Overview
The house came with only a basic plug-and-play modem/router setup and no manageable network infrastructure. This project replaces it with a fully segmented Unifi network built around VLAN isolation, dual-AP wireless coverage, and an air-gapped security-testing sandbox.
Current status: Cloud Gateway Max, USW-Ultra switch, and one of two U7 Lite APs are online and fully configured. VLAN segmentation, wireless SSIDs, and the isolated Lab environment are built and validated. Two items remain before Phase 1 closes out: the second AP (delayed by a suspected bad RJ45 connector or cable) and a final pass on physical cable and rack management.
Network Design
Seven VLANs enforce default-deny segmentation: Management (1), Trusted (10), IoT (20), Guest (30), Lab (40), Server (50), and a dedicated Security network (60) for cameras — kept separate from general IoT for tighter isolation on higher-value devices. Trusted is the only network with broad reach; everything else is isolated by default, with no blanket exception rules added unless a device genuinely requires local LAN access.
Wireless Architecture
Both APs broadcast matching SSIDs mapped to their respective VLANs, with band steering and 80MHz channel width on 5GHz for full-home roaming without manual reconnects. The Security network's SSID adds MAC address filtering in Allow mode, restricting association to a single known device — an extra layer beyond VLAN isolation alone for the network's most sensitive segment.
Segmentation & Isolation
Isolation is enforced at the routing layer rather than relying solely on firewall rules to drop already-routed traffic — confirmed during testing when cross-VLAN traffic returned "Destination Host Unreachable" directly from the gateway, meaning no inter-VLAN route exists at all rather than a rule catching packets after the fact. This is a stronger isolation guarantee than a rule-based deny alone.
Lab Validation
The Lab VLAN (40) is wired to a single dedicated gateway port, fully air-gapped from both the internet and every other VLAN. A Kali Linux machine on that VLAN hosted an isolated vulnerable target (Metasploitable2) over a VirtualBox host-only network, keeping the target invisible to the physical network entirely. An Nmap scan against the target enumerated 20+ open services, including well-known intentional backdoors — confirming the scanning workflow functions as intended. Containment was then verified by attempting to reach a Trusted-VLAN device from the Lab VLAN: the attempt failed outright, with the gateway reporting no route to the destination.
Troubleshooting
Getting VirtualBox's host-only networking running on Kali surfaced a kernel/DKMS module mismatch typical of rolling-release systems — the running kernel had outpaced the available header packages in the repos. Resolving it required waiting for a matching headers release, rebuilding the VirtualBox kernel modules via DKMS, and rebooting into the correct kernel before the host-only network driver would load. Separately, bringing the second AP online has been held up by a suspected bad RJ45 connector or cable run — a reminder that segmentation and firewall design don't matter if the physical layer underneath isn't solid.
Physical Build & Cable Management
Closing out Phase 1 with a deliberate pass on the physical side, not just the logical design: a 3D-printed rack (black body, white labels, black text) keeps the build visually consistent, with every cable labeled at both ends to match its documented port assignment, dressed with reusable fasteners rather than permanent ties, and left with enough service loop to reroute without re-terminating. The goal is a build where the physical layout is as traceable as the network diagram — anyone should be able to match a labeled cable to its VLAN and port from the photos alone.
Skills demonstrated: Network segmentation and least-privilege firewall design, wireless architecture, VM-level network isolation, vulnerability scanning with Nmap, Linux kernel/driver troubleshooting on a rolling-release system, and physical infrastructure documentation.
