HOME LAB

Computer Networking in Practice: Homelab Network Architecture and Deployment

May 08, 2026 homelab networking vlan dhcp routing wifi +4 homelab networking vlan dhcp routing wifi poe surveillance huawei server

This year I finally brought a Dell R730XD into service with TrueNAS and a RAID6 storage pool. At that point, a gigabit home LAN stopped making sense: the server could provide much more local throughput than the network could carry.

So the first requirement was practical: move the internal backbone to 10G. Once the core was being rebuilt, it also made sense to stop treating the home network as one flat LAN. Servers, cameras, APs, management interfaces, and IoT devices should not all live in the same broadcast domain.

The final architecture is built around a routed 10G core, segmented VLANs, PoE access, centrally managed Wi-Fi, and ACLs at the network boundaries. The goal is to keep the network fast where it matters, isolated where it should be, and simple enough to debug when something breaks.

The core policy is straightforward: VLAN100 is my trusted work/admin network, VLAN99 is infrastructure management, and VLAN30 is surveillance. VLAN100 can administer VLAN99 and VLAN30. VLAN99 and VLAN30 cannot initiate access to other VLANs, and other VLANs cannot reach VLAN100.

The networking ideas behind the rack

Here are the network concepts that show up repeatedly in this design.

Concept 1

Switching

Switches build the physical fabric

A switch connects devices inside a Layer 2 network and forwards Ethernet frames by MAC address.

Connects router uplinks, server ports, APs, cameras, NVR, and management interfaces.
Keeps local Ethernet traffic inside the switching fabric.
Carries multiple logical networks when VLANs are used.

Concept 2

Routing

Routers connect IP networks

Routing decides how packets move between subnets and how traffic exits toward the Internet.

The edge router handles PPPoE and Internet access.
The core switch routes between internal VLAN gateways.
Default routes define where unknown destinations go next.

Concept 3

VLANs

VLANs define trust boundaries

A VLAN splits one physical switching fabric into separate logical Layer 2 networks.

Management, cameras, IoT, APs, and trusted work devices do not share one flat LAN.
Each VLAN gets a clear subnet, gateway, and policy boundary.
ACLs can then control which VLANs may talk to each other.

Concept 4

Ports

Access and trunk ports place VLANs on cables

Port type decides whether one endpoint receives one VLAN or a link carries many VLANs.

Access ports fit cameras, NVR, and iDRAC because each endpoint belongs to one VLAN.
Trunk ports fit switch uplinks and APs because they carry several VLANs.
PVID/native VLAN decides where untagged traffic lands on a trunk.

Concept 5

Addressing

DHCP and routes make the network usable

DHCP gives hosts addresses; routes tell devices where to send traffic outside the local subnet.

Client VLANs receive DHCP service from the core switch.
AP management DHCP is relayed to the AC so it can provide Option 43.
The core sends Internet-bound traffic to the router over the routed /30 link.

Concept 6

Operations

LACP and PoE make deployment practical

Some network features are less about theory and more about keeping the physical deployment clean.

LACP bundles multiple links for aggregate capacity and redundancy.
PoE powers APs and cameras through the same cable that carries data.
These choices reduce cabling friction and make the network easier to maintain.

With that vocabulary in place, we can move from concepts to the actual homelab topology.

Interactive Topology

Homelab Network Map

Svelte Flow

10 devices · 9 links

Homelab Network Map: text description

This text describes the same devices, connections, and configuration as the interactive map.

VLAN configuration

VLAN	Subnet	Gateway	DHCP	Purpose and notes
VLAN99: Management	192.168.99.0/24	192.168.99.100	static-only	Infrastructure management plane. Core switch VLANIF99 is the gateway. AC and switches use static management addresses.
VLAN10: AP Management	192.168.10.0/24	192.168.10.1	relay	Access point self addresses. Core switch relays DHCP to the AC at 192.168.11.1. The AC returns Option 43 for controller discovery.
VLAN11: AC Control	192.168.11.0/24	192.168.11.2	static-only	AC control-plane network. The AC uses 192.168.11.1 and the core switch uses 192.168.11.2.
VLAN20: Life	192.168.20.0/24	192.168.20.1	server	Daily household devices.
VLAN30: Security	192.168.30.0/24	192.168.30.1	server	Security SSID, cameras, and NVR. Cameras and NVR are statically assigned inside this VLAN.
VLAN100: Work	192.168.100.0/24	192.168.100.1	server	Workstations and server services.
VLAN200: IoT	192.168.200.0/24	192.168.200.1	server	Smart home devices.

