[{"content":"Before procuring any hardware, it\u0026rsquo;s important to know what all hardware is required. To map this out and understand, I created a network diagram to see what device will connect to what.\nNetwork Diagram For context, before this setup I had one router that connected to ISP and all wireless/wired devices connected to this router. Generic home internet setup :)\nI need 4 hardware devices - XPON Modem, Mini PC for OpnSense, Managed Switch, Wifi Access Point. Reason being - and at least 4 LAN cables. Reason being:\nXPON Terminal Modem # TP-Link XZ000-G7 - To connect to ISP\u0026rsquo;s fiber cable\nTP-Link XZ000-G7 XPON Modem Mini PC # I have installed OpnSense in it. You can use any old pc/laptop/server if you have. I wanted to keep router separate hence got this.\nMiniPC Switch # TP-Link ES208G - 8 Port switch. Supports VLAN\nTP-Link ES208G Switch Wifi Access Point # TP-Link AC1750 - Supports per-SSID VLAN\nTP-Link AC1750 EAP Server PC # I already had PC, which will act as primary server. I have setup proxmox in it and run services via LXC/VMs\nServer PC After procuring required hardware, I started exploring device interfaces. In next sections, I\u0026rsquo;ll discuss how I have setup each hardware device.\n","date":"28 October 2026","externalUrl":null,"permalink":"/homelab/hardware/","section":"Homelab","summary":"","title":"The Hardware - Router, Switch, etc.","type":"homelab"},{"content":"Network Diagram - XPON XPON Modem connects to ISP fiber cable, and converts incoming light signals to usable electrical data for routers, computers, printers, etc.\nTP-Link XZ000-G7 XPON Modem Registering modem with ISP # Every XPON modem/router has a unique SN (Serial Number). This SN can usually be found at back of modem or in modem\u0026rsquo;s UI interface.\nISP generally registers this Serial Number with themselves. My ISP registered previous router\u0026rsquo;s Serial Number with them - meaning it recognises and expects me to connect to them via previous router. Considering this, I have two options-\nAsk ISP to register SN of this new XPON modem Override SN in modem interface with the one registered with ISP. I went with Option #2 - override SN in modem interface.\nTo do this, open XPON interface. Then:\nGo to Advanced Tab Network -\u0026gt; XPON Settings Enter SN in GPON SN field - This should be previous modem\u0026rsquo;s SN that is registered with ISP SN Type - HEX (or as per previous router\u0026rsquo;s configuration) Password Type - ASCII (default). Leave Password empty (or as per previous router\u0026rsquo;s configuration) OLT Mode - Normal (or as per previous router\u0026rsquo;s configuration) Once this is done, XPON registration status should show Registered.\nImportant It is important for XPON router to register with ISP. Without this, internet won\u0026rsquo;t work.\nLastly, set VLAN Mode to Transparent (Advanced Tab -\u0026gt; Network -\u0026gt; VLAN Settings). I\u0026rsquo;ll configure VLAN in OpnSense\nWired connections # ISP cable connects to modem\u0026rsquo;s PON port RJ-45 output port connects to OpnSense router\u0026rsquo;s WAN port ","date":"28 October 2026","externalUrl":null,"permalink":"/homelab/xpon/","section":"Homelab","summary":"","title":"XPON Modem","type":"homelab"},{"content":"Network Diagram - OpnSense Router OpnSense router is the heart and soul of entire homelab setup. Firewall rules, VLAN configurations, exposing services to the internet, wireguard setup\u0026hellip; everything is done in OpnSense. I have setup OpnSense in a Mini PC. This PC has two LAN ports and is powered with Intel N150 processor.\nOne port connects to XPON modem and the other port connects to Switch. Until switch is configured, the other port can be connected directly to laptop/PC.\nMini PC This document highlights all the configuration(s) I have done in OpnSense router. I\u0026rsquo;ll try to document as much as I can, and keep this document updated.\nI\u0026rsquo;ll segregate OpnSense configuration(s) in their own sections. This should make it easy to navigate and jump to relevant sections.