//Eddie Brinton-Quinn ghostwire

Replacement of a flat, unsegmented LAN with a micro-segmented network built on enterprise patterns. The work covers network design, DNS architecture, service migration, and fault diagnosis — designed and built solo, from a helpdesk background, with no formal networking training beyond self-directed study.

Segmentation design

Eight VLANs, each a distinct trust boundary rather than an arbitrary device bucket:

VLAN	Purpose	Trust posture
10 Services	user-facing applications	east-west to storage/infra
20 Storage	TrueNAS data plane	isolated from service tier
30 DMZ	external ingress (Pangolin)	explicitly-allowed internal only
40 Infrastructure	DNS, IdP, monitoring	consumed by systems, not users
45 Management	switch/firewall/hypervisor admin	no direct access from user VLANs
50 Guest	untrusted visitors	internet-only, 15/1 Mb/s cap
60 Endpoints	trusted user devices	service/storage access
70 IoT	smart devices	client isolation, internet-only, 15/1 Mb/s cap

Rack layout reserves U16 for a CARP failover twin (dual-router HA) and U19 for an MLAG twin (dual-switch HA) — no re-racking required when the second nodes land.

DNS architecture

A four-tier namespace replacing an accumulated *.local wildcard — designed so a hostname encodes function, tier, and location:

• Authoritative tier: svc/infra/mgmt functional subdomains per VLAN; svr for physical assets with site identity; clstr/vrt for cluster entities vs. individual VMs
• Canonical names: gitlab.eddiequinn.casa — CNAMEs into the authoritative tier, same name inside and out
• Split-horizon: Bind9 serves the internal view to 10.67.0.0/16 only; Cloudflare serves the public view to everyone else; Unbound on OPNsense forwards internal clients to Bind9
• Net effect: internal queries resolve to LAN IPs, external to the tunnel endpoint, with zero client configuration and no NAT hairpinning; Traefik routing rules halved

Ad-blocking: AdGuard replaced by Bind9 RPZ — response-policy scaffolding and a local override zone are live; OISD/Hagezi blocklist ingestion is on the backlog (neither publishes AXFR, so it needs a download script + cron). Plaintext, version-controlled, declarative.

Live migration

~20 services (VMs, LXCs, physical devices) moved into the new zones across multiple evenings, executed remotely with no maintenance window. Recurring failure classes diagnosed and resolved:

• Service bind addresses: every service pinned to its old IP stopped resolving on the new subnet — root-caused via layer-by-layer OSI walkthrough (routing fine, DNS dead)
• DHCP option gaps: Kea's automatic gateway option silently absent from leases — devices got IPs but no route off-subnet
• Hardcoded storage IPs: NFS volumes across GitLab, Immich, and the arr stack all referenced the old TrueNAS address — every volume recreated

DHCP itself moved from dnsmasq to Kea (dnsmasq was squatting on port 67 and serving no planned purpose).

Platform

Authentik IdP (Docker container on the VLAN 40 infrastructure host) as the identity gatekeeper; Traefik as internal reverse proxy; Pangolin as the external tunnel. Integration status: Grafana and Jellyfin wired to Authentik; Proxmox/TrueNAS/GitLab/Nextcloud pending. Proxmox Backup Server not yet migrated. WebAuthn/YubiKey MFA pending hardware.

Evidence

Full writeup is PGP-signed (SHA512) and public. The build covers much of what the CCNA syllabus addresses — a side effect the writeup capitalises on rather than the project's goal.

---

← back to selected work