Operator evidence board

# Home Network Redesign

This is the proposed future-state design for your house and homelab: six purposeful VLANs, a real camera/security lane now instead of later, cleaner SSIDs, stricter policy boundaries, and a staged migration path that avoids lighting the place on fire.

6 target VLANs Management, Trusted, Servers, IoT, Guest, Cameras/Security. No more historical junk lanes.
1 legacy VLAN to kill Old IoT / VLAN 2 goes away after device migration and validation.
2 AP posture Keep U7 Pro as main AP. Reinstall the U6 LR downstairs if coverage or camera RSSI needs it.
Camera growth ready now Doorbell, chimes, and future camera gear live on a security lane from day one.

## Interactive controls

Card filter
Detail level
Operator calls
Move chimes off Management Retire VLAN 2 Split Servers from Trusted Pre-stage Camera VLAN now

## Current to target topology

What exists now versus the lane structure I would put in place before you hand me admin access.

Current Management UDM, switches, APs, plus two Protect chimes that do not belong there. 10.5.0.0/24
→
Mgmt VLAN 10 Infra only: gateway, switches, APs, management IPs, admin surfaces. 10.5.10.0/24
Trusted + Servers mixed Main LAN currently holds user clients and service hosts together. 10.5.1.0/24
→
Trusted VLAN 20 Phones, desktops, laptops, Steam Deck, personal endpoints. 10.5.20.0/24
Servers VLAN 30 PD, Serenity, Nomad, Rocinante, and other service hosts. 10.5.30.0/24
Old IoT still real CIA Via on VLAN 2 is still carrying the meaningful smart-home traffic. 192.168.1.0/24
→
IoT VLAN 40 All retained smart-home gear lands here after phased migration. 10.5.40.0/24
Camera lane underused Doorbell is there, but security gear is not consistently placed yet. 10.5.20.0/24 now / repurpose later
→
Camera VLAN 60 Doorbell, chimes, future cameras, Protect accessories. Built now, not “someday.” 10.5.60.0/24
Guest VLAN 50 Pure internet-only guest lane with client isolation. 10.5.50.0/24

## Target VLAN plan

These cards are the final lane definitions I would work from as your network engineer.

## SSID plan

Fewer SSIDs, clearer meaning, and explicit temporary lanes only where justified.

## Firewall intent matrix

Not every protocol spelled out yet, but the policy posture is explicit and sane.

## Migration phases

Ordered to reduce blast radius: infrastructure first, then servers, then security, then IoT cleanup.

## Wi-Fi coverage and AP posture

The downstairs U6 LR is part of the plan if coverage or camera RSSI says it should be.

### Coverage sketch

Upstairs / main coverage zone / existing U7 Pro area
Downstairs / camera + IoT pressure zone / candidate U6 LR restore point
U7
U6

### AP guidance

Preferred: wired backhaul Delay RF micro-tuning

- Keep the U7 Pro as the main upstairs AP.
- Reinstall the U6 LR downstairs if validation shows weak coverage or poor roaming.
- Bias cameras toward wired PoE whenever practical; do not solve camera growth with “more Wi-Fi” by default.
- Put both AP management interfaces on Management VLAN 10.

Why not over-tune on day one?

Because the real first win is correct segmentation and sane physical placement. Fancy channel math before the VLAN model is cleaned up is premature wizardry.

## Decision summary

The crisp operator answer.

### Best-fit final shape

- Management
- Trusted
- Servers
- IoT
- Guest
- Cameras / Security

### Things to delete

- Old IoT VLAN 2
- Stale access-port archaeology
- Non-infra devices on Management
- Duplicate SSIDs without a real policy reason

### Security posture

- IoT and Cameras default-deny toward the rest of the LAN
- Trusted is the operator lane
- Servers expose only explicit services
- Guest is internet-only and isolated