\nISP configuration to connect to Internet # Assuming XPON is configured and is in registered state, I\u0026rsquo;ll proceed to setup router to connect to the internet.\nInfo Refer XPON Modem configuration if not already done\nMy ISP connects over PPPoE and has VLAN configured. I was provided details for both by them.\nThe VLAN ID provided by ISP is different from VLAN we will configure to segregate internal network. ISPs use VLANs to segregate services provided by them such as internet service, VoIP, etc.\nInfo My mini pc has two ethernet ports. One port is configured as wan and the other as lan. For me, the wan interface is assigned device id igc1 and lan as igc0. Interface parents are configured according to these details.\nwan - igc1\nlan - igc0\nI\u0026rsquo;ll first create the interfaces (Step #1 and Step #2). Then begin configuring required interfaces. ISP configuration deals with mini pc\u0026rsquo;s wan interface. I\u0026rsquo;ll configure the interface devices (VLAN, etc.) as per my ISP\u0026rsquo;s requirements. On successful configuration, router should be able to connect to the internet. Meaning ping test from router to internet should work.\nCreate ISP VLAN # Go to Interfaces -\u0026gt; Devices -\u0026gt; VLAN and create a new VLAN. Enter Device Name (eg: vlan0.\u0026lt;tag\u0026gt;) Select Parent interface. This should be the WAN interface (Important!) - ethernet port to which XPON modem is connected to. For me this is igc1. Enter VLAN tag provided by ISP VLAN Priority 0 Description is optional Save and Apply Create PPPoE device # Go to Interfaces -\u0026gt; Devices -\u0026gt; Point-to-Point Click Add new interface Link Type - PPPoE Link Interface - VLAN interface created in previous step Description (optional) Username/password - as provided by ISP Leave rest as it is. Populate fields that are applicable to you. Save and Apply wan (igc1) interface # XPON modem is connected to this interface\nGo to Interfaces -\u0026gt; \u0026lt;wan\u0026gt; interface. Ensure Identifier in interface is wan. Let\u0026rsquo;s call this UnderWAN. This is because PPPoE device uses this interface under the hood. Set Description = UnderWAN Changes to this interface gets applied to PPPoE device interface automatically. With this new OpnSense router, authentication was failing with ISP because of MAC mismatch. My ISP had previous router\u0026rsquo;s MAC address registered with them. To fix this, set MAC Address to MAC registered with ISP - for me this is previous router\u0026rsquo;s MAC address. Save and apply PPPoE interface Assignment # The PPPoE device created in Step #2 needs to be enabled Go to Interfaces -\u0026gt; Assignments Create a new assignment for PPPoE device created in Step #2 Set description WAN_ISP Save and apply. Once applied, WAN_ISP should be visible under Interfaces section Configuring WAN_ISP interface Go to Interfaces -\u0026gt; WAN_ISP Enable interface if its disabled Set description WAN_ISP IPv4 configuration - select PPPoE MSS - 1492 - Without this setting, router uses default MSS - 1500 which is incorrect. PPPoE connection uses 8 bytes, which should be accounted for in MSS value. Save and apply Testing connectivity # I\u0026rsquo;ll try pinging host 1.1.1.1 from opnsense router-\nGo to Interfaces -\u0026gt; Diagnostics -\u0026gt; Ping Enter hostname - 1.1.1.1 Address Family - IPv4 Keep rest as it is. Click Start Let it run for a few seconds. Note Send and Receive values. If they are greater than 0, internet connect is working. If it doesn\u0026rsquo;t work, double-check the following:\nPPPoE credentials VLAN tag provided by ISP Custom MSS value? Wrong MSS can lead to dropping of packets. UnderWAN interface MAC address override. Is XPON modem in Registered state? VLAN configuration # This is internal VLAN configuration to segregate internal network.\nHere, we work with lan interface which is igc0 for me.\nI have following VLANs configured. This serves my current use-case, and might change in future as and when required.\nThe idea is to isolate PUBLIC and IOT network from TRUSTED network, while keeping all management devices (such as routers/switch/etc.) isolated from all other networks.