252 lines
10 KiB
Markdown
252 lines
10 KiB
Markdown
# Home Network Infrastructure Documentation
|
|
|
|
## Overview
|
|
|
|
This documentation covers the complete home network setup including IP allocation scheme, DHCP reservations, VLANs, and device inventory for a 192.168.0.0/24 network managed by OPNsense.
|
|
|
|
**Network:** 192.168.0.0/24
|
|
**Router:** OPNsense at 192.168.0.1
|
|
**Last Updated:** June 1, 2026
|
|
|
|
## Network Architecture
|
|
|
|
### Core Infrastructure
|
|
- **Router/Firewall:** OPNsense (192.168.0.1)
|
|
- **DNS/Ad Blocking:** AdGuard Home (192.168.0.11)
|
|
- **Reverse Proxy:** Nginx Proxy Manager (192.168.0.10)
|
|
- **VPN:** Tailscale integration
|
|
|
|
### IP Allocation Scheme
|
|
|
|
```
|
|
192.168.0.1 - OPNsense Router
|
|
192.168.0.2-9 - Reserved for future infrastructure
|
|
192.168.0.10-29 - Core Services (VMs/Containers)
|
|
192.168.0.30-49 - User Computers & Laptops
|
|
192.168.0.50-69 - Mobile Devices & Tablets
|
|
192.168.0.70-79 - TVs & Media Devices
|
|
192.168.0.80-99 - Available (IoT devices migrated to VLAN 20)
|
|
192.168.0.100-119 - Network Infrastructure (APs, switches)
|
|
192.168.0.120-139 - Hypervisors & Storage
|
|
192.168.0.140-149 - Reserved for expansion
|
|
192.168.0.150-200 - DHCP Pool (Guest devices only)
|
|
192.168.0.201-254 - Future expansion
|
|
```
|
|
|
|
### VLAN Structure
|
|
|
|
| Network | Subnet | VLAN | SSID | Purpose |
|
|
|---------|--------|------|------|---------|
|
|
| **Main LAN** | 192.168.0.0/24 | (none) | TeePee | General devices, VMs, servers |
|
|
| **IoT Devices** | 10.10.3.0/24 | 20 | IoTeePee | Smart home, bulbs, plugs, sensors |
|
|
| **Security Cameras** | 10.10.2.0/24 | 30 | Cameras | IP cameras (wired, pending migration) |
|
|
|
|
### Firewall Rules
|
|
|
|
- **IoT VLAN (20):** Devices can reach the internet and Home Assistant (192.168.0.15) only. All other VLAN access is blocked.
|
|
- **Camera VLAN (30):** Devices can reach the internet, Home Assistant (192.168.0.15), and the Frigate/FoundryVTT VM (192.168.0.16) only.
|
|
- **Main LAN:** Unrestricted access to all VLANs and the internet.
