🌐 家庭网络架构🌐 Home Network Architecture

VLAN Network Segmentation

• VLAN 1 — Management — Network device management, admin-only access
• VLAN 10 — Primary — Personal computers and phones, full internet access
• VLAN 20 — IoT — Smart home devices, restricted internet, only HA and necessary cloud APIs
• VLAN 30 — Cameras — Fully isolated security cameras, no internet outbound, Scrypted access only
• VLAN 40 — Guest — Guest Wi-Fi on isolated VLAN, no internal access, bandwidth limited

Firewall Rule Strategy

Based on "default deny" principle, only enabling necessary cross-VLAN communication:

• VLAN 10 → VLAN 20/30: Allow (manage IoT and cameras)
• VLAN 20/30/40 → VLAN 10: Deny (isolate untrusted devices)
• VLAN 20 → Internet: Restricted (whitelist domains and ports only)
• mDNS/IGMP cross-VLAN reflection: Allow for HomeKit device discovery

IPv6 Dual-Stack Configuration

• DHCPv6-PD — Obtain IPv6 prefix delegation (/56 or /60) via PPPoE, auto-assign to VLAN subnets
• SLAAC — Endpoints auto-generate IPv6 addresses via SLAAC with Privacy Extensions
• DNS64/NAT64 — Not used; maintaining pure dual-stack for maximum compatibility

WAN Failover Configuration

• WAN1: Primary (gigabit broadband PPPoE), WAN2: Backup (4G/5G mobile hotspot)
• Auto failure detection: ping-based WAN1 monitoring, auto-switch to WAN2 within 5 seconds
• Auto failback to WAN1 when recovered

Passwall Transparent Proxy Setup

• Routing Rules — GeoIP/GeoSite-based auto-routing; domestic traffic direct, overseas via proxy
• DNS Leak Prevention — DoH/DoT encrypted DNS queries to prevent ISP DNS hijacking
• Crontab Persistence — Low overlay partition space can cause crontab loss; regularly clean logs and cache

SmartDNS + AdGuard Home

• SmartDNS — Parallel upstream DNS, auto-select fastest; domestic via 114/Alibaba DNS, overseas via Cloudflare/Google
• AdGuard Home — DNS-level ad filtering with EasyList China + AdGuard default filter lists
• Processing Chain — Client → AdGuard Home (ad filter) → SmartDNS (routing) → upstream DNS

10GbE Network Performance

• iPerf3 Test — NAS (10GbE) to workstation (10GbE) achieves 9.4Gbps, near theoretical max
• SMB Transfer — Large file SMB transfer reaches 1.1GB/s (limited by SSD RAID performance)
• Time Machine — Mac backup at ~800MB/s over 10GbE; initial full backup ~30 min for 500GB

Backup & Disaster Recovery

• 3-2-1 Backup — 3 copies of data, 2 different storage media, 1 offsite backup
• Hyper Backup — Critical data backed up to external USB drive and cloud (Baidu Netdisk/iCloud)
• Docker Config Backup — All Docker compose files and config volumes exported to Git repo
• VM Snapshots — OpenWrt and HA VMs auto-snapshot weekly, retaining 4 recent versions

Firewall Rule Strategy

• Default Deny — All inter-VLAN traffic denied by default, open selectively
• IoT → HA — Allow IoT devices to reach HA on port 8123 and MQTT
• Main → All — Main network can access all VLANs, no reverse access
• Camera → NVR — Only NAS/Scrypted pulls RTSP streams, all other traffic blocked

VLAN Trunk Configuration

• Switch Trunk — UniFi Switch uplink and NAS ports set as trunk, allowing all VLAN tags
• Synology 802.1Q — Configure VLAN tags on physical NIC in DSM, create virtual interface per VLAN
• OpenWrt VM — Assign trunk mode to OpenWrt VM virtual NIC in VMM for cross-VLAN routing

Channel Planning

• 2.4GHz — Select channel 1/6/11 that doesn't conflict with Zigbee coordinator
• 5GHz DFS — Use DFS channels (52-144) to reduce neighbor interference; radar detection may temporarily disable
• Channel Width — 5GHz uses 160MHz for maximum throughput (Wi-Fi 7), 2.4GHz 20MHz to minimize interference

Roaming Optimization

• 802.11r — Fast BSS Transition reduces handoff delay below 50ms
• Min RSSI — Set -75dBm threshold to force weak-signal clients to switch
• TX Power — Reduce power to prevent excessive overlap causing sticky roaming

Wi-Fi 7 (802.11be) Key Features

• 320MHz Channels — 6GHz supports 320MHz (5GHz max 160MHz), theoretical peak 46Gbps
• 4096-QAM — ~20% throughput gain over Wi-Fi 6's 1024-QAM
• MLO — Simultaneous 2.4/5/6GHz for better throughput and lower latency
• Preamble Puncturing — Skip occupied segments within wide channels instead of falling back