\nVLAN VLAN Name IP Notes VLAN10 TRUSTED 10.0.10.1/24 Trusted Devices such as Phones, laptops, etc. VLAN20 PUBLIC 10.0.20.1/24 Publicly-exposed VMs/LXC containers VLAN30 IOT 10.0.30.1/24 IOT devices VLAN99 MANAGEMNT 10.0.99.1/28 Management devices (OpnSense, switch, Access point, etc.) Creating VLAN devices # Go to Interfaces -\u0026gt; Devices -\u0026gt; VLAN Click Add VLAN Enter Device Name (eg: vlan0.\u0026lt;tag\u0026gt;) Select Parent interface. This should be the WAN interface (Important!) - ethernet port to which XPON modem is connected to. For me this is igc1. Enter VLAN tag provided by ISP VLAN Priority 0 Description is optional Save and Apply Repeat this for all other VLANs\nDevice Assignment # After creating VLAN devices, we need to assign them an interface.\nGo to Interface -\u0026gt; Assignments Click Add Enter description. Ideally it should be identifier for Device we select in next step Select VLAN device for which interface is to be created. Keep rest of the fields default Click Save Repeat for all VLAN devices. Once done, click Apply for changes to take effect.\nAfter applying, refresh page. Interfaces created should be visible under Interfaces\nInterface List For each VLAN interface, ensure:\nIt is Enabled and have Prevent Interface removal enabled. Verify the Device it is assigned to. Should ideally be vlan* device or wan/lan Under Generic configuration: Set IPv4 Configuration Type to Static IPv4 Under Static IPv4 configuration Enter IPv4 address and subnet. Eg: For IOT, the IPv4 address will be 10.0.30.1 and subnet /24. This IPv4 acts as gateway and interface address. Subnet tells valid range of IPs this interface will work for. Eg: All devices within 10.0.30.1/24 will have gateway pointing to IOT interface. Repeat for all interfaces.\nNext, I\u0026rsquo;ll configure DHCP ranges for all these interfaces.\nDHCP Range configuration # This configuration defines valid range the IPs from which DHCP server provides IP addresses to clients.\nGo to Services -\u0026gt; Dnsmasq DNS \u0026amp; DHCP -\u0026gt; DHCP Ranges Click Add button Select Interface Enter Start Address Enter End Address Keep rest of the fields default Save Repeat this for all interfaces. Once created, click Apply for changes to take effect.\nExample: DHCP Range Screen This tells IOT devices will get IPs betweek 10.0.30.10 and 10.0.30.199\nFirewall Rules # By default, firewall restricts traffic for all new interfaces. Meaning all traffic to/from interface will be blocked. I\u0026rsquo;ll configure firewall rules to allow traffic to flow through the interface(s).\nAt a high level, these are the basic rules I want:\nIOT, PUBLIC network should not be able to talk to any other internal network (Eg: TRUSTED) TRUSTED should be able to talk to all interfaces Firewall Alias # Before proceeding, I\u0026rsquo;ll create a Firewall alias. This will come handy when I need to refer multiple interfaces in single firewall rule.\nGo to Firewall -\u0026gt; Aliases Click Add Enter name (eg: internal_networks) Select Type - Network(s) In Content dropdown select all the VLAN and WAN interface(s). Enter optional description Save and Apply Configuring Firewall for IOT # Important IOT VLAN network should not be able to connect to other internal network.\nIOT VLAN network should be able to connect to internet\nFor this, I will create 2 firewall rules.\nFirewall Rule #1 # Enable access to all interfaces except internal networks. This will allow IOT to connect to internet\nGo to Firewall -\u0026gt; Rules Click Add Select Interface as IOT Disable Quick Action Pass Source will be IOT network Destination internal_networks - This should be the alias created above Enable Invert Destination checkbox - with this enabled, the rule applies to all interfaces except for one(s) select in Destination. Keep rest of the fields as default Enable Log if required Save Firewall Rule #2 # Rule #1 blocks access to it\u0026rsquo;s own interface as well. Allow access to IOT interface gateway DNS lookup (Port 53)\nGo to Firewall -\u0026gt; Rules Click Add Select Interface as IOT Enable Quick Action - Pass Protocol - TCP/UDP Source - IOT network Destination - IOT address Destination port 53 (domain) Keep rest of the fields as default Enable Log if required Save Once both these rules are created, Click Apply for changes to take effect. IOT devices should now not have access to internal networks, and should be able to access the internet\nRepeat same step(s) for PUBLIC. Tweak as required.