|
|
|
|
## Infrastructure - Core Services (10-29)
|
|
|
|
| Hostname | Service | IP | MAC Address | Type | Status |
|
|
|----------|---------|-----|-------------|------|--------|
|
|
| npm | Nginx Proxy Manager | 192.168.0.10 | bc:24:11:5b:1d:a2 | Docker | ✅ Active |
|
|
| adguard | AdGuard Home | 192.168.0.11 | BC:24:11:47:27:43 | LXC | ✅ Active |
|
|
| vaultwarden | Vaultwarden | 192.168.0.12 | BC:24:11:A8:44:A1 | LXC | ✅ Active |
|
|
| nextcloud | Nextcloud | 192.168.0.14 | 02:99:5b:4c:b3:e6 | VM | ✅ Active |
|
|
| homeassistant | Home Assistant | 192.168.0.15 | 02:46:0b:d8:35:7c | VM | ✅ Active |
|
|
| foundryvtt-frigate | Frigate (NVR) + FoundryVTT | 192.168.0.16 | bc:24:11:ad:cb:f6 | Pop!_OS VM | ✅ Active |
|
|
| openmediavault | OpenMediaVault (NAS) | 192.168.0.17 | bc:24:11:2c:68:58 | VM | ✅ Active |
|
|
| wordpress-irodori | WordPress - Irodori | 192.168.0.18 | bc:24:11:42:70:2a | VM | ✅ Active |
|
|
| wordpress-dustin | WordPress - Dustin | 192.168.0.19 | bc:24:11:7e:fc:ff | VM | ✅ Active |
|
|
|
|
## User Devices - Computers (30-49)
|
|
|
|
| Hostname | Device | IP | MAC Address | Notes |
|
|
|----------|--------|-----|-------------|-------|
|
|
| jamiepc | Jamie's PC | 192.168.0.30 | 50:eb:f6:5a:71:f2 | Primary workstation |
|
|
| 3d-printer | 3D Printer (Bambu A1) | 192.168.0.32 | 10:b4:1d:d7:02:2c | Network printer |
|
|
| haruka-laptop | Haruka's Laptop | 192.168.0.33 | a8:41:f4:8d:b9:5b | Laptop |
|
|
| hp-printer | HP Printer | 192.168.0.34 | a8:b1:3b:01:c2:ce | Network printer |
|
|
|
|
## Mobile Devices (50-69)
|
|
|
|
| Hostname | Device | IP | MAC Address | Notes |
|
|
|----------|--------|-----|-------------|-------|
|
|
| jamie-phone | Jamie's Mobile (S23) | 192.168.0.50 | 1a:de:e8:f1:a5:d3 | Samsung Galaxy S23 |
|
|
| haruka-phone | Haruka's Mobile (S25) | 192.168.0.51 | 4e:c7:f7:bc:f1:c5 | Samsung Galaxy S25 |
|
|
| samsung-tablet | Samsung Galaxy Tablet | 192.168.0.52 | ee:a1:23:9f:1e:c5 | Tablet |
|
|
|
|
## TVs & Media Devices (70-79)
|
|
|
|
| Hostname | Device | IP | MAC Address | Notes |
|
|
|----------|--------|-----|-------------|-------|
|
|
| unknown-media | Unknown Media Device | 192.168.0.71 | a0:d0:5b:c7:13:28 | Likely TV or streaming |
|
|
|
|
## IoT Devices (VLAN 20 — 10.10.3.0/24)
|
|
|
|
All smart home devices have been migrated from the main LAN (192.168.0.80-94) to the IoT network (10.10.3.0/24, VLAN 20, SSID: IoTeePee). They now receive dynamic IPs via DHCP on the IoT interface. Static IPs are no longer assigned.
|
|
|
|
| Hostname | Device | MAC Address | Notes |
|
|
|----------|--------|-------------|-------|
|
|
| tapo-hub-h100 | Tapo Hub/Chime H100 | a8:29:48:88:84:d6 | Smart home hub |
|
|
| tapo-leak-t300 | Tapo Water Leak Sensor T300 | 20:23:51:d0:b1:7d | Battery powered |
|
|
| tapo-bedside-l530 | Tapo Smart Bulb L530 - Bedside | 20:23:51:08:19:76 | Smart bulb |
|
|
| tapo-bedroom-l530 | Tapo Smart Bulb L530 - Bedroom | b0:19:21:17:a7:c3 | Smart bulb |
|
|
| tapo-hallway-a-l530 | Tapo Smart Bulb L530 - Hallway A | f0:09:0d:b6:4a:8d | Smart bulb |
