Enterprise Infrastructure Lab

Custom Routing, Network Segmentation, and Secure Remote Access

Security Motivation

This infrastructure was architected in response to the inherent security risks of shared apartment Wi-Fi. Recognizing that standard consumer routers lack the granular control required to protect local devices, I designed a private, segmented network that prioritizes data integrity and absolute control over traffic flow.

System Architecture

Homelab System Topology
Network architecture: Security-hardened infrastructure with segmented VLANs and encrypted remote access.

Core Routing & Security Fabric

The backbone moves away from consumer routing, utilizing dedicated hardware for deep packet inspection and network-wide DNS filtering.

  • Gateway / Firewall (OPNsense): A dedicated Dell OptiPlex appliance handles all inter-VLAN routing, enforcing strict firewall rules between the trusted and untrusted IoT zones.
  • DNS Sinkhole (Pi-hole): Network-wide ad-blocking and telemetry interception occur at the DNS layer, ensuring no device leaks data outside the network.

Secure Remote Access

To maintain 24/7 visibility without exposing ports to the public internet, I implemented an encrypted Tailscale (WireGuard) overlay.

  • Subnet Routing: The OPNsense gateway is configured as a Tailscale Subnet Router, providing authenticated, seamless access to the entire internal 10.0.1.0/24 range from any remote location.
  • Zero-Trust Policy: This avoids the vulnerabilities associated with traditional port forwarding, keeping the management stack behind an encrypted tunnel.

Network Segmentation & IoT Hardening

The lab employs a "Zero-Trust" approach to IoT devices, which are treated as inherently untrusted due to their limited security patching.

  • VLAN Isolation: IoT traffic is strictly restricted to a dedicated VLAN, preventing these devices from communicating with the core trusted network.
  • Egress Filtering: I have implemented strict OPNsense firewall rules that limit IoT device traffic to only the specific endpoints required for operation, preventing unauthorized "phone-home" telemetry or lateral movement.