LAN Layout & Gateway

LAN Layout & Gateway

🌐 Internet Edge

• ISP: AT&T Fiber (1Gbps Up/Down)
• Gateway/ONT: HUMAX BGW320-500 (Located in Sunroom)
• Mode: Bridge/Pass-through mode enabled (February 2026 upgrade)

🛡️ Core Routing (Server Closet)

• Device: Protectli FW2B (Pluto)
• OS: Ubuntu 24.04 LTS (ZFS on Root)
• Role: Primary Gateway & Firewall (Replacing opnSense architecture)
• Internal LAN: 192.168.13.0/24 (Native), 10.13.x.y (VLANs - Deploying)

Core Services

• Firewall: nftables (v2 production Ruleset active)
• DHCP: Technitium DHCP (192.168.13.0/24 scope active)
• DNS: Technitium DNS (DNS-over-TLS enabled via Cloudflare/Google)
• Identity: JumpCloud (Fully configured on Pluto for identity management)
• Monitoring: Beszel-agent + Vector (Shipping to ClickHouse)
• Backup: Syncoid/Sanoid (OS snapshots and replication to Luna)
• VPN: WireGuard (Pluto Gateway + MacBook Client - Deployed March 18, 2026)

📡 Physical Switching & Wireless

• Switch: 24-port Gigabit Managed Switch with 12x PoE+ ports.
• AP: 2x Grandstream Mesh Access Points (PoE powered).
• Update (Feb 26, 2026): Backbone migration to the new Ubuntu-based routing on Pluto is complete. Network is stable on 192.168.13.x.

🔒 Security Updates (March 19, 2026)

• WireGuard: Tunnel configured for pluto and Macbook client; nftables updated for tunnel traffic.
• Fail2Ban:
  • Refined default and SSH jail configs.
  • Added Recidive jail (repeat offenders).
  • Added Portscan detection jail.
• Edge Hardening:
  • Port Closures: Removed Minecraft Bedrock (19132) and Bittorrent (52341) forwards.
  • Rate Limiting: Enabled nftables rate-limiting for Minecraft Java (25565), Voice Chat (24454), and CoTurn (3478).
  • Geo-blocking: Implemented automated nftables blocklist (CN, KP, RU, IR) via systemd timer + lookup sets.