ccnet-WI: consider a dedicated VLAN for the QNAP, separate from VLAN 10 #30
Labels
No labels
blocked
borg-backup
ceph
forgejo
in-progress
infra
netdata
nextcloud
p:high
p:low
p:medium
searxng
service-onboard
swarm-nodes
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
copper/ccnet-prod-devops#30
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Currently the QNAP shares VLAN 10 (10.20.10.0/24) with ccnet-wi-trixie, ccnet-wi-jump, and ccnet-wi-pbs -- L3 firewall rules on ccnet-wi-fw (added 2026-07-14, see docs/ccnet-wi-site.md) restrict what can reach the QNAP over the WireGuard tunnel (SSH/HTTP/HTTPS from the admin workstation only) and what it can reach outbound (blocked entirely outside the local subnet), but everything on VLAN 10 itself still shares one broadcast domain/L2 segment. A second, QNAP-only VLAN on the TP-Link Omada ES205G switch (192.168.1.251) would add real L2 isolation on top of the existing L3 rules. Not scoped yet -- needs the switch's uplink port identified first (open item, see docs/ccnet-wi-site.md's Omada section) and a decision on how trixie/fw's virtual NICs would need to change to tag the new VLAN.