Devices and interfaces

Public Internet

The upstream ISP connection reached through PPPoE.

Type: internet.

Interface	Configuration
ISP handoff	Peer: Huawei AR5710S-S8T2X MultiGE 0/0/0. Mode: wan. Bandwidth: 1G. Public WAN access enters the router here.

Huawei AR5710S-S8T2X

Edge router handling PPPoE WAN access and the routed handoff to the core switch.

Type: router. Vendor: Huawei. Model: AR5710S-S8T2X.

Interface	Configuration
MultiGE 0/0/0	Peer: ISP. Mode: wan. Bandwidth: 1G. PPPoE dial-up interface for Internet access.
10GE 0/0/1	IP: 192.168.255.1/30. Peer: Core eth-0-44. Mode: routed. Bandwidth: 10G. Layer 3 point-to-point handoff to the core switch.

48-port 10G Core Switch

The routed core for VLAN gateways, DHCP services, trunks, and aggregation links.

Type: switch. Model: Centec-based 48x10G SFP+ core switch. Management IP: 192.168.99.100/24. VLANs: VLAN99, VLAN10, VLAN11, VLAN20, VLAN30, VLAN100, VLAN200.

Interface	Configuration
Vlanif99	IP: 192.168.99.100/24. Access VLAN: VLAN99. Management gateway.
Vlanif10	IP: 192.168.10.1/24. Access VLAN: VLAN10. AP management gateway with DHCP relay.
Vlanif11	IP: 192.168.11.2/24. Access VLAN: VLAN11. AC control VLAN gateway.
Vlanif20	IP: 192.168.20.1/24. Access VLAN: VLAN20. Life SSID gateway.
Vlanif30	IP: 192.168.30.1/24. Access VLAN: VLAN30. Security VLAN gateway.
Vlanif100	IP: 192.168.100.1/24. Access VLAN: VLAN100. Work VLAN gateway.
Vlanif200	IP: 192.168.200.1/24. Access VLAN: VLAN200. IoT VLAN gateway.
eth-0-44	IP: 192.168.255.2/30. Peer: Router 10GE 0/0/1. Mode: routed. Bandwidth: 10G.
eth-0-41	Peer: AC XGE0/0/1. Mode: trunk. Bandwidth: 10G. Allowed VLANs: VLAN99, VLAN11.
eth-0-45 - eth-0-48	Peer: PoE switch GE0/0/25 - GE0/0/28. Mode: lacp. Bandwidth: 4 x 1G. Allowed VLANs: VLAN99, VLAN10, VLAN20, VLAN30, VLAN100, VLAN200. LACP group: PoE-uplink.
eth-0-25 - eth-0-26	Peer: Dell R730XD dual 10G. Mode: lacp. Bandwidth: 2 x 10G. Allowed VLANs: VLAN100. LACP group: Server-uplink.

DHCP scopes

VLAN10: 192.168.10.0/24; gateway 192.168.10.1; server DHCP relay. Relay to 192.168.11.1. AP management DHCP is relayed to the AC.
VLAN20: 192.168.20.0/24; gateway 192.168.20.1; server Core switch.
VLAN30: 192.168.30.0/24; gateway 192.168.30.1; server Core switch. The VLAN has DHCP available, while cameras and NVR are statically assigned.
VLAN100: 192.168.100.0/24; gateway 192.168.100.1; server Core switch.
VLAN200: 192.168.200.0/24; gateway 192.168.200.1; server Core switch.

Static routes

0.0.0.0/0 via 192.168.255.1. Default route to the Huawei router.

Huawei AirEngine 9700S-S

Wireless access controller for AP onboarding and SSID-to-VLAN policy.

Type: ac. Vendor: Huawei. Model: AirEngine 9700S-S. Management IP: 192.168.99.8/24. VLANs: VLAN99, VLAN11.

