Network

Topology

Internet
   │
UDM Pro (router/firewall/IDS)
   │
USW-24-PoE (core switch)
   ├── nyx / styx / erebus (Proxmox, trunked)
   ├── vault (TrueNAS)
   ├── U6-Lite APs x2
   └── Raspberry Pi (Pi-hole secondary)

VLANs

VLAN	Name	Subnet	Purpose
10	Trusted	10.10.10.0/24	Personal devices, laptops
20	IoT	10.10.20.0/24	Smart home devices, isolated from Trusted
30	Servers	10.10.30.0/24	Proxmox VMs/containers, TrueNAS
40	Guest	10.10.40.0/24	Guest wifi, internet-only
99	Mgmt	10.10.99.0/24	Switch/AP/UPS management interfaces

Firewall rules: IoT and Guest cannot initiate connections to Trusted or Servers. Servers can reach the internet for updates but inbound is default-deny.

DNS & ad-blocking

• Primary: Pi-hole (VM on erebus)
• Secondary: Pi-hole (Raspberry Pi), synced via Gravity Sync
• Upstream: Cloudflare DNS-over-TLS (1.1.1.1)
• Internal domains resolved via local DNS records (*.lab.internal)

Remote access

No ports are forwarded on the UDM Pro. Two paths in:

1. Cloudflare Tunnel — for public-facing services (see Services), terminates TLS at Cloudflare's edge, tunnel daemon runs as an LXC on erebus
2. Tailscale — for personal/admin access (SSH, Proxmox UI, TrueNAS UI), exit-node capable, ACLs restrict which devices can reach the Servers VLAN

Domains

• j7c.xyz — public domain, DNS managed in Cloudflare
• lab.internal — internal-only, split-horizon via Pi-hole