Enterprise Infrastructure Lab

Router-on-a-Stick VLAN Trunking, Proxmox VE, and AI-Driven Automation

Security Motivation

This infrastructure was architected in response to the inherent security risks of shared apartment Wi-Fi. Recognizing that standard consumer routers lack the granular control required to protect local devices, I designed a private, segmented network that prioritizes data integrity, local AI compute, and absolute control over traffic flow.

System Architecture

Homelab System Topology
Network architecture: Layer 2 Aruba core switch enforcing Router-on-a-Stick 802.1Q VLAN tagging to OPNsense, Proxmox compute, and isolated IoT endpoints.

Core Routing & Router-on-a-Stick Fabric

The backbone relies on an Aruba S3500 Enterprise Switch acting as the central Layer 2 distribution hub using a Router-on-a-Stick topology.

  • Physical Port Tagging & WAN Ingress: Raw ISP WAN traffic enters directly into an isolated WAN-tagged port on the Aruba switch, which trunks the traffic up to the firewall gateway.
  • Gateway / Firewall (OPNsense): A dedicated Dell OptiPlex appliance processes WAN, inter-VLAN routing, and strict firewall policies over a single 802.1Q trunk interface.
  • DNS Sinkhole (Pi-hole): Network-wide ad-blocking and telemetry interception occur at the DNS layer, ensuring no device leaks data outside the network.

Core Compute & Virtualization Stack

At the center of the trusted network is a high-availability Proxmox VE compute node hosting virtual machines and LXC containers for localized processing and edge routing.

  • Virtual Machines (VMs):
    • Home Assistant OS: Centralized IoT engine orchestrating localized climate control (humidifier, ESP32 temperature monitoring), fabrication hardware (3D printer monitoring and controls), media devices (Roku, Xbox), and smart plug power metrics.
    • Ollama LLM Instance: Dedicated virtual machine hosting local, air-gapped Large Language Models. Runs the Qwen model, which interfaces directly with Home Assistant to enable local, private natural language device control.
  • LXC Containers (CTs):
    • NGINX Proxy Manager: Edge reverse proxy managing SSL encryption and routing internal traffic across custom wildcard domains under *.lab.jbfueston.com.
    • Actual Budget: Self-hosted, end-to-end encrypted personal finance ledger.

Secure Remote Access & Ingress

To maintain 24/7 visibility without exposing management ports directly to the public internet, I implemented a hybrid access strategy combining encrypted tunnels with internal proxying.

  • Subnet Routing (Tailscale / WireGuard): The OPNsense gateway operates as a Tailscale Subnet Router, providing zero-trust, authenticated access to internal subnets from remote devices.
  • Internal Wildcard Routing: Internal services are cleanly addressed via custom DNS entries pointing to the local NGINX proxy, giving edge services dedicated *.lab.jbfueston.com endpoints.

Physical Port VLAN Hardening

The network enforces physical port-based 802.1Q segregation directly at the Aruba switch level to isolate unsafe hardware from core compute resources.

  • VLAN 10 (Trusted Network): Contains primary compute nodes, administrative interfaces, and trusted personal endpoints.
  • VLAN 99 (Unsafe / IoT Network): Sandboxed IoT zone mapped to physical ports housing smart plugs, 3D printer telemetry, media boxes, and ESP32 microcontrollers.
  • Egress & Inter-VLAN Rules: OPNsense firewall rules strictly limit IoT devices on VLAN 99 from initiating connections to VLAN 10 or unauthorized external endpoints.