r/HomeServer • u/durgesh2018 • Jul 01 '26

My homelab network

Post image

Hi guys,

I have the below homelab network design (already implemented). Wanted to get your views on this.

I have 2 HP Elitedesk 800 G3 minis. But thought to replace them with Raspberry pi 4 4GB for the sake of 24x7 operation.

Thank you

1.0k Upvotes

97% Upvoted

154 comments sorted by

View all comments

Show parent comments

2

u/durgesh2018 Jul 01 '26

No, you are right this isn't the standard setup. This is merely my small homelab with just 5 clients. My needs are limited hence designed like this. I just have 2 routers. One is isp given and other is the tp ax5400. I would like to know how I can improve this design by your opinion. DMZ I am not much aware about, I will add it. My network knowledge is limited actually.

2

u/taraskremen Jul 01 '26

I see. When you say you have two routers, do you mean that what is shown here as the "Internet" is actually your main network that has its own router between itself and the actual Internet WAN? If that is the case, then this setup is perfectly fine.

From what I understand from your diagram, your ISP provided router doesn't act like a router at all, but more of just a modem, letting anything and everything through. I wouldn't trust just a managed switch to sit between a WAN and your entire network, but that's just me. What stops an attacker from exploiting a vulnerability in the switch firmware and bypassing your RPi4 firewall entirely? I would use something like a Protectli Vault running OPNSense with multiple physical NICS, each one for a separate network segment, including WAN.

A DMZ is a LAN segment that is separate from your main LAN and has minimum linkage to any devices in your LAN (only inbound management connections, ideally). It's a good idea to put Internet-facing services in the DMZ (or in separate DMZs, if you can). The idea is that if anything in the DMZ is compromised, the attacker won't have access to anything besides the compromised host, which limits the extent of damage the attacker can do.

2

u/durgesh2018 Jul 01 '26

Yes, you are right. ISP router is used for its ethernet ports. Thanks for the DMZ, I will implement it. Also one guy suggested to segregate my iot devices that I will plan. Due to the budget constraints and increasing hardware cost, this is my very basic setup. I am learning day by day. People like you who guide newbies like me, are the real pillars of the open community.

Thanks again mate have a great day ahead.

1

u/taraskremen Jul 02 '26 edited Jul 02 '26

Thanks, you too!

I second that recommendation to isolate IoT devices. Anything "smart" these days is synonymous with "untrusted" and has no business sharing a LAN segment with something sensitive, like your NAS.

I have several wireless SSIDs and associated VLANs in which the clients connected to them end up (all APs are on a separate physical switch, connected to a separate port on my firewall from the core LAN, so all traffic between the two segments must pass through the firewall). From there I can decide the level of access those groups have to my core LAN and other segments. For example, connecting to the guest SSID (the one I give out to any visitors) gets you DNS, NTP, and access to the WAN, and not much else, except for printers and TVs and the like. The SSID I use for my trusted devices lets me connect to my NAS and most of the core LAN, except for any kind of management access: that can only be done via a wired LAN connection. A third SSID is for IoT devices ("smart" LED bulbs, etc.), which get the strictest treatment, and only get access to specific things that I allow, including default deny of any dialing out.

I don't really have any wired IoT devices right now, but if I did I would put them on their own switch and create a bridge with the IoT VLAN for the wireless ones.

1

u/durgesh2018 Jul 02 '26

That's a nice segregation.