\nConfiguring Firewall for TRUSTED # For TRUSTED VLAN, I have allowed all access.\nGo to Firewall -\u0026gt; Rules Click Add Select Interface as PUBLIC Enable Quick Action - Pass Keep rest of the fields as default Enable Log if required Save Configure firewall rules for all the VLAN devices. Feel free to tweak rules, harden them as required.\nRestricting OpnSense to MANAGEMENT VLAN # By default, OpnSense management interface is accessible on all Interface addresses. Eg: It will be accessible from IOT device on IP 10.0.30.1, etc.\nI don\u0026rsquo;t want any VLAN other than Management VLAN to be able to access OpnSense management console. To achieve this, I did the following:\nAssuming MANAGEMENT VLAN is created and IPv4 is assigned to the interface (Reference: VLAN Configuration)\nGo to System -\u0026gt; Settings -\u0026gt; Administration Under Web GUI -\u0026gt; Listen Interfaces - Select MANAGEMENT Click Save and Apply With this, the Opnsense interface is only accessible on MANAGEMENT VLAN.\nTip MANAGEMENT VLAN devices should be accessible from TRUSTED VLAN devices because TRUSTED has all access\nWireguard Setup # (WIP)\n","date":"28 October 2026","externalUrl":null,"permalink":"/homelab/opnsense/","section":"Homelab","summary":"","title":"OpnSense Router (MiniPC)","type":"homelab"},{"content":"Network Diagram - Switch All physical devices (Wireless access point, OpnSense router, Server PC) connect to one another via switch.\nTP-Link ES208G Switch The switch is assigned IP from MANAGEMENT VLAN (VLAN99) IP pool via DHCP. This is done by assigning Management VLAN 99 in Switch interface. For further details on VLAN configuration, refer VLAN Configuration\nManagement VLAN Screen From network diagram above:\nOpnSense connects to switch on Switch Port 8 Server PC connects to switch on Switch Port 2 Wireless Access Point connects to switch on Switch Port 1 Considering the VLAN configuration and the design, VLAN configuration in Switch is configured as follows:\nVLAN Settings Port 8 (OpnSense) is tagged for all VLANs. This is important because entire VLAN configuration is driven via OpnSense. So it should have the visibility of all VLAN devices. Port 1 (Wireless Access Point) is tagged against VLAN10, VLAN30 and VLAN99. This is required because: VLAN10: Trusted devices such as Laptops, mobiles can connect via Wifi VLAN30: IOT devices can connect over wifi VLAN99: AP gets it\u0026rsquo;s own interface IP from VLAN99 IP pool Port 2 (Server PC) is tagged against VLAN10, VLAN20, VLAN99. This is required because: VLAN10: Trusted VMs VLAN20: Public VMs/services VLAN99: Proxmox in server PC gets IP from VLAN99 pool That\u0026rsquo;s it. I\u0026rsquo;ll next configure Wireless Access Point\n","date":"29 October 2026","externalUrl":null,"permalink":"/homelab/switch/","section":"Homelab","summary":"","title":"The Switch","type":"homelab"},{"content":"Network Diagram - Wireless Access Point All wireless devices connect to internet via this Access Point. The access point supports VLAN and exposes two SSIDs - one for VLAN10 (TRUSTED) and one for VLAN30 (IOT).\nTP-Link AC1750 EAP The Access Point is assigned IP from MANAGEMENT VLAN (VLAN99) IP pool via DHCP. This is done by assigning Management VLAN 99 in AP interface. For further details on VLAN configuration, refer VLAN Configuration\nManagement VLAN Screen Connecting to Wireless Access Point\u0026rsquo;s interface # When connecting for the first time, either directly via LAN cable or SSID, the interface is accessible at http://tplinkeap.net. But once we configure Management VLAN ID as 99 - connecting to AP gets a bit tricky. This is due to a bug in TP-Link firmware - TP-Link rejects request if source IP is different from it\u0026rsquo;s interface IP. What this means is if I try to access VLAN99 IP assigned to AP from TRUSTED VLAN10 device, AP will not allow it.