Homelab Network Setup
Use this skill to design a home or small-lab network that can grow without
needing a full rebuild.
When to Use
- Planning a new home network or redesigning an ISP-router-only setup.
- Choosing gateway, switch, and access point roles.
- Designing IP ranges, DHCP scopes, static reservations, and DNS.
- Preparing for future VLANs, Pi-hole, NAS, lab servers, or VPN access.
- Troubleshooting a new network that has double NAT, unstable Wi-Fi, or changing
server addresses.
How It Works
Start by separating device roles:
Internet
|
Modem or ONT
|
Gateway or router NAT, firewall, DHCP, DNS, inter-VLAN routing
|
Managed switch wired clients, AP uplinks, optional VLAN trunks
|
Access points Wi-Fi only; ideally wired backhaul
Servers and NAS stable addresses, DNS names, monitoring
Clients and IoT DHCP pools, isolated later if VLANs are available
Pick a gateway that matches the operator, not just the feature checklist:
| Option |
Best fit |
Notes |
| ISP router |
Basic internet only |
Limited control and often poor VLAN support |
| UniFi gateway |
Managed home network |
Good UI, ecosystem lock-in |
| OPNsense or pfSense |
Flexible homelab |
Strong VLAN, firewall, VPN, and DNS control |
| MikroTik |
Advanced network users |
Powerful, but easy to misconfigure |
| Linux router |
Tinkerers |
Document rollback before using as primary gateway |
IP Plan
Avoid the most common default, 192.168.1.0/24, when you expect to use VPNs.
It often conflicts with hotels, offices, and ISP routers.
Example small homelab plan:
192.168.10.0/24 trusted clients
192.168.20.0/24 IoT and media devices
192.168.30.0/24 servers and NAS
192.168.40.0/24 guest Wi-Fi
192.168.99.0/24 network management
Gateway convention: .1
Infrastructure reservations: .2 through .49
Dynamic DHCP pool: .50 through .240
Spare room: .241 through .254
Use home.arpa for local names. It is reserved for home networks and avoids the
leakage/conflict problems of ad hoc names like home.lan.
nas.home.arpa
pihole.home.arpa
gateway.home.arpa
switch-01.home.arpa
DHCP And DNS
- Use DHCP reservations for anything you SSH into, bookmark, monitor, or expose
as a service.
- Hand out the gateway as DNS until a local resolver is intentionally deployed.
- If using Pi-hole or another DNS filter, give it a reservation first, then point
DHCP DNS options at that address.
- Keep a small static/reserved range per subnet so replacements do not collide
with dynamic leases.
Cabling And Wi-Fi
- Prefer wired AP backhaul over mesh when you can run Ethernet.
- Use a PoE switch for APs and cameras if the budget allows it.
- Label both ends of each cable and keep a simple port map.
- Put the gateway, switch, DNS server, and NAS on UPS power if outages are common.
Examples
Beginner Upgrade
Goal: Keep the ISP router but stabilize a small lab.
- Set DHCP reservations for NAS, Pi, and any SSH hosts.
- Move local names to
home.arpa.
- Disable duplicate DHCP servers on secondary routers or APs.
- Wire the main AP instead of relying on wireless backhaul.
VLAN-Ready Plan
Goal: Prepare for future segmentation without enabling it immediately.
- Choose non-overlapping /24 ranges for trusted, IoT, servers, guest, and
management.
- Reserve .1 for the gateway and .2-.49 for infrastructure on every subnet.
- Buy a gateway and switch that support VLANs and inter-VLAN firewall rules.
- Document which SSIDs and switch ports will eventually map to each network.
Anti-Patterns
- Double NAT without a reason or documentation.
- Using
192.168.1.0/24 when VPN access is planned.
- Dynamic addresses for NAS, Pi-hole, Home Assistant, or other service hosts.
- Consumer routers repurposed as APs while their DHCP servers are still enabled.
- Flat networks with cameras, smart plugs, laptops, and servers all sharing the
same trust boundary.
See Also
- Skill:
network-interface-health
- Skill:
network-config-validation
1---2name: homelab-network-setup3description: Practical home and homelab network planning for gateways, switches, access points, IP ranges, DHCP reservations, DNS, