Network

A flat home network with OPNsense handling routing and firewalling. Everything sits on a single LAN — there is no VLAN segmentation today, which keeps the setup simple for a trusted home environment (the trade-off is discussed under Architecture decisions).

Topology

graph TD
    internet((Internet)) --> modem[Cable modem]
    modem --> opnsense[OPNsense VM<br/>router · firewall · DHCP · DNS]
    opnsense --> ap[TP-Link AP<br/>Wi-Fi]
    opnsense --> proxmox[Proxmox<br/>hypervisor]
    opnsense --> monitoring[monitoring<br/>Prometheus · Grafana · Loki]
    opnsense --> kontti[kontti<br/>media · AI · apps]
    opnsense --> nas[Synology DS920+<br/>NFS · backup target]
    opnsense --> ha[Home Assistant]
    tailscale[/Tailscale subnet router/] -.->|VPN| opnsense
    kontti -.->|NFS| nas
    monitoring -.->|scrape| kontti
    monitoring -.->|scrape| proxmox

OPNsense runs as a VM on Proxmox, so the router itself is part of the virtualised platform it protects — see the Proxmox and OPNsense pages.

Devices

Remote access is handled by Tailscale running as a subnet router on OPNsense.

My experience

A flat network has been sufficient for my needs. The TP-Link AP covers Wi-Fi well enough for a small apartment. I prefer wired connections but haven't bothered running cables through the flat.

The Synology DS920+ has worked well as an NFS server and as a backup target that replicates to Backblaze B2. At some point I'll likely replace it with a different solution.