---
title: "01 — Architecture"
description: "## Purpose"
section: nanda
raw: "01-architecture.md"
source: ai-generated
tags: network, aruba, siemens, vlan
last-updated: 2026-09-15
---

# 01 — Architecture

> **Last updated:** 2026-09-05 | **Status:** ✅ Updated with Aruba switch info

## Purpose

High-level topology of the home network based on analysis of:

1. OpenWRT router backup (`backup-Clacks-2026-09-05.tar.gz`)  
2. Aruba switch config (`config1(2).pcc`)  
3. Current DHCP leases (`hass-leases.txt`)

This is the entry point for all other documentation.

## Core devices

| Role | Device | Model | IP Address | Notes |
|------|--------|-------|------------|-------|
| WAN router / firewall | OpenWRT Router | Clacks (TP-Link) | 192.168.30.254 | Dual-WAN, uses bond0 on lan0/lan1 |
| Core switch | Aruba ProCurve | JL253A (2930F) | 192.168.28.240 | VLAN-aware, edge-port STP on all ports |

## Network zones / VLANs

| Zone | VLAN ID | Subnet | Gateway | Purpose |
|------|---------|--------|---------|---------|
| LAN (User) | 30 | 192.168.30.0/24 | .254 | Trusted devices, DNS resolver at .1 |
| HASS/IoT | 29 | 192.168.29.0/24 | .254 | Home Assistant & IoT automation (45+ devices) |
| DMZ | 31 | 192.168.31.0/24 | .254 | External-facing services, AdGuard DNS sinkhole |
| GUEST | 27 | 192.168.27.0/24 | .254 | Guest network, isolated from LAN |
| MANAGEMENT | 28 | 192.168.28.0/24 | .240 | Switch/firewall management (isolated) |

> [!note]
> **Aruba switch STP settings:** All VLANs use `admin-edge-port` which means
> ports forward immediately without waiting for STP to converge. This is a
> safe configuration for home networks where the edge devices don't run their
> own bridges/STP.

## IPv6 summary

| Zone | Subnet | Gateway | Notes |
|------|--------|---------|-------|
| LAN | 2403:5814:6baf:30::/64 | ::1 | /64 delegated to clients |
| HASS | 2403:5814:6baf:29::/64 | ::1 | RA server mode |
| DMZ | 2403:5814:6baf:31::/64 | ::1 | AdGuard, TheWatch |
| MANAGEMENT | 2001:44b8:610b:3f28::/64 | ::240 | Switch management IPv6 |

## DHCP settings

| Setting | Value |
|---------|-------|
| Leasetime | LAN/HASS/DMZ: 10 days, GUEST: 12 hours |
| RA mode | hybrid (RA + DHCPv6 for IPv6) |

## Firewall zones summary

| Zone | Networks | Policy (in→out) | Forward |
|------|----------|------------------|---------|
| lan | lan, wg0 | REJECT → ACCEPT | ACCEPT |
| hass | hass | REJECT → ACCEPT | REJECT |
| dmz | dmz | REJECT → ACCEPT | REJECT |
| guest | guest | REJECT → ACCEPT | REJECT |
| mgmt | mgmt | REJECT → ACCEPT | REJECT |

## Related

- [02 — Switch Configuration](/nanda/02-switch-configuration/) - Port/VLAN details  
- [03 — Firewall Rules](/nanda/03-firewall-rules/) - Zone-based policies  
- [04 — IP Addressing](/nanda/04-ip-addressing/) - Subnet assignments  

---

## Source Disclaimer

- [x] AI Generated
- [ ] Human Generated
- [ ] AI Edited
- [ ] Human Edited