Interface	Configuration
XGE0/0/1	Peer: Core eth-0-41. Mode: trunk. Bandwidth: 10G. Allowed VLANs: VLAN99, VLAN11.
Vlanif99	IP: 192.168.99.8/24. Access VLAN: VLAN99. AC management address.
Vlanif11	IP: 192.168.11.1/24. Access VLAN: VLAN11. AC control address and DHCP server endpoint for AP management.

DHCP scopes

VLAN10: 192.168.10.0/24; gateway 192.168.10.1; server Huawei AirEngine 9700S-S. Option 43: 192.168.11.1. APs receive management addresses and discover the AC through Option 43.

Static routes

192.168.10.0/24 via 192.168.11.2. Return path to AP management addresses via the core switch.
0.0.0.0/0 via 192.168.99.100. Default route via the core management gateway.

The AC only needs VLAN99 and VLAN11 on its trunk to the core switch.
Client SSID VLANs are mapped at the AP edge and carried by the PoE access switch trunk.

Huawei S1730S-S24P4S-A2

Secondary PoE access switch for APs, cameras, NVR, and iDRAC management.

Type: switch. Vendor: Huawei. Model: S1730S-S24P4S-A2. Management IP: 192.168.99.5/24. VLANs: VLAN99, VLAN10, VLAN20, VLAN30, VLAN100, VLAN200.

Interface	Configuration
Vlanif99	IP: 192.168.99.5/24. Access VLAN: VLAN99. Static management address.
GE0/0/25 - GE0/0/28	Peer: Core eth-0-45 - eth-0-48. Mode: lacp. Bandwidth: 4 x 1G SFP. Allowed VLANs: VLAN99, VLAN10, VLAN20, VLAN30, VLAN100, VLAN200. LACP group: PoE-uplink.

AP-facing ports are trunks with native VLAN10 and allowed VLANs 10, 20, 30, 100, and 200.
Camera and NVR ports are placed in VLAN30 and powered by PoE where applicable.

3 x Huawei Wi-Fi 6 APs

PoE-powered APs. Their own management IPs come from VLAN10, and SSIDs map into service VLANs.

Type: ap. Vendor: Huawei. VLANs: VLAN10, VLAN20, VLAN30, VLAN100, VLAN200.

Interface	Configuration
Ethernet uplink	Peer: PoE switch access ports. Mode: trunk. Bandwidth: 1G. Allowed VLANs: VLAN10, VLAN20, VLAN30, VLAN100, VLAN200. Native/PVID: VLAN10. Native VLAN10 for AP management; tagged SSID VLANs for client traffic.

AP management addresses are leased from VLAN10.
Default gateway is 192.168.10.1.
Option 43 points APs to the AC control address 192.168.11.1.

Dell R730XD

Homelab server with dual 10G SFP+ service uplinks and a separate iDRAC management port.

Type: server. Vendor: Dell. Model: R730XD with 0C63DV NIC. Management IP: 192.168.100.45/24. VLANs: VLAN100.

Interface	Configuration
X520 SFP+ port 1 and port 2	Peer: Core eth-0-25 - eth-0-26. Mode: lacp. Bandwidth: 2 x 10G. Allowed VLANs: VLAN100. LACP group: Server-uplink. Business/service network uplink.
Service IP	IP: 192.168.100.45/24. Access VLAN: VLAN100. Default gateway is 192.168.100.1.

Dell iDRAC

Out-of-band server management connected to the PoE access switch.

Type: server. Vendor: Dell. Management IP: 192.168.99.56/24. VLANs: VLAN99.

Interface	Configuration
iDRAC Ethernet	IP: 192.168.99.56/24. Peer: PoE switch access port. Mode: access. Access VLAN: VLAN99. Default gateway is 192.168.99.100.

4 x Hikvision Cameras

PoE-powered security cameras with static addresses in VLAN30.

Type: camera. Vendor: Hikvision. VLANs: VLAN30.

Interface	Configuration
Camera Ethernet	Peer: PoE switch camera ports. Mode: access. Bandwidth: 1G. Access VLAN: VLAN30. PoE powered; static IPs in 192.168.30.0/24.

Hikvision NVR

Recorder placed directly on VLAN30 so camera traffic stays inside the security segment.

Type: nvr. Vendor: Hikvision. VLANs: VLAN30.

