# NANDA — Home Network Documentation (Clacks OpenWRT + Siemens Switch) > **Owner:** Clacks OpenWRT Router + Siemens Scalance XR326-2C > **Location:** [your location] > **Backup sources:** > > - `backup-Clacks-2026-09-05.tar.gz` (OpenWRT router) > - `RunningCLI(1).txt` (Siemens Scalance XR326-2C switch) > - `hass-leases.txt` (current DHCP leases) > **Created:** 2026-09-05 > **Router IP:** 192.168.30.254 Welcome to the NANDA documentation repository. Every document follows the same boilerplate: a metadata block up top, a purpose statement, the actual documentation, and cross-links to related docs. ## Repository structure This is now the **single documentation repository** for the NANDA network (Nancy And Adrian). Three documentation areas live side by side: | Path | Area | Source (pre-merge) | | --- | --- | --- | | `Network/` | NANDA home network — router, switches, VLANs, wireless, automation wiring | this repo (original content) | | `ai-docs/` | AI machine — llama.cpp inference servers, models, Docker services | former `AI-Docs` repo | | `home-assistant/` | Home Assistant — rooms, devices, automations, energy, HA | former `Home-Assistant-Docs` repo | | `Experiments/` | Work-in-progress documents, files, and scripts — not production, not network-specific | this repo (new) | > **Secrets guardrail:** live configuration (compose files, `.env` files, > systemd units, model presets) stays **out of this repo** — it lives in the > `~/ai-configs` and HA config folders on the host. The `.gitignore` at the > repo root blocks those file types by default. Docs reference config by name > and redact all secrets. ## The network This wiki was extracted from the OpenWRT router backup, the Siemens switch configuration, and current DHCP leases. ## Summary of discovered devices | Device | Model | IP Address | Role | |--------|-------|------------|------| | Clacks Router | TP-Link (OpenWRT) | 192.168.30.254 | Core router/firewall | | LAN-SW | Aruba JL253A (2930F) | 192.168.28.240 | Edge switch | | Siemens PoE Switch | Scalance XR326-2C | 192.168.28.241 | Access layer edge switch | ## Network topology (summary) ```mermaid graph TD subgraph WAN ISP[Internet] end subgraph Network MODEM[Cisco C867VAE-W-E-K9 192.168.28.10] FW[OpenWRT Router 192.168.28.254] ARUBA[Aruba 2930F 192.168.28.240] SIEMENS[Siemens XR326-2C 192.168.28.241] LAOTH[TP-Link EAP615-Wall 192.168.28.246] NINEREEDS[TP-Link EAP615-Wall 192.168.28.247] ASPHALT[TP-Link EAP235-Wall 192.168.28.248] MORAG[TP-Link EAP620-HD 192.168.28.249] ERROL[TP-Link EAP620-HD 192.168.28.250] BUGGYSQUIRES[TP-Link OC200 192.168.28.5] TRAK9100[Trak9100 NTP 192.168.31.4] THEABBOT[The Abbot NTP 192.168.31.3] RINPO[Rinpo NTP 192.168.31.13] AGNES[Agnes HTTPS 192.168.31.5] VETINARI[Vetinari D-Shield 192.168.31.10] end subgraph Segments GUEST[VLAN27, 192.168.27.0/24, 2403:5814:6baf:27::/64] MGMT[VLAN28, 192.168.28.0/24, 2403:5814:6baf:28::/64] HASS[VLAN29, 192.168.29.0/24, 2403:5814:6baf:29::/64] LAN[VLAN30, 192.168.30.0/24, 2403:5814:6baf:30::/64] DMZ[VLAN31, 192.168.31.0/24, 2403:5814:6baf:31::/64] WG[WireGuard, 192.168.33.0/24, 2403:5814:6baf:33::/64] WG-MGMT[WireGuard, 192.168.35.0/24, 2403:5814:6baf:35::/64] end ISP --- MODEM MODEM --- FW MODEM -. MGMT -.- ARUBA FW -- GUEST, MGMT, HASS, LAN, DMZ --- ARUBA ARUBA -- GUEST, MGMT, HASS, LAN, DMZ --- SIEMENS ARUBA -- GUEST, MGMT, HASS, LAN --- MORAG ARUBA -- DMZ --- TRAK9100 TRAK9100 -. PPS -.- THEABBOT ARUBA -- DMZ --- THEABBOT ARUBA -- DMZ --- RINPO ARUBA -- DMZ --- AGNES ARUBA -- DMZ --- VETINARI SIEMENS -- GUEST, MGMT, HASS, LAN --- LAOTH SIEMENS -- GUEST, MGMT, HASS, LAN --- NINEREEDS SIEMENS -- GUEST, MGMT, HASS, LAN --- ASPHALT SIEMENS -- GUEST, MGMT, HASS, LAN --- ERROL SIEMENS -- MGMT --- BUGGYSQUIRES ``` ## Index | # | Document | Covers | Status | |---|----------|--------|--------| | 01 | [Architecture](Network/01-architecture.md) | High-level topology, zones, core devices | ✅ Complete | | 02 | [Switch Configuration](Network/02-switch-configuration.md) | Aruba JL253A switch, ports, VLANs | ✅ Complete | | 03 | [Firewall Rules](Network/03-firewall-rules.md) | Zones, NAT, port forwarding | ✅ Generated from backup | | 04 | [IP Addressing](Network/04-ip-addressing.md) | Subnets, current DHCP leases (45+ IoT devices) | ✅ Complete with lease data | | 05 | [Servers & Docker](Network/05-servers-and-docker.md) | Hosts, Docker services, service placement | ✅ Complete | | 06 | [Wireless](Network/06-wireless.md) | SSIDs, APs, radio configuration | ✅ Complete | | 07 | [Authentication](Network/07-authentication.md) | Authentication schemes and services | ✅ Complete | | 08 | [Home Automation](Network/08-home-automation.md) | HA device inventory, lease alerts | ✅ Complete with current data | | 09 | [Siemens Switch Configuration](Network/09-siemens-switch.md) | XR326-2C analysis, unknown items | ✅ Complete | ## Next steps / Items needing attention 1. **Review [09-siemens-switch.md](09-siemens-switch.md)** - New documentation for the Siemens Scalance XR326-2C switch 2. **Verify physical connections** - Check ports ge 0/1 (Omada OC200), ext-e 0/26 (Aruba Switch) to confirm devices match aliases 3. **Enable DHCP snooping** on Siemens switch for security (currently disabled) 4. **Rotate SNMP community strings** on both switches if using v2c 5. **Investigate unused ports** - Ports ge 0/19-22 are available but unassigned ## Files to check regularly - **04-ip-addressing.md** - Check expired device warnings weekly - **hass-leases.txt** - Compare against router UI for expired leases - **09-siemens-switch.md** - Review unknown items section after physical inspection ## Security recommendations 1. Replace weak SNMP community strings (`public` and a weak custom string on the Siemens switch) with strong secrets 2. Enable DHCP snooping on Siemens switch to prevent rogue DHCP attacks 3. Rotate SSH keys if currently using password authentication --- *Documentation generated automatically from OpenWRT backup, Siemens switch CLI config, and current DHCP leases.* --- ## Source Disclaimer - [x] AI Generated - [ ] Human Generated - [x] AI Edited - [x] Human Edited