Are there problems I can avoid by subnetting differently? I'm setting up a modest home lan, and I want to know if I missed anything critical or if there's a simpler way to subnet with given requirements. My requirements are: hardware nodes, low power (except workstation), gigabyte networking, except lightweight www services, extremely configurable, separate vlans/subnets for fw, vpn, dmz, lan, and wifi.
link to nwdiag png output: https://postimg.cc/HcGhPkw7
Note: RPI is a bottleneck at wifi segment and will be replaced soon.
Q: Should the UPS be placed on the vpn network segment for easier remote power-management options or is this a security risk?
If you're curious how I made the image, it's nwdiag -- very cool program that has been around for a little while (oreilly books etc).
and here is the "source code":
nwdiag {
inet[shape = "cloud"];
inet -- nap; nap -- noc;
network comcast {
address = "71.-.-.-/16";
noc;
edge; }
edge -- modem; modem[address="71.-.-.-,SB6141"]; modem -- router;
group isp { color = "#ccddff"; noc edge; }
network fw {
address="10.12.176.0/28";
router [address="10.1.176.1,Soekris net6501/npf"];
dmz[address="10.12.176.2, Cisco Catalyst 1"];
lan[address="10.12.176.3, Cisco Catalyst 2"];
vpn[address="10.12.176.4,apu2e4 / NetBSD,racoon vpn"]; }
network vpn {
address="10.84.37.176/30"
vpn[address="10.84.37.177"];
workstation [address="10.84.37.178,HP z840 / Xen"]; }
network lan {
address="192.168.42.0/28"
lan[address="192.168.42.1"];
printer[address="192.168.42.2,HP 4250tn"]
wap[address="192.168.42.3,RPI3B+/ath9k,NetBSD"];
ups[address="192.168.42.4,Eaton 9100"];
}
network dmz {
address="172.16.93.11/28";
dmz[address="172.16.93.8"];
dns1[address="172.16.93.9,BeagleBone Black / Minix3"];
dns2[address="172.16.93.10,BeagleBone Black / Minix3"];
web[address="172.16.93.11,BeagleBone Black / Minix3"]; }
network wifi {
address="192.168.221.1/28";
wap[address="192.168.221.1"];
iphone1[address=".dhcp"];
iphone2[address=".dhcp"];
ipad[address=".dhcp"];
macbookair[address=".dhcp"]; }
}
UPDATE
Okay, so I've been reading up a bit and here are my modifications to the network (and the code). What I think I need to do for maximum security (a requirement I accidentally omitted in my OP) is have each switch and router on a /30, but I'm not sure exactly how to implement that because I also need more than one or two hosts on most network segments.
Also, I use three different private addressing schemes to be able to tell them apart easily in tcpdump or similar. I truly don't know how much I'm going to regret this in the future (perhaps someone could tell me their experience with that).
If my vpn addressing looks messy it's on purpose, to defeat guess attacks, i.e., 192.168.1.1 .2 .3 .4, easily guessed, whereas 10.84.37.178, not so much. If somebody tells me different and gives me a compelling reason to do so I will change it. That's why I'm here!
Anyway, this is my best try and link to the updated png: https://postimg.cc/qzy774xB
nwdiag {
isp[shape = "cloud"];
isp -- modem;
modem;
modem -- fw-1;
network fw {
address="10.12.176.0/30";
fw-1 [address="10.12.176.1,Soekris net6501/npf"];
vpn-1[address="10.13.176.1,apu2e4 / NetBSD,racoon vpn"];
dmz-1[address="10.14.176.1, Catalyst 1"];
lan-1[address="10.15.176.1, Catalyst 2"];
}
network vpn {
address="10.84.37.176/30";
vpn-1[address="10.84.37.177"];
workstation [address="10.84.37.178,HP z840 / Xen"];
}
network dmz {
address="172.16.93.11/28";
dmz-1[address="172.16.93.8"];
dns-1[address="172.16.93.9,BeagleBone Black / Minix3"];
dns-2[address="172.16.93.10,BeagleBone Black / Minix3"];
web-1[address="172.16.93.11,BeagleBone Black / Minix3"];
}
network lan {
address="192.168.42.0/28"
lan-1[address="192.168.42.1"];
wap-1[address="192.168.42.3,RPI3B+/ath9k,NetBSD"];
lp-1[address="192.168.42.2,HP 4250tn"]
ups-1[address="192.168.42.4,Eaton 9100"];
}
network wifi {
address="192.168.221.1/28";
wap-1[address="192.168.221.1"];
iphone-1[address=".dhcp"];
iphone-2[address=".dhcp"];
ipad[address=".dhcp"];
macbookair[address=".dhcp"];
}
}