Interface	Configuration
NVR Ethernet	Peer: PoE switch access port. Mode: access. Bandwidth: 1G. Access VLAN: VLAN30. Static IP in 192.168.30.0/24.

Network connections

Connection	Endpoints	Configuration
PPPoE WAN	Public Internet → Huawei AR5710S-S8T2X(MultiGE 0/0/0)	Type: wan. Bandwidth: 1G.
192.168.255.0/30	Huawei AR5710S-S8T2X(10GE 0/0/1) → 48-port 10G Core Switch(eth-0-44)	Type: routed. Bandwidth: 10G. Routed subnet: 192.168.255.0/30. Router side: 192.168.255.1/30. Core side: 192.168.255.2/30.
Trunk 99,11	48-port 10G Core Switch(eth-0-41) → Huawei AirEngine 9700S-S(XGE0/0/1)	Type: trunk. Bandwidth: 10G. Allowed VLANs: VLAN99, VLAN11.
LACP trunk	48-port 10G Core Switch(eth-0-45 - eth-0-48) → Huawei S1730S-S24P4S-A2(GE0/0/25 - GE0/0/28)	Type: lacp. Bandwidth: 4 x 1G. Allowed VLANs: VLAN99, VLAN10, VLAN20, VLAN30, VLAN100, VLAN200. LACP group: PoE-uplink.
LACP 2 x 10G	48-port 10G Core Switch(eth-0-25 - eth-0-26) → Dell R730XD(X520 SFP+ dual ports)	Type: lacp. Bandwidth: 2 x 10G. Allowed VLANs: VLAN100. LACP group: Server-uplink.
Access VLAN99	Huawei S1730S-S24P4S-A2 → Dell iDRAC(iDRAC Ethernet)	Type: access. Allowed VLANs: VLAN99.
PoE trunk	Huawei S1730S-S24P4S-A2 → 3 x Huawei Wi-Fi 6 APs	Type: trunk. Bandwidth: 1G each. Allowed VLANs: VLAN10, VLAN20, VLAN30, VLAN100, VLAN200. Native/PVID: VLAN10. PoE enabled.
PoE access VLAN30	Huawei S1730S-S24P4S-A2 → 4 x Hikvision Cameras	Type: access. Bandwidth: 1G each. Allowed VLANs: VLAN30. PoE enabled.
Access VLAN30	Huawei S1730S-S24P4S-A2 → Hikvision NVR	Type: access. Bandwidth: 1G. Allowed VLANs: VLAN30.
CAPWAP/control	3 x Huawei Wi-Fi 6 APs → Huawei AirEngine 9700S-S	Type: trunk. Allowed VLANs: VLAN10, VLAN11. APs get VLAN10 addresses from the AC DHCP scope. Option 43 points to the AC control address 192.168.11.1.
VLAN30 video	4 x Hikvision Cameras → Hikvision NVR	Type: access. Allowed VLANs: VLAN30. The cameras and NVR are in the same security VLAN, so recording traffic does not need to leave VLAN30.

Wireless networks

SSID	VLAN	Purpose
SSID-Work	VLAN100	Work devices and trusted client access.
SSID-Life	VLAN20	Daily household devices.
SSID-Security	VLAN30	Security clients and camera-related access.
SSID-IoT	VLAN200	Smart home and lower-trust devices.

Traffic paths

Internet egress: Client or server traffic reaches the core default route, crosses the /30 handoff, and exits through PPPoE. Devices: Dell R730XD → 48-port 10G Core Switch → Huawei AR5710S-S8T2X → Public Internet.
AP discovery: APs obtain VLAN10 addresses through DHCP relay and discover the AC at 192.168.11.1 by Option 43. Devices: 3 x Huawei Wi-Fi 6 APs → Huawei S1730S-S24P4S-A2 → 48-port 10G Core Switch → Huawei AirEngine 9700S-S.
SSID-Work traffic: Wireless clients on SSID-Work are bridged to VLAN100 and use the core switch as their gateway. Devices: 3 x Huawei Wi-Fi 6 APs → Huawei S1730S-S24P4S-A2 → 48-port 10G Core Switch.
Camera to NVR: Camera streams stay in VLAN30 between the PoE switch, cameras, and NVR. Devices: 4 x Hikvision Cameras → Huawei S1730S-S24P4S-A2 → Hikvision NVR.
Server gateway: The Dell server uses VLAN100 through the dual-10G LACP bundle and reaches its gateway at 192.168.100.1. Devices: Dell R730XD → 48-port 10G Core Switch.

