Network & Operational Security
Keep the house apart from the blast radius
A UniFi Dream Machine sits between the internet and everything at home. Two links, six zones, no open ports for web apps, and a teaching style that starts with whatever someone already owns.
Map
How the network is shaped
Conceptual only. No addresses, no VLAN numbers. If a box fails, traffic should have somewhere else to go, and devices that do not need to talk should not be able to.
Segmentation
Left hand, right hand
Segmentation means putting different kinds of devices on separate lanes (VLANs) on the same physical network. Each zone only talks to what it needs.
Picture your hands. Right hand: cameras and sensors. Left hand: your computer and family phones. Keep them apart. If a cheap camera gets weird, it should not be sitting next to the laptop that holds tax docs and school files.
Trusted
Guest
Surveillance
IoT
Storage
Homelab
Failover
Two internet connections
If one link drops, traffic moves to the other automatically. The gateway handles that handoff so the house does not wait on someone noticing the outage first.
Public edge
How public things are exposed safely
The default is closed. Anything public has to earn its path out, and sensitive admin tools get an extra gate.
No open inbound ports
Cloudflare Tunnel
Access gate
WAF and rate limits
Remote access
How we get in from elsewhere
Tailscale is a private mesh VPN. A subnet router into the lab lets us reach what we need without punching holes in the firewall. Outbound privacy VPN (Proton VPN) is available when we want traffic to leave that way.
On the security side: Elastic Fleet agents on key servers, Wazuh for security monitoring, and automated code review that blocks committed secrets.
Teaching story
Start where they already are
I told a coworker about my setup and overwhelmed her. “That’s a lot, I don’t really understand.” Fair. I switched.
I asked what she had at home. She showed her Ring cameras and a standard ISP router. No lab tour. Just her gear.
Analogy: left hand and right hand. Right hand is cameras and sensors. Left hand is your computer and family phones. Keep them apart so a compromised camera is not sitting next to the laptop that holds your life.
I said go home, open the router app, play with it, and send me screenshots and questions. We walked through it together and moved her cameras to the guest network, with main devices on the main network. Afterward she could explain why segmentation matters and manage the split herself.
How I teach
Principles that survive real houses
DNS at home is handled by the gateway with split-horizon DNS (inside names resolve locally; outside goes through Cloudflare). A self-hosted DNS server is staged for later. None of that is the first lesson for a friend with a Ring camera and an ISP router.