|
|
| tapo-hallway-b-l530 | Tapo Smart Bulb L530 - Hallway B | 40:ae:30:67:a2:46 | Smart bulb |
|
|
| tapo-porch-l530 | Tapo Smart Bulb L530 - Porch | 3c:64:cf:63:58:da | Smart bulb |
|
|
| tapo-plug-a-p110 | Tapo P110 Smart Plug | 40:ae:30:50:c8:62 | Power monitoring |
|
|
| tapo-plug-b-p110 | Tapo P110 Smart Plug | b0:19:21:17:a5:7e | Power monitoring |
|
|
| yeelight-color4 | Yeelight Smart Bulb | 58:b6:23:41:e1:ff | Smart bulb |
|
|
| reolink-kitchen | Reolink E1 Camera - Kitchen | 54:ef:33:bd:be:e0 | Security camera |
|
|
| reolink-outdoor | Reolink Camera - Outdoor | e8:ca:c8:6d:b0:7f | Security camera |
|
|
| TPC100 | Tuya Backyard Camera | a8:b1:3b:01:c2:ce | Backyard Camera |
|
|
| TPC100 | Tuya Living Room Camera | 58-04-4F-4A-D1-E1 | Living Room Camera |
|
|
| TPC120 | Tuya Garden Camera | B8-FB-B3-7A-68-81 | Garden Camera |
|
|
|
|
### Pending Camera Migration (VLAN 30 — 10.10.2.0/24)
|
|
|
|
The three IP cameras (TPC100 backyard, TPC100 living room, TPC120 garden — formerly 192.168.0.92, .93, .94) will be migrated to the Camera network (10.10.2.0/24, VLAN 30) once physically reconnected. Until then, they remain on the IoT network (VLAN 20).
|
|
|
|
## Network Infrastructure (100-119)
|
|
|
|
| Hostname | Device | IP | MAC Address | Notes |
|
|
|----------|--------|-----|-------------|-------|
|
|
| u7-lite | UniFi U7 Lite AP | 192.168.0.159 | — | Managed by UniFi OS controller; pending static DHCP reservation |
|
|
|
|
## Hypervisors & Storage (120-139)
|
|
|
|
| Hostname | Device | IP | MAC Address | Notes |
|
|
|----------|--------|-----|-------------|-------|
|
|
| proxmox-1 | Proxmox Server 1 | 192.168.0.120 | 10:ff:e0:11:46:9f | Primary hypervisor |
|
|
| proxmox-2 | Proxmox Server 2 | 192.168.0.121 | 74:d4:35:97:f4:9d | Secondary hypervisor |
|
|
|
|
## DHCP Configuration
|
|
|
|
### Current Settings
|
|
- **DHCP Pool:** 192.168.0.150 - 192.168.0.200 (51 addresses)
|
|
- **Purpose:** Guest devices and temporary connections
|
|
- **Static Reservations:** 20 devices with confirmed MACs
|
|
|
|
### DNS Settings
|
|
- **Primary DNS:** 192.168.0.11 (AdGuard Home)
|
|
- **Secondary DNS:** 192.168.0.1 (OPNsense fallback)
|
|
|
|
## VPN / Tailscale
|
|
|
|
| IP | MAC Address | Purpose |
|
|
|----|-------------|---------|
|
|
| 100.65.128.1 | e0:cb:19:60:87:70 | Tailscale VLAN device |
|
|
| 100.65.159.134 | bc:24:11:be:cf:af | Tailscale VLAN device (permanent) |
|
|
|
|
## Network Statistics
|
|
|
|
- **Total Active Devices:** 33
|
|
- **VMs/Containers:** 10
|
|
- **User Computers:** 5 (3 PCs + 2 printers)
|
|
- **Mobile Devices:** 3 (2 phones + 1 tablet)
|
|
- **TVs & Media:** 3
|
|
- **Smart Home/IoT:** 15 (9 Tapo + 1 Yeelight + 2 Reolink + 3 Tuya) — all on VLAN 20
|
|
- **Network Infrastructure:** 1 (UniFi U7 Lite AP)
|
|
- **Hypervisors:** 2
|
|
- **Static Assignments:** 20 devices
|
|
- **DHCP Pool Size:** 51 addresses
|
|
|
|
## Known Issues
|
|
|
|
### Tapo App Issues
|
|
- Some Tapo devices may show incorrect info in app after VLAN migration