Topology summary

The network is built around a routed core.

flowchart LR
    Internet["Public Internet"] -->|"PPPoE"| Router["Huawei AR5710S-S8T2X"]
    Router -->|"10G routed link 192.168.255.0/30"| Core["48-port 10G core switch"]
    Core -->|"10G trunk VLAN99,11"| AC["Huawei AirEngine 9700S-S"]
    Core -->|"4 x 1G LACP trunk"| PoESwitch["Huawei PoE access switch"]
    Core -->|"2 x 10G LACP"| Server["Dell R730XD services"]
    PoESwitch --> APs["Huawei Wi-Fi 6 APs"]
    PoESwitch --> Cameras["Hikvision cameras"]
    PoESwitch --> NVR["Hikvision NVR"]
    PoESwitch --> iDRAC["Dell iDRAC"]

Role	Device	Purpose
Edge router	Huawei AR5710S-S8T2X	PPPoE WAN and routed handoff to the core
Core switch	48-port 10G SFP+ switch, Centec chipset	VLAN gateways, DHCP, DHCP relay, default route, aggregation
Access switch	Huawei S1730S-S24P4S-A2	PoE access for APs and cameras, NVR, iDRAC, trunk to core
Wireless controller	Huawei AirEngine 9700S-S	AP discovery, AP management, SSID policy
Wireless APs	Huawei Wi-Fi 6 APs	Client access, SSID-to-VLAN mapping
Server	Dell R730XD with 0C63DV NIC	Services on VLAN100, dual-10G LACP to core
Surveillance	Hikvision cameras and NVR	Static security devices on VLAN30

Physical links

The WAN enters the router on MultiGE 0/0/0 and uses PPPoE over a 1G public uplink.

The router connects to the core through a routed point-to-point link:

Link	Type	VLANs / IPs
Router `MultiGE 0/0/0` to ISP	WAN	1G PPPoE
Router `10GE 0/0/1` to core `eth-0-44`	Routed	Router `192.168.255.1/30`, core `192.168.255.2/30`
Core `eth-0-41` to AC `XGE0/0/1`	Trunk	VLAN99, VLAN11
Core `eth-0-45-48` to access switch `GE0/0/25-28`	LACP trunk	VLAN99,10,20,30,100,200
Core `eth-0-25-26` to Dell R730XD	LACP	VLAN100
Access switch to APs	PoE trunk	Native VLAN10, allowed VLAN10,20,30,100,200
Access switch to cameras and NVR	Access	VLAN30
Access switch to iDRAC	Access	VLAN99

VLANs, gateways, and DHCP

The core switch owns the routed VLAN interfaces for the main internal networks:

VLAN	Role	Gateway	DHCP
99	Management	`192.168.99.100/24`	Static
10	AP management	`192.168.10.1/24`	Relay to AC `192.168.11.1`
11	AC control	`192.168.11.2/24`	Static
20	Life / daily devices	`192.168.20.1/24`	Core switch
30	Security / cameras / NVR	`192.168.30.1/24`	Core switch, with cameras/NVR static
100	Work and server services	`192.168.100.1/24`	Core switch
200	Smart home / IoT	`192.168.200.1/24`	Core switch

VLAN99 is the management plane. The core switch uses 192.168.99.100/24, the AC uses 192.168.99.8/24, the access switch uses 192.168.99.5/24, and iDRAC uses 192.168.99.56/24.

VLAN10 is only for AP management. APs receive addresses by DHCP and use 192.168.10.1 as their gateway.

VLAN11 is the AC control network. The AC uses 192.168.11.1/24; the core uses 192.168.11.2/24.

The core switch directly serves DHCP for VLAN20, VLAN30, VLAN100, and VLAN200. VLAN10 is relayed to the AC:

VLAN10 DHCP relay -> 192.168.11.1

The AC DHCP pool for APs is:

Subnet: 192.168.10.0/24
Gateway: 192.168.10.1
Option 43: 192.168.11.1

Routing model

The core switch is the default gateway for the internal VLANs. The router is the Internet edge.

