# Networks & Switching
Editable diagram
[![network.png](https://wiki.hexadust.net/uploads/images/gallery/2024-11/scaled-1680-/xOrahgcBwTwT1Yyk-network.png)](https://wiki.hexadust.net/uploads/images/gallery/2024-11/xOrahgcBwTwT1Yyk-network.png) ## VLANs
**Name** **Tag** **Network** **Description****Gateways**
HOME1 192.168.1.0/24Internal home network caroline: 192.168.1.1 justine: 192.168.1.2 (DHCP default)
GUEST10 192.168.10.0/24Isolated network caroline: 192.168.10.1 (DHCP default)
SERVER50 192.168.50.0/24Internet exposed servers caroline: 192.168.50.1 (DHCP default)
IOT 80 192.168.80.0/24IoT devices carolone: 192.168.100.1 (DHCP default)
MGMT100 192.168.100.0/24Management network carolone: 192.168.100.1 justine: 192.168.100.2 (DHCP default)
### Connectivity Caroline does VLAN routing.
**Name** **Internet access G/W** **DNS** **WiFi SSID** **Access to**
HOMEJustine (VPN), Caroline Justine (PiHole), Caroline Haru, Haru Legacy (2.4GHz) SERVER, IOT
GUESTCarolineCarolineToudi, Toudi Legacy (2.4GHz)
SERVERCarolineCaroline
IOT CarolineCarolineIoT (2.4GHz)
MGMTJustine (VPN), CarolineJustine (PiHole), CarolineHaru MGMT (2.4GHz) SERVER
## Subnets
**Base range** **Subnet 1 / Usage** **Subnet 2 / Usage****IPv6 ULA `fd42:dead:beef/48`**
`10.0.0.0/8`*reserved for work VPNs*
`172.16.0.0/12` (to 172.31.)
`172.17.1.1/24. `Justine VPN: `vpn` `fd42:dead:beef:1701/64`
`172.17.2.1/24`Justine VPN: `outpust``fd42:dead:beef:1721/64`
`172.17.100.1/24`VPS VPN: `vps` `fd42:dead:beef:1700/64`
`172.18.0.0/16`Justine Docker `fd42:dead:beef:1800/64`
`172.19.0.0/16`Igor Kubenretes `fd42:dead:beef:1900/64`
`172.20.0.0/24`Igor Sandbox VMs `fd42:dead:beef:2000/64`
`192.168.0.0/16` `fd42:dead:beef:68/56`
`192.168.1.0/24`HOME VLAN `fd42:dead:beef:6801/64`
`192.168.10.0/24`GUEST VLAN `fd42:dead:beef:6810/64`
`192.168.50.0/24`SERVER VLAN `fd42:dead:beef:6850/64`
`192.168.80.0/24`IOT VLAN `fd42:dead:beef:6880/64`
`192.168.100.0/24`MGMT VLAN `fd42:dead:beef:6800/64`
## Adding networks ### Caroline - *Network* -> *Interfaces* -> *Devices* - Add `VLAN (802.1q)` on `eth1` for new VLAN tag - *Network* -> *Interfaces* - Add interface for the new device - Configure DHPC server on the new interface with options for default G/W and DNS server - `3,192.168.80.1` -
`6,192.168.80.1`
- *Network* -> *Firewall* -> *Zones* - Add zone for the new interface - *Network* -> *Firewall* -> *Traffic rules* - Add rule for DHCP (`UDP 67`) - Add rule for DNS (`UDP+TCP 53`) - Add rule for ICMP - *Network* -> *DHCP and DNS* -> *Devices & Ports* - Add new interface to DHCP server *Listen interfaces* ## Switch configuration

**OpenWRT edit VLAN tag assignment** Network -> Interfaces -> Devices -> `switch` (Bridge device) -> Configure... -> Bridge VLAN filtering

## IPv6 ### ULA - [Unique local address](https://en.wikipedia.org/wiki/Unique_local_address) - Use for private or local addressing. - Prefix `fc00::/7` - Prefix `fd00::/8` format: - Global ID: `fdxx:xxxx:xxxx::/48` - `x`-es should be chosen random - Subnets (64k): `fdxx:xxxx:xxxx:ssss::/64` - Expanded: `fdxx:xxxx:xxxx:ssss:0000:0000:0000:0000/128` - Prefix `fc00::/8` is not defined. For WireGuard the Global ID can be generated with `base64 -d | hexdump` from server's public key. Random ID can be made with `cat /dev/random | head -c5 | ruby -e 'puts STDIN.read.unpack("H*")'`. Encode v4 in v6 example: `fd00:192:168::1/64`. ULA: `fd42:dead:beef/48` ### IPv4 in IPv6 Example: `::ffff:192.0.2.1` -> hex encoded `::ffff:c000:201`