OPNsense at the edge
The D525 appliance has one job: be the router. It handles WAN/LAN routing, VLANs, fixed DHCP assignments for known devices, firewalling and Unbound DNS. Inbound home port forwarding is closed.
router bypass→OPNsense
Supermicro A→HP ProCurve 1810G-24
Guest means guest
The guest WLAN gets Internet and nothing else. Dynamic DHCP, no internal reachability, no capture, no AdGuard and no extra surveillance layer.
Three UniFi APs
Three identical long-range UniFi access points cover bedroom, living room and workshop. The bedroom AP is wired; the others mesh wirelessly. Their PoE injectors are intentionally outside the UPS.
VLANs by purpose, not paranoia
The network separates normal/server infrastructure, the Windows 98 Retro VLAN, WLAN/IoT, laptops, QNAP, individual Supermicro roles and guests. Cthulhu can reach all administrative surfaces. Ordinary clients cannot.
The X1 and Toshiba share a laptop network but are client-isolated. Each sees only its own QNAP share. The workshop PC cannot reach the homelab. The retro machine can keep being 1998 without being trusted as 2026.
FAST PATHS
Direct links for the traffic that actually benefits
Cthulhu ↔ QNAP
Dedicated point-to-point 10GbE for large file transfers and storage work.
Cthulhu ↔ HP TrueNAS
Dedicated point-to-point 10GbE for backup administration, restores and direct data movement.
Cthulhu ↔ Supermicro C
QSFP+ DAC, direct subnet, wildly more bandwidth than this little helper server needs.
Cthulhu ↔ Supermicro D
Direct 40GbE into the Proxmox playground. Bought cheaply, flashed with Mellanox Firmware Tools and kept because it worked.
“40G, because it worked.”
The 1G switch is still enough
The HP ProCurve remains the central VLAN switch because bulk transfers can bypass it on dedicated links. It is factory fanless; a tiny Noctua was added anyway because “can't hurt” is also a valid cooling policy.
One deliberately separate Wi-Fi
A Starlink Mesh Mini in the bedroom broadcasts its own Starlink WLAN outside OPNsense and the homelab. Its glamorous primary client is an eight-or-nine-year-old Blu-ray/DVD player used for Netflix and Prime. It is not on the UPS, so during a power cut that branch simply disappears first.