|
|
- **3D printer plug:** App showing wrong MAC, verify after print finishes
|
|
- **Resolution:** Use OPNsense ARP table MACs as source of truth
|
|
|
|
### Devices Needing Attention
|
|
- Factory reset recommended for Tapo devices showing app glitches after VLAN migration
|
|
|
|
## Maintenance Tasks
|
|
|
|
### Regular Tasks
|
|
- [ ] Monthly: Review DHCP leases for new unknown devices
|
|
- [ ] Quarterly: Audit static IP assignments
|
|
- [ ] Quarterly: Update device firmware (routers, APs, cameras)
|
|
- [ ] Yearly: Review and optimize IP allocation scheme
|
|
|
|
### Pending Tasks
|
|
- [ ] Factory reset Tapo devices with app issues
|
|
|
|
## Security Considerations
|
|
|
|
1. **Network Segmentation:** VLAN 20 (IoT) and VLAN 30 (Cameras) isolate untrusted devices from the main LAN
|
|
2. **Guest Network:** DHCP pool isolated from static devices
|
|
3. **Firewall Rules:** OPNsense enforces strict inter-VLAN rules — IoT can only reach HA; Cameras can only reach HA and Frigate/FoundryVTT
|
|
4. **DNS Filtering:** AdGuard Home provides ad/tracker blocking
|
|
5. **Remote Access:** Tailscale VPN for secure remote access
|
|
|
|
## Backup Strategy
|
|
|
|
### What to Backup
|
|
1. **OPNsense Configuration:** XML backup from web interface
|
|
2. **DHCP Reservations:** CSV export (included in this repo)
|
|
3. **Network Documentation:** This README and related files
|
|
4. **AdGuard Home Config:** Settings and filter lists
|
|
|
|
## Migration Notes
|
|
|
|
## Troubleshooting
|
|
|
|
### Device Not Getting Reserved IP
|
|
1. Check MAC address in router's ARP table
|
|
2. Verify DHCP reservation exists
|
|
3. Release/renew DHCP lease on device
|
|
4. Check for MAC address conflicts
|
|
|
|
### Cannot Access Device
|
|
1. Verify device is online (ping IP)
|
|
2. Check if device changed MAC (WiFi vs Ethernet)
|
|
3. Review firewall rules in OPNsense
|
|
4. Check DNS resolution in AdGuard Home
|
|
|
|
### IoT Device Issues
|
|
1. Tapo devices: Check app vs ARP table for correct MAC
|
|
2. Battery devices (water sensor): Won't always appear in ARP
|
|
3. For offline devices: Power cycle or factory reset
|
|
|
|
## Tools & Commands
|
|
|
|
### Identify Device by MAC
|
|
```bash
|
|
# Online MAC lookup
|
|
curl -s "https://api.macvendors.com/5c:62:8b:8d:cb:d6"
|
|
|
|
# Or use OUI lookup
|
|
# First 6 characters (3 octets) identify manufacturer
|
|
```
|
|
|
|
### Scan Network
|
|
```bash
|
|
# Using nmap
|
|
nmap -sn 192.168.0.0/24
|
|
|
|
# Using arp-scan (more reliable)
|
|
sudo arp-scan --interface=eth0 192.168.0.0/24
|
|
```
|
|
|
|
### Check Current IP/MAC
|
|
```bash
|
|
# View ARP table
|
|
arp -a
|
|
|
|
# Or on OPNsense
|
|
arp -an | grep 192.168.0
|
|
```
|
|
|
|
---
|
|
|
|
**Configuration Files:**
|
|
- `dhcp-reservations.csv` - DHCP static assignments export
|
|
- `Network Inventory.docx` - Human-readable network map
|
|
- `opnsense-config.xml` - OPNsense configuration backup (not in repo)
|
|
|
|
**Last Updated:** June 1, 2026
|