\nAssuming AP is connected to Port 1 of Switch, the AP gets IP from VLAN99 pool. To check IP to received:\nIn OpnSense, go to Services -\u0026gt; Dnsmasq DNS \u0026amp; DHCP -\u0026gt; Leases Look for IP assigned to EAP245. To make this IP static, click on Add Reservation against the IP entry and create reservation. I\u0026rsquo;ll use this IP for SSH port-forward in order to connect to EAP.\nOpnSense router and Access Point both are on VLAN99. Hence, the AP is accessible from OpnSense\nssh -L 8443:\u0026lt;AP_VLAN99_IP\u0026gt;:443 \u0026lt;opnsense_user\u0026gt;@\u0026lt;opnsense_ip\u0026gt;:\u0026lt;opnsense_port\u0026gt;` AP is then accessible at http://localhost:8443\nSSID configuration # Create required SSIDs. I have created two - one for TRUSTED and one for IOT. Once SSIDs are created, go to Wireless -\u0026gt; VLAN Against each SSID: Enable VLAN Assign VLAN ID: \u0026lt;TRUSTED_SSID\u0026gt;: VLAN ID = 10 \u0026lt;IOT_SSID\u0026gt;: VLAN ID = 30 Save Testing connection # Try connecting to these SSIDs one by one. Ensure:\nTRUSTED is able to access VLAN99 devices (eg: Opnsense interface) IOT is unable to access VLAN99 devices. I had configured firewall rule for this. Firewall rules reference - Firewall Rules ","date":"29 October 2026","externalUrl":null,"permalink":"/homelab/eap/","section":"Homelab","summary":"","title":"Wireless Access Point","type":"homelab"},{"content":"","date":"29 October 2026","externalUrl":null,"permalink":"/","section":"","summary":"","title":"","type":"page"},{"content":"Setting up homelab has taught me so many new concepts - not just in theory but with actual hands-on. I have experienced internet lag due to misconfigured MSS value (Netflix not streaming like it was before), losing access to devices due to VLAN (cc: Hi Switch), losing internet access due to some misconfiguration(s), a bad firewall rule and IOT was able to access network it wasn\u0026rsquo;t supposed to.\nThis is a multi-part series that covers how I have setup my homelab. I will try to cover all the aspects of my setup - from hardware acquired, network segregation (802.1Q VLAN), OpnSense configuration, working around ISP CGNAT so that I can connect to services over the internet (using plain wireguard - no tailscale/netbird).\nI’m writing this series so I can look back at what I did. But if you get stuck on something I’ve covered here, hopefully it helps you too.\n","date":"29 October 2026","externalUrl":null,"permalink":"/homelab/","section":"Homelab","summary":"","title":"Homelab","type":"homelab"},{"content":"","date":"29 October 2026","externalUrl":null,"permalink":"/series/homelab/","section":"Series","summary":"","title":"Homelab","type":"series"},{"content":"","date":"29 October 2026","externalUrl":null,"permalink":"/tags/self-hosting/","section":"Tags","summary":"","title":"Self-Hosting","type":"tags"},{"content":"","date":"29 October 2026","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","date":"29 October 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"28 October 2026","externalUrl":null,"permalink":"/tags/opnsense/","section":"Tags","summary":"","title":"OpnSense","type":"tags"},{"content":"Hi, I’m Rijul. I’m a platform engineer based in Mumbai. I’ve been in software for about 8 years, the last few on cloud infrastructure: AWS, EKS, Kubernetes, and the pipelines around them.\nI didn\u0026rsquo;t start here, though. I began as a software engineer and worked across backend, frontend and even blockchain before moving into DevOps and platform work. I still like building things for fun. These days that’s my Homelab.\nThis site is mostly notes from building it: the hardware, VLANs, OPNsense, getting around CGNAT with WireGuard, and everything I broke along the way. I write things down so I can look back at what I did. If it helps you too, even better.\nOutside of work I run (slowly, but I\u0026rsquo;m chasing those PRs), and I\u0026rsquo;m always looking for good food. I might write about both someday.\nWant to say hi? Email / LinkedIn works best.\n","externalUrl":null,"permalink":"/about/","section":"","summary":"","title":"About","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"}]