index

Homelab Overview

Intro

This page is a living reference and inventory of my homelab setup - its current state and future work. I expect to periodically update it as changes are made to the homelab environment.

Purpose

This homelab grew out of my experience taking down my home network experimenting with Pihole. I needed a way to segment my network and have a sandbox environment where misconfigurations were self-contained and other people and devices would not be affected. It has since evolved as a way to learn about networking, self-host applications and services, repurpose old hardware, and explore networking, security, and infrastructure concepts without running up an AWS bill.

Architecture

Network Overview

VLAN Scheme

  • Management (1) - network devices (i.e. gateway, switches, access points, etc.)
  • Trusted (10) - personal devices, consoles, and IoT (planned migration to IoT VLAN)
  • IoT (20) - provisioned, migration planned
  • Guest (30) - provisioned, unused
  • Homelab (40) - servers, sandboxes

Segmentation

  • VLANs designed to be isolated from each other
  • Inter-VLAN ALLOW from the network device list (tablet, Roku stick, Roku TV) which contains the devices running the Jellyfin client application (trusted) —> media server (homelab). Allow established/related return traffic
  • IPv6 not configured

Networking Hardware

  • Gateway - UniFi Cloud Gateway Ultra
  • Switch - USW-Lite-8-PoE
  • Access points - U6+ & U6 Lite

24/7 Servers

Raspberry Pi 4 - running Home Assistant OS. Currently supporting lighting automation with Phillips Hue bulbs, Hue motion sensor, an Aqara presence sensor communicating over Zigbee, and Alexa speakers.

2017 MacBook Air - Ubuntu Server OS. Running Jellyfin media server.

2018 MacBook Pro - Ubuntu Server OS. Running self-hosted todo list app (PWA, API, DB)

Remote Access

Tailscale provides an encrypted tunnel to communicate with specific devices on the network securely. At present, there are no access control lists configured to prevent any devices on the tailnet from communicating with each other. The devices currently on my tailnet are:

  • Phone
  • Home Assistant
  • MacBook Air
  • MacBook Pro
  • Daily laptop

Using Tailscale allows me to access Home Assistant from my phone and laptop while I am away securely. Without access control lists, the devices running services are able to talk to my Home Assistant instance, which is not ideal and is referenced in the future work section.

Security

IPS - block all Tor/Tor-associated traffic. In reviewing logs, I noticed a significant amount of traffic originating from Tor-associated IP addresses to two devices on the homelab VLAN. Until I am able to identify and investigate further, I’ve configured the IPS to block all Tor traffic and traffic from Tor-associated IP addresses.

DHCP guarding - enabled on all VLANs to prevent rogue or unauthorized DHCP servers on the network.

Roadmap

There’s still much to be done to harden the network. This document will be updated as changes are made. Future work is as follows:

  • Tailscale access control lists - not all devices on the tailnet need to be able to communicate with each other on all ports. Access control lists need to be configured to enforce principle of least privilege
  • Migrate IoT devices to IoT VLAN (20) - self explanatory. IoT devices with weak or opaque security controls should live on their own VLAN. Access and functionality needs to be configured to balance security and functionality so features like AirPlay and communication with smart speakers are possible.
  • Plan and configure guest network - the guest network is currently unused. I need to figure out a method of adding an authentication/approval layer to the trusted VLAN and a method for visitors to seamlessly log on to the WiFi.
  • Migrate Jellyfin server - to dedicated device and more appropriate VLAN to avoid poking holes in what is intended to be a completely isolated VLAN (40)
  • Dedicated management VLAN - instead of using the default UniFi VLAN, move the management VLAN and the UniFi network devices to a dedicated VLAN where I have full control over the configuration
  • Migrate U6 Lite from uplink to wired connection
  • Configure honeypot - future project. I’m curious to explore what kinds of activity a honeypot would get
  • Log forwarding to Wazuh - in the interest of building industry-relevant skills and increasing visibility into network activity