The Homelab

PROBLEM

I'm self-taught and pursuing MTCNA and CCNA — now MTCNA certified, CCNA in active lab prep. Textbook study only takes you so far — the real test is whether you can configure a VLAN that doesn't break the internet, recover a router you've locked yourself out of, and design a network that fails gracefully. I needed a lab I owned, with real consequences when something went wrong.

WHAT I BUILT

A production home network and a dedicated VLAN 40 lab segment running side-by-side. The production side handles real traffic: a MikroTik hAP ac² as the main gateway, a Grandstream GWN7711P managed switch, Synology DS425+ NAS, HP ProDesk i7 running 25+ Docker containers, and 3× TP-Link HX510 as a Wi-Fi 6E wireless mesh. Five VLANs segment management, trusted devices, IoT, lab gear, and the wireless mesh.

The lab segment (VLAN 40) is a separate routed network with a MikroTik CCR1009 as its gateway and three hAP ac² routers as lab nodes — dedicated hardware for OSPF, BGP, WireGuard, and routing protocol experiments without touching the production network. I can break it completely and rebuild it without the household losing internet.

MONITORING & AUTOMATION

The Dude runs on a MikroTik CHR VM on the ProDesk. SNMP-polls every device across all five VLANs. Custom Slack webhooks fire within 90 seconds of any device going offline. I sleep through outages now — alert-to-detection is under 2 minutes.

AdGuard Home handles DNS-level ad and tracker blocking for the whole network. Home Assistant runs automations across Tapo smart plugs, cameras, and IR blasters, with Frigate providing local AI object detection on RTSP camera streams. Uptime Kuma monitors every exposed service. Watchtower handles automated Docker image updates. The EcoFlow River 3 Plus provides UPS, with NUT integration to gracefully shut down the NAS before the battery dies.

ACCESS & SECURITY

Cloudflare Tunnel provides zero-trust remote access to internal services — no open ports, no exposed IP, no port forwarding rules. WireGuard VPN for direct access when I need it. All inter-VLAN routing runs through the hAP ac² with explicit firewall rules — IoT devices cannot initiate connections to trusted VLANs. The management VLAN (99) is accessible only from explicitly trusted hosts.

WHAT I LEARNED

Working with VLANs in anger is different from reading about them. I've locked myself out of the router (twice — the second time I had a recovery runbook). I've debugged SNMP authentication failures at 11pm, traced asymmetric routing, and rebuilt firewall rules from scratch after breaking the internet for the whole house. I have runbooks for all of it. That's the point.