Portfolio · Network
One roof. Two worlds. Family devices stay on a calm household path; lab machines stay on a separate practice path. A small VyOS router is the doorway between them and the internet — so experiments don’t spill onto phones, TVs, and kids’ tablets.
Scroll the story. Each step lights a piece of the schematic.
01 · Upstream
Service comes in through a single upstream link (Starlink at this site). Because the provider uses carrier-grade NAT, there is no safe “open a hole in the firewall for the whole internet” story — remote access is deliberate and encrypted later in the path.
02 · Edge
A compact ThinkCentre Tiny runs VyOS — open-source routing software. It is the only place that decides what may leave toward the internet and what must stay inside. Think of it as a locked lobby with two hallways, not a free-for-all Wi‑Fi box.
03 · HomeNet
Phones, laptops, TVs, and IoT live on the home segment, served by a mesh in access-point mode (the router, not the mesh, hands out addresses). Guests and IoT can use separate Wi‑Fi names so everyday family use stays predictable.
04 · LabNet
Servers, lab nodes, and admin workstations sit on the lab segment. That is where experiments, clusters, and learning systems live — so a broken lab experiment does not take down the family’s internet night.
05 · Isolation
Forwarding policy defaults to deny. Lab machines can reach the internet through the router, and they can talk among themselves — but they are not free to roam onto household devices. Isolation is tested on purpose: lab-to-home client traffic fails by design.
06 · Remote care
When support is needed from away, access is through Tailscale (and SSH where appropriate), not by publishing services to the whole internet. That same pattern shows up in family desktop support stories on the Work page.
Technical write-up (redacted): github.com/DestroyTheKraken/homelab
