3. Network Architecture

3.1 Overview

TheDen Home Network is designed for segmentation, performance, and manageability using VLANs to isolate traffic and prevent lateral movement between device classes. A router (Protectli FW6D running OPNSense) handles routing/NAT, VLAN termination, and DNS. A WiFi AP (UniFi 6+) connects directly to the FW6D via an 802.1Q trunk, broadcasting eight SSIDs across isolated VLANs.

3.2 Design Goals

Isolation: Each VLAN has a clear and limited purpose.
Visibility: All inter‑VLAN and WAN traffic passes through OPNsense for inspection and logging.
Control: Only authorized management systems can alter network configuration.
Scalability: VLAN framework supports future expansion and additional IoT segmentation.

3.3 Physical Topology

[ AT&T BGW320-500 ]
│ (Fiber handoff)

│
[ Protectli FW6D Firewall (OPNsense) ]

      ├── igb0 -> WAN (DHCP from ISP)
       ├── igb1 -> 802.1Q Trunk to UniFi U6+ AP (VLANs 10,20,30,40,50,60,70,80,99)
       └── igb2 -> Admin (192.168.100.0/24)
                  │
          [ UniFi U6+ AP ]
          ├── SSID “thedenhome”   -> VLAN 10
          ├── SSID “thedenmobile” -> VLAN 20
          ├── SSID “thedeniot”      -> VLAN 30
          ├── SSID “thedenguest”   -> VLAN 40
          ├── SSID “thedenprinter” -> VLAN 50

        ├── SSID “thedenwork1” -> VLAN 60
          ├── SSID “thedenwork2” -> VLAN 70
          └── SSID “thedenwork3” -> VLAN 80

3.4 Interface Summary

Interface	Description	VLAN	IP/Subnet	Notes
igb0	WAN	—	DHCP (public)	Connection to modem
igb1	LAN Trunk	10–99	—	VLAN trunk from AP
igb2	ADMIN	—	192.168.100.1/24	Ethernet mgmt port
vlan0.10	VLAN10_HOME	10	192.168.10.1/24	Personal computers
vlan0.20	VLAN20_MOBILE	20	192.168.20.1/24	Cellphones and tablets
vlan0.30	VLAN30_IOT	30	192.168.30.1/24	Smart devices
vlan0.40	VLAN40_GUEST	40	192.168.40.1/24	Guest WiFi
vlan0.50	VLAN50_PRINT	50	192.168.50.1/24	Printer VLAN
vlan0.60	VLAN60_WORK1	60	192.168.60.1/24	Work VLAN #1
vlan0.70	VLAN70_WORK2	70	192.168.70.1/24	Work VLAN #2
vlan0.80	VLAN80_WORK3	80	192.168.80.1/24	Work VLAN #3
vlan0.99	VLAN99_MGMT	99	192.168.99.1/24	WiFi AP VLAN

3.5 Subnet IP Addressing

VLAN	Subnet	Gateway	DHCP Range
VLAN10_HOME	192.168.10.0/24	192.168.10.1	100–200
VLAN20_MOBILE	192.168.20.0/24	192.168.20.1	100–200
VLAN30_IOT	192.168.30.0/24	192.168.30.1	100–200
VLAN40_GUEST	192.168.40.0/24	192.168.40.1	100–200
VLAN50_PRINT	192.168.50.0/24	192.168.50.1	100–200
VLAN60_WORK1	192.168.60.0/24	192.168.60.1	100–200
VLAN70_WORK2	192.168.70.0/24	192.168.70.1	100–200
VLAN80_WORK3	192.168.80.0/24	192.168.80.1	100–200
VLAN99_MGMT	192.168.99.0/24	192.168.99.1	100–200
ADMIN	192.168.100.0/24	192.168.100.1	100–200