Notice: you're looking at a read-only mirror of our Dokuwiki.

Network Topology

This document outlines the network topology, VLAN segmentation, firewall zone policies, and external IP/NAT allocations configured on the primary router (int-fw-01).

Physical Interfaces & VLAN Segmentation

The internal network connects over an 802.3ad LACP bond interface (bond0) across eth2 and eth3, trunking 802.1Q tagged VLANs to core switching infrastructure.

VLAN & Subnet Allocations

Additional Routed Subnets

• 10.20.64.0/22 & 2602:fa6d:abc:64::/64 (Netbird VPN): Routed via next-hop 10.20.6.7 / 2602:fa6d:abc:6::7 on interface peth6 in the DMZ.
• 10.80.216.0/24 (Media Rack Containers, unused): Routed via next-hop 10.20.100.110 on bond0.100.

Firewall Zones

Inter-Zone Access & Security Policies

Stateful return traffic is globally accepted. The general communication model between zones is outlined below (individual pinholes and edge cases exist for specific hosts and services):

flowchart TD
    WAN["WAN"]

    subgraph Zones ["Firewall Zones"]
        Management["Management"]
        Members["Members"]
        Guests["Guests"]
        DMZ["DMZ"]
        Isolated["Isolated"]
    end

    %% Outbound to Internet
    Management -->|"Outbound"| WAN
    Members -->|"Outbound"| WAN
    Guests -->|"Outbound"| WAN
    DMZ -->|"Outbound"| WAN
    Isolated -.->|"Partial (IoT/DMX)"| WAN

    %% Inter-Zone Access
    Members --> DMZ
    Guests -->|"Public services"| DMZ

High-Level Inter-Zone Matrix

*: Edge cases exist.

Policy Summary by Flow

• WAN Inbound:

  • To DMZ: Ingress is strictly restricted to published services via DNAT (Forgejo, Pelican game servers, Netbird STUN).
  • To Local: Only SIT 6in4 encapsulation (protocol 41) from the tunnel broker and ICMPv6 echo requests are accepted; everything else is dropped.
  • To All Other Zones: Dropped unconditionally.

• Internet Egress (to WAN):

  • Members, DMZ, Management, Guests: Unrestricted outbound access.
  • Isolated: Default rejected. Specific exceptions allow outbound access for IoT devices (10.20.130.0/24) and lighting control operator endpoints on DMX. Quarantined devices (bond0.300) cannot reach the Internet.

• Members Access:

  • To DMZ & Guests: Open access.
  • To Management: Blocked by default. Pinhole exceptions exist for management workstations, monitoring servers (SNMP/metrics/ICMP), and specific admin endpoints (e.g. JetKVM).
  • To Isolated: Blocked by default, with pinhole exceptions for media streaming (Apple TVs), home automation (Home Assistant controlling IoT devices and ArtNet), and lighting control.

• DMZ Access to Internal Zones:

  • Blocked by default.
  • Edge cases include Netbird VPN client pools routed through the DMZ into internal service and management subnets, as well as ingress reverse proxies contacting specific internal backends (e.g., Home Assistant).

• Isolated Access to Internal Zones:

  • Blocked by default.
  • Edge cases allow Home Assistant in the IoT subnet to query specific management targets (such as smart PDUs), and designated operator ranges in DMX to communicate back to member networks.
  • Intra-zone traffic within Isolated is filtered to prevent unmanaged lateral movement between IoT, DMX, and quarantine networks.

• Traffic to Local (Router Services):

  • All internal zones are permitted access to essential network services: DHCP (UDP 67/68, DHCPv6), DNS (UDP/TCP 53), NTP (UDP 123), and ICMP ping.
  • Administrative access (SSH) to the router is restricted to Management, Member subnets, and authorized Netbird VPN clients.
  • Prometheus exporters and SNMP metrics are restricted to designated monitoring servers.

External IP Allocations & NAT

Public IP Assignments

The primary WAN interface (bond0.412) is configured with a static /29 subnet from the ISP (Astound Broadband):

• Subnet: 104.202.86.120/29
• Upstream Gateway: 104.202.86.121
• Assigned Addresses:
  • 104.202.86.122 (Primary WAN & Egress): Router gateway IP, 6in4 SIT IPv6 tunnel endpoint, and the primary outbound SNAT/masquerade address for internal networks.
  • 104.202.86.123 (External Web / Git / VPN Services): Dedicated public IP for Forgejo and Netbird STUN.
  • 104.202.86.124 (Pelican Game Hosting): Dedicated public IP for Pelican-Eggs game server ports.

Public IPv6 Allocation

• Upstream IPv6 connectivity is provided via a 6in4 tunnel (tun0) to 199.255.18.160.
• The local tunnel address is 2602:fa6d:abc:ffff::2/64.
• Routed prefix 2602:fa6d:abc::/48 is assigned natively across internal VLANs as /64 subnets with router advertisements enabled.

Inbound Port Forwarding (DNAT)

Destination NAT routes traffic arriving on secondary public IPs to internal DMZ hosts:

Note: Mirror hairpin DNAT rules (167, 168, 169, 173) are configured on all Inside-Interfaces to allow internal devices to access these public services transparently via their external IPs.

Outbound Source NAT (SNAT)