docs.na.id.au

Purpose

01 — Architecture

Last updated: 2026-09-05 | Status: ✅ Updated with Aruba switch info

Purpose

High-level topology of the home network based on analysis of:

  1. OpenWRT router backup (backup-Clacks-2026-09-05.tar.gz)
  2. Aruba switch config (config1(2).pcc)
  3. Current DHCP leases (hass-leases.txt)

This is the entry point for all other documentation.

Core devices

RoleDeviceModelIP AddressNotes
WAN router / firewallOpenWRT RouterClacks (TP-Link)192.168.30.254Dual-WAN, uses bond0 on lan0/lan1
Core switchAruba ProCurveJL253A (2930F)192.168.28.240VLAN-aware, edge-port STP on all ports

Network zones / VLANs

ZoneVLAN IDSubnetGatewayPurpose
LAN (User)30192.168.30.0/24.254Trusted devices, DNS resolver at .1
HASS/IoT29192.168.29.0/24.254Home Assistant & IoT automation (45+ devices)
DMZ31192.168.31.0/24.254External-facing services, AdGuard DNS sinkhole
GUEST27192.168.27.0/24.254Guest network, isolated from LAN
MANAGEMENT28192.168.28.0/24.240Switch/firewall management (isolated)

[!note] Aruba switch STP settings: All VLANs use admin-edge-port which means ports forward immediately without waiting for STP to converge. This is a safe configuration for home networks where the edge devices don’t run their own bridges/STP.

IPv6 summary

ZoneSubnetGatewayNotes
LAN2403:5814:6baf:30::/64::1/64 delegated to clients
HASS2403:5814:6baf:29::/64::1RA server mode
DMZ2403:5814:6baf:31::/64::1AdGuard, TheWatch
MANAGEMENT2001:44b8:610b:3f28::/64::240Switch management IPv6

DHCP settings

SettingValue
LeasetimeLAN/HASS/DMZ: 10 days, GUEST: 12 hours
RA modehybrid (RA + DHCPv6 for IPv6)

Firewall zones summary

ZoneNetworksPolicy (in→out)Forward
lanlan, wg0REJECT → ACCEPTACCEPT
hasshassREJECT → ACCEPTREJECT
dmzdmzREJECT → ACCEPTREJECT
guestguestREJECT → ACCEPTREJECT
mgmtmgmtREJECT → ACCEPTREJECT

Source Disclaimer