Operator evidence board
Home Network Redesign
This is the proposed future-state design for your house and homelab: six purposeful VLANs, a real camera/security lane now instead of later, cleaner SSIDs, stricter policy boundaries, and a staged migration path that avoids lighting the place on fire.
Interactive controls
Current to target topology
What exists now versus the lane structure I would put in place before you hand me admin access.
Target VLAN plan
These cards are the final lane definitions I would work from as your network engineer.
SSID plan
Fewer SSIDs, clearer meaning, and explicit temporary lanes only where justified.
Firewall intent matrix
Not every protocol spelled out yet, but the policy posture is explicit and sane.
Migration phases
Ordered to reduce blast radius: infrastructure first, then servers, then security, then IoT cleanup.
Wi-Fi coverage and AP posture
The downstairs U6 LR is part of the plan if coverage or camera RSSI says it should be.
Coverage sketch
AP guidance
- Keep the U7 Pro as the main upstairs AP.
- Reinstall the U6 LR downstairs if validation shows weak coverage or poor roaming.
- Bias cameras toward wired PoE whenever practical; do not solve camera growth with “more Wi-Fi” by default.
- Put both AP management interfaces on Management VLAN 10.
Why not over-tune on day one?
Because the real first win is correct segmentation and sane physical placement. Fancy channel math before the VLAN model is cleaned up is premature wizardry.
Decision summary
The crisp operator answer.
Best-fit final shape
- Management
- Trusted
- Servers
- IoT
- Guest
- Cameras / Security
Things to delete
- Old IoT VLAN 2
- Stale access-port archaeology
- Non-infra devices on Management
- Duplicate SSIDs without a real policy reason
Security posture
- IoT and Cameras default-deny toward the rest of the LAN
- Trusted is the operator lane
- Servers expose only explicit services
- Guest is internet-only and isolated