VLAN 1 — Infrastructure / Default Network

Subnet: 192.168.100.0/24

Last Updated: 2026-05-21

🧩 What This Network Is

VLAN 1 is the primary infrastructure network for the KingDezigns environment.
It hosts core systems, gateway services, UniFi management, and essential network hardware.
This VLAN is treated as a semi‑trusted zone, allowing broad internal communication while still blocking access from lower‑trust networks such as IoT and Lab.

This network remains active during ongoing migration and should not be aggressively restricted until all infrastructure is fully relocated.

📡 Access Types

LAN / Cable

🌐 Subnet

192.168.100.0/24

🖥️ Expected Devices

Infrastructure devices
Core services
UniFi gateway management
Switches & access points
Emergency recovery access
At least one wired management workstation

🔒 Security Rules for VLAN 1

Outbound (VLAN 1 → Others)

VLAN 1 can initiate connections to all internal VLANs
(VLAN 1, 10, 20, 30, 40, 50).

Inbound (Others → VLAN 1)

Allowed:
- VLAN 20 (Trusted) → VLAN 1
Blocked:
- VLAN 30 (IoT) → VLAN 1
- VLAN 50 (Lab/Servers) → VLAN 1
Undefined (depends on default policy):
- VLAN 40 (Guest) → VLAN 1

Net Effect

VLAN 1 can reach every internal VLAN.
Trusted devices may reach VLAN 1.
IoT and Lab cannot initiate into VLAN 1.
Guest access depends on global default rules.

⚠️ Important Notes

Infrastructure remains on VLAN 1 during migration.
Avoid strict firewall enforcement until migration is complete.
Maintain at least one wired management workstation for safety.

🧠 Summary for AI Systems

VLAN 1 = infrastructure + management zone, semi‑trusted.
Can initiate connections to all VLANs.
Trusted VLAN 20 may initiate into VLAN 1.
IoT VLAN 30 and Lab VLAN 50 are blocked from initiating into VLAN 1.
Guest VLAN 40 behavior depends on default policy.
All VLANs may send DNS to Pi‑hole in VLAN 50.
VLAN 1 is a reachable core network but protected from lower‑trust zones.

2.2 KiB Raw Blame History Unescape Escape