Networking

My homelab network is segmented into 5 VLANs with a multi-tier DNS architecture and high-availability reverse proxy. This wiki covers the design decisions and implementation details.

Complete Network Topology

#

VLAN Design

#

Design principle: Servers (VLAN 30) can reach management (VLAN 10), but management devices are protected from server-initiated connections. IoT devices are fully isolated—they cannot initiate connections to any other VLAN.

DNS Architecture

#

Multi-Tier Design

#

The DNS stack uses a three-tier architecture for performance, redundancy, and ad-blocking:

DNS Performance Tiers

#

Layer 1: Firewall DNS Proxy

#

The Palo Alto firewall provides the first DNS layer:

Static entries include Proxmox nodes, NAS devices, and firewall interfaces—services that must resolve even if Pi-hole is down.

Layer 2: Pi-hole HA

#

Two Pi-hole instances with automatic failover:

Failover timing:

• Health check interval: 5 seconds
• Failures before failover: 3 consecutive
• Recovery Time Objective: ~15 seconds

Health checks verify:

1. FTL service is running
2. Port 53 is listening
3. DNS queries resolve (tests dns.google, cloudflare)

Layer 3: Upstream DNS

#

Pi-hole forwards to Cloudflare for external resolution:

• Primary: Firewall (which uses Cloudflare)
• Fallback: Direct to Cloudflare 1.1.1.2

High-Availability Architecture

#

Three critical services run as HA pairs using keepalived VRRP:

Key settings:

• Preemption: Enabled (primary reclaims VIP on recovery)
• Notifications: Discord webhooks on state changes
• Health checks: Service-specific validation before accepting traffic

Reverse Proxy Architecture

#

Dual-Proxy Design

#

Cloudflare Tunnel Path

#

Benefits:

• Zero exposed firewall ports (outbound-only)
• DDoS protection included
• User identity via Cloudflare Access
• Automatic TLS termination

Protected services: Password manager, VPN management, media server.

Caddy HA Path

#

Benefits:

• No external dependency
• Lower latency for internal traffic
• Full control over TLS certificates
• Wildcard cert via DNS-01 challenge

Domain Tiers

#

Firewall Architecture

#

Palo Alto Networks PA-440

#

Security Zones

#

Network Monitoring

#

UniFi Controller

#

Manages all network hardware:

• UniFi Gateway (inter-VLAN routing)
• 24-port managed switch (USW-24-G2)
• 2 WiFi 6 access points (U6-LR, U6-Pro)

Monitoring features:

• Real-time client list
• Bandwidth per device
• DPI (Deep Packet Inspection) stats
• Anomaly detection

Pi.Alert Network Scanner

#

Scans subnets every 5 minutes for:

• New device detection
• MAC address tracking
• Port scanning
• Vendor lookup

Lessons Learned

#

1. Multi-Tier DNS Saves the Day

#

When Pi-hole crashed due to database pressure, the firewall’s static entries kept core infrastructure resolving. Without this layer, Proxmox nodes couldn’t reach each other.

2. Config Drift Kills HA

#

The Caddy HA pair once drifted out of sync when I updated only one node. The VIP failed over to the outdated node, breaking several services. Always deploy to BOTH nodes.

3. VRRP ID Collisions

#

Each HA pair needs a unique VRRP ID. When I accidentally reused ID 55 for both DNS and NFS, one pair’s failover broke the other. Now I track IDs in documentation.

4. Health Checks Need Redundancy

#

Early Pi-hole health checks tested only one upstream. If that upstream was slow, the check failed and triggered unnecessary failover. Now checks test multiple targets with fallback.

Related Pages

#

• Infrastructure - Where DNS and proxy containers run
• Observability - Log shipping and alerting
• Automation - Network automation via Semaphore