextcloud, Vaultwarden, nginx)
NAS16 (LAMP stack, MariaDB, Webmin)
PLEX32 (Plex Media Server — Dell Wyse 5070)
Additional lab servers
Test systems
Development containers

🔒 Security Rules for VLAN 50

Outbound (VLAN 50 → Others)

Blocked (Global Final Drop):
VLAN 50 cannot initiate connections to:
- VLAN 1 — Infrastructure
- VLAN 10 — Management
- VLAN 20 — Trusted
- VLAN 30 — IoT
- VLAN 40 — Guest
Allowed Exceptions:
- Home Assistant (192.168.150.30) → VLAN 30 (IoT), any port, TCP/UDP
- DNS → Pi‑hole (local to VLAN 50)

Inbound (Others → VLAN 50)

Allowed:
- VLAN 1 (Infrastructure) → VLAN 50
- VLAN 20 (Trusted) → VLAN 50
- VLAN 30 (IoT) → Home Assistant (192.168.150.30:8123)
Default‑Policy Dependent:
- VLAN 10 → VLAN 50
- VLAN 40 → VLAN 50

Net Effect

Lab/Server systems are heavily isolated from initiating connections to other VLANs.
Only Home Assistant is allowed to control IoT devices.
Management and Trusted VLANs can reach Lab systems.
All VLANs use Pi‑hole in VLAN 50 for DNS.
IoT can reach Home Assistant only on port 8123.

🧠 Summary for AI Systems

VLAN 50 = sandboxed server/lab zone, semi‑trusted but highly restricted.
Outbound traffic is blocked to all VLANs except:
- Home Assistant → IoT
- DNS → Pi‑hole
Inbound allowed from VLAN 1 and VLAN 20.
IoT can reach Home Assistant only on port 8123.
Designed to contain high‑privilege services and prevent lateral movement.
PLEX32 (192.168.150.45) added 2026-06-18 — dedicated Plex Media Server, replaced Plex on NAS08. See server_plex32.md.

2.7 KiB Raw Blame History Unescape Escape