Core default route: 0.0.0.0/0 -> 192.168.255.1

flowchart LR
    VlanGateway["VLAN gateway on core"] --> CoreRoute["Core default route"]
    CoreRoute -->|"0.0.0.0/0 via 192.168.255.1"| Router["Huawei router"]
    Router -->|"PPPoE"| Internet["Public Internet"]

This keeps internal routing close to the switching fabric. Traffic between VLANs reaches the core directly. Internet-bound traffic leaves through the router.

Wireless

The AP-facing switch ports are trunks:

Native / PVID VLAN: 10
Allowed VLANs: 10, 20, 30, 100, 200

SSID	VLAN	Purpose
`SSID-Work`	100	Trusted work/admin devices
`SSID-Life`	20	Daily household devices
`SSID-Security`	30	Security clients and camera-related access
`SSID-IoT`	200	Smart home devices

The AC trunk only carries VLAN99 and VLAN11. Client VLANs are mapped at the AP edge and carried through the AP-to-access-switch trunk, then through the access-to-core trunk.

The AC has two important routes:

192.168.10.0/24 -> 192.168.11.2
0.0.0.0/0      -> 192.168.99.100

The first route is the return path to AP management addresses. The second route sends other AC traffic to the core management gateway.

Server and surveillance placement

The Dell R730XD has two network roles:

Role	VLAN	Address	Gateway	Link
Services	100	`192.168.100.45/24`	`192.168.100.1`	Dual 10G LACP to core
iDRAC	99	`192.168.99.56/24`	`192.168.99.100`	Access switch port

The iDRAC path is separate from the service path. I can change the server data network without losing out-of-band management.

The cameras and NVR are placed in VLAN30 with static addresses. Camera-to-NVR traffic stays inside the security VLAN.

The resulting surveillance path is short:

flowchart LR
    Cameras["Hikvision cameras"] -->|"VLAN30 video streams"| PoESwitch["PoE access switch"]
    PoESwitch -->|"VLAN30 access"| NVR["Hikvision NVR"]
    PoESwitch -->|"Trunk VLAN30"| CoreSwitch["Core switch gateway 192.168.30.1"]

ACL policy

The VLAN policy is intentionally strict. VLAN100 is my trusted network and is effectively single-user. It is the only VLAN allowed to initiate access into the management and security networks.

Source	Destination	Action	Reason
VLAN100	VLAN99	Allow	Admin access to switches, AC, and iDRAC
VLAN100	VLAN30	Allow	Admin access to cameras and NVR
VLAN99	Any non-management VLAN	Deny	Management devices should not initiate access to clients or services
VLAN30	Any other VLAN	Deny	Cameras and NVR should not initiate access outside the security network
VLAN10, VLAN11, VLAN20, VLAN30, VLAN99, VLAN200	VLAN100	Deny	VLAN100 should not be reachable from other VLANs
VLAN10, VLAN11, VLAN20, VLAN200	VLAN99	Deny	Only VLAN100 can manage infrastructure
VLAN10, VLAN11, VLAN20, VLAN200	VLAN30	Deny	Only VLAN100 can reach the security network

In short:

VLAN99 and VLAN30 are protected destinations.
Only VLAN100 can initiate traffic to VLAN99 and VLAN30.
VLAN30 and VLAN99 cannot initiate traffic to other VLANs.
VLAN100 is not reachable from other VLANs.

The policy direction is easier to see as a graph:

flowchart LR
    Vlan100["VLAN100 Work/Admin"] -->|"allow admin"| Vlan99["VLAN99 Management"]
    Vlan100 -->|"allow admin"| Vlan30["VLAN30 Security"]
    Vlan20["VLAN20 Life"] -. "deny" .-> Vlan99
    Vlan20 -. "deny" .-> Vlan30
    Vlan200["VLAN200 IoT"] -. "deny" .-> Vlan99
    Vlan200 -. "deny" .-> Vlan30
    Vlan10["VLAN10 AP Management"] -. "deny" .-> Vlan100
    Vlan30 -. "deny initiate" .-> Vlan100
    Vlan99 -. "deny initiate" .-> Vlan100

This is the point where the network becomes operationally useful. The physical design gives every device a clear place. The VLAN design gives every group a clear subnet. The ACL policy defines which boundaries are real.