It really depends on how coupled your services are and how sparse you want to place them.
Are you learning VLANS? Heres my default setup anytime i set a home up:
10.0.10.0/24 my personal devices that I trust the most communicate with anything, but not administrative
10.0.20.0/24 wife/family members that may do stupid things. Communicate with most things
10.0.30.0/24 IoT Communicate with outside only
10.0.40.0/24 Guest. Communicate with some IoT
1.0.50.0/25 outside services. DMZ. All rfc 1918 blocked
1.0.90.0 /24 MGMT communicate everywhere. Administrative use only.
I run most services on .10.
Although I can log into anything from .10, its only to a non-administrative user to check in on basic stuff (is this service running? Did x drive not mount on boot?). Each host is configured to restrict ssh access to admin users to mgmt.
This means i have to switch VLAN to administrate services. It also means those users get less use and are easier to audit. Plus switching to ‘network root’ feels intentional.
You could get it done in an afternoon if you draw a map of the network and keep a tidy checklist. Seriously, map it out first. It’ll serve as documentation you that you WILL need in the future.
It really depends on how coupled your services are and how sparse you want to place them.
Are you learning VLANS? Heres my default setup anytime i set a home up:
10.0.10.0/24 my personal devices that I trust the most communicate with anything, but not administrative 10.0.20.0/24 wife/family members that may do stupid things. Communicate with most things 10.0.30.0/24 IoT Communicate with outside only 10.0.40.0/24 Guest. Communicate with some IoT 1.0.50.0/25 outside services. DMZ. All rfc 1918 blocked 1.0.90.0 /24 MGMT communicate everywhere. Administrative use only.
I run most services on .10.
Although I can log into anything from .10, its only to a non-administrative user to check in on basic stuff (is this service running? Did x drive not mount on boot?). Each host is configured to restrict ssh access to admin users to mgmt.
This means i have to switch VLAN to administrate services. It also means those users get less use and are easier to audit. Plus switching to ‘network root’ feels intentional.
You could get it done in an afternoon if you draw a map of the network and keep a tidy checklist. Seriously, map it out first. It’ll serve as documentation you that you WILL need in the future.
Good luck with the build!