New VLANs

Management and Services VLANs

#

Two new core networks were created first.

Management Network
VLAN ID: 10
Subnet: 172.16.10.0/24
Gateway: 172.16.10.1
Purpose: Administration VLAN

Services Network
VLAN ID: 11
Subnet: 172.16.11.0/24
Gateway: 172.16.11.1
Purpose: internal services such as DNS, reverse proxy, application frontends, and migrated current services

The Management Network is intended for infrastructure control planes and administrative access. This includes all core infrastructure devices and management interfaces exposed by services where possible.

• UDM SE management access
• FortiSwitch management
• UniFi switches and APs
• APC UPS NMCs
• Proxmox Hosts
• iDRAC
• etc.

The Services Network is intended for applications and services that clients may need to consume.

• Pi-hole DNS
• Traefik
• Plex Media Server
• Nextcloud
• GameShelf
• etc.

The intended distinction is that a device can provide a service on VLAN 11 while still being administered over VLAN 10, avoiding exposing its management interface to devices that are allowed to access the Services Network.

Blackhole (Parking) VLAN

#

Blackhole Network (No Assignment)

Name: Blackhole Network (No Assignment)
VLAN ID: 999
Subnet: 172.16.254.0/24
DHCP: None
IPv6: None
Internet Access: Disabled

The purpose of this VLAN is to act as a dead landing zone for accidental untagged traffic. It does not need to be allowed/tagged across the main 10G uplink unless there is a reason to carry that parking VLAN between switches, which, there is not.

Final VLAN Direction

#

The network is being standardized around a structure that cleanly maps VLAN IDs to subnets.

VLAN 1    Native Network       172.16.1.0/24
VLAN 2    IoT Network          172.16.2.0/24
VLAN 3    Camera Network       172.16.3.0/24
VLAN 10   Management Network   172.16.10.0/24
VLAN 11   Services Network     172.16.11.0/24
VLAN 20   Kidcave Network      172.16.20.0/24
VLAN 99   Guest Network        172.16.99.0/24
VLAN 999  Blackhole Network    172.16.254.0/24 
                               (NO DHCP IN USE)

As the home lab continues to grow, this makes it much easier to know where a device belongs just by looking at its IP address.