OPNSENSE / NETWORK SEGMENTATION

A home network.
A branch for my lab.

I ran and terminated Ethernet cabling in four rooms, built out the household guest network, and kept a separate router connection for my room and homelab.

Explore the network design See the build photos

Assembled white 3D printed network rack with Ubiquiti equipment on top, the Protectli router and switch in the middle, and two mini PCs below. — The assembled rack: Protectli + OPNsense, switching and Wi-Fi. The two mini PCs are planned additions to my cluster.

DESIGN GOAL

Keep homelab and project work separate from the household network.

01 NETWORK ARCHITECTURE

Household on one side.
My room on the other.

The Protectli router runs OPNsense. One router port feeds a managed switch for the household guest network. That switch connects both Ubiquiti Wi-Fi and the wired ports serving the rest of the house.

My room uses a separate router port and its own downstream switch for my personal machine, homelab and projects. This gives me a place to connect and isolate lab devices away from the household network.

HOUSEHOLD AND ROOM SEPARATIONPhysical layout overview

ROUTER

Protectli + OPNsense

Separate ports for the household and my room

HOUSEHOLD GUEST PORT

Rest of the house

GUEST NETWORK

Managed switch

Household wired and wireless access

Ubiquiti Wi-Fi

Wireless guest access

4 wired rooms

Including the living room

DEDICATED ROOM PORT

My room

DOWNSTREAM SWITCH

Room switch

Personal and project devices

Personal machine

My everyday workstation

PC build

Homelab + projects

Lab and project devices

The household managed switch serves Wi-Fi and wired room ports on the guest network. My PC and homelab use a separate room switch. Individual firewall rules are not shown.

02 PHYSICAL INSTALLATION

Four rooms wired.
Every end terminated.

I ran Ethernet cabling underneath the house and terminated the cable ends in four rooms on the household guest network, including the living room.

Those four wired room connections run back to the managed switch alongside Ubiquiti Wi-Fi. My own room uses the separate router port shown above.

03 THE DESIGN DECISIONS

An explicit boundary.
A place to build.

Separate the household from my room

The main division is between the network everyone else uses and the connection serving my room. That boundary is the basis of the layout, with dedicated router ports separating the two sides.

Expand on the room side

The downstream switch connects my personal machine alongside my homelab and projects. This is where I can work with project devices while keeping them separate from the rest of the house.

Bring household wired and wireless access together

The guest network's managed switch distributes the household connection to Ubiquiti Wi-Fi and the wired room ports. My room's switch sits on its own router port, keeping the two branches distinct.

04 HARDWARE INTEGRATION

From a printed frame
to a working setup.

I 3D printed the frame and built up the hardware in stages, starting with the Protectli router, switch and patch panel.

The expanded setup now includes two mini PCs that I plan to add to my cluster.

Empty white 3D printed frame with mounting rails and a honeycomb front vent, before the network hardware was fitted. — Printed frame
The frame assembled before the network hardware went in.

Printed frame holding the Protectli router, numbered patch panel and network switch, connected with Ethernet cables. — Initial hardware
The Protectli router, switch and patch panel fitted and connected.

Expanded white network rack on a shelf, with Ubiquiti equipment above the router and switch and two mini PCs fitted at the bottom. — Expanded setup
The fuller setup, including two mini PCs planned for my cluster.

Back to the projects

A home network.A branch for my lab.

Household on one side.My room on the other.