Got 3 Wifi SSIDs, one for internal, one for legacy internal (2.4 only - mostly IOT), one for guests (and my work devices)
AP and FW are from Unifi and i made the guest wifi to be with client isolation.
My entire internal network is one vlan and one subnet.
I plan on fixing that, but yeah…
I’ve got a synology nas that got its webserver ports exposed and synology photo backup ports.
I plan on putting it similary like you, when i get time and a cheap managed switch.
Putting servers in a managed vlan
Putting my gaming pc and shady VM (because of mods and root level anti-cheat software, which i dont trust either of them even a tiny bit) into a seperate vlan
putting my externable reachable stuff (soon to be also a proper reverse proxy with basic and cert auth, for Homeasssitant, jellyfin, […] access without a vpn (because vpn and android auto dont work together and i use my gps tag for automations in Homeassistant)
putting all other internal devices that i trust, such as my phones and CCTV cams and whatnot in a vlan
though maybe i would split that too, because i like to keep my cameras and other iot stuff without an internet connection.
Regarding your setup: i think it is pretty strong, only a dmz for externaly reachable stuff is missing. But the rest? Pretty decent!
Imma shame myself now publicly.
Got 3 Wifi SSIDs, one for internal, one for legacy internal (2.4 only - mostly IOT), one for guests (and my work devices)
AP and FW are from Unifi and i made the guest wifi to be with client isolation.
My entire internal network is one vlan and one subnet.
I plan on fixing that, but yeah…
I’ve got a synology nas that got its webserver ports exposed and synology photo backup ports.
I plan on putting it similary like you, when i get time and a cheap managed switch.
Regarding your setup: i think it is pretty strong, only a dmz for externaly reachable stuff is missing. But the rest? Pretty decent!