Home Network Design & Set-Up

[abq]

Hello All,

I apologize in advance for this long post. I am redesigning our home network - thanks to a generous hEX donation from Patrick Goal is a secure home network with 3 wireless subnets (Home, Guest, & IOT/DMZ), and 4 wired subnets (Home, IOT/DMZ, Lab, & Management).
DSL ISP speed is ~15Mbps down/~1.5Mbps up, and I just signed up for TorGuard VPN.

I have following equipment to use for our core network:
1. MicroTik hEX RB750Gr3
2. Ubiquiti EdgeRouterX ER-X
3. Ubiquiti UniFi UAP-LR
4. Raspberry Pi3
5. Kangaroo Mini PC with Atom x5 Z8500, 2GB memory (Not ECC), & Win10-Home
(I also have a Supermicro A1SRi-2758 with 32GB ECC memory, but no case yet)
6. GL-iNet GL-MT300N-V2 (Travel Router)
7. Various VLAN capable 8, 16, 24, & 48 port Switches (I will start a separate thread for extending network & lab set-up)
8. Epson XP-830 Cloud Printer & Scanner (need to share with Home, Guest, & Lab)

I am considering the following software (many overlap functions & features, so don't need it all:
a. Radius server
b. PiHole server
c. OpenVPN server
d. DNS server (DNSSEC vs DNSCrypt)
e. DHCP server
f. PXE server
g. TFTP server
h. NTP server
i. PFSense
j. miFi Controller
k. UniFi Controller
l. NeoRouter server
m. DNSMASQ server
n. DUDE

My initial thought is hEX or ER-X for edge router, Pi3 or Kangaroo for DNS, DHCP, VPN, etc. Router's Eth1 could be Internet(DSL), Eth2 UAP-LR (3 VLAN of Home, Guest, & IOT), Eth3 Home, Eth4 Lab & Management, and Eth5 IOT/DMZ. I will like to use the GL-iNet for VPN security while on travel. I was thinking IOT/DMZ network doesn't need VPN (TorGuard), but needs to be extra segregated from rest of network.

Key software functions include some form of DNS, DHCP, NTP, Security, VPN, UniFi Controller, MiFi Controller, & some minimum monitoring capabilities.

I am open to recommendations & trade-offs, so please let me know if you have good articles & 'how to' guides for me to read.

Thank You,
ABQ

 

[Patrick]

Sounds like you have lots of gear for a build thread

 

[abq]

Did I list too much gear for a simple build thread?!?

I could start with the ER-X (ETH for DSL, Home, IOT/DMZ, Lab, & Management) & UAP-LR (VLANs for Home, Guest, & IOT SSIDs):

ER-X
ETH1: DSL
ETH2: Home, VLAN2, 192.168.2.1/24
ETH3: Lab, VLAN3, 192.168.3.1/24
ETH4: Management, VLAN4, 192.168.4.1/24
ETH5: UAP-LR (Home, Guest, & IOT - VLAN segments & SSIDs)
-Home: SSID 'Home', VLAN2, 192.168.2.1/24
-Guest: SSID 'Guest', VLAN1, 192.168.1.1/24
-IOT: SSID 'IOT', VLAN11, 192.168.11.1/24


Is this a good start?

 

[ridney]

Dont forget to include your voice network

 

[abq]

@ridney, thank you for the great idea. I don't have VoIP right now, but may be a good time to take the plunge. Good excuse to set up better QOS

 

[Kryax]

May also want to consider an "Untrusted" VLAN for untrusted devices that don't fall under IoT. Things like SMART TV's or other chatty devices that you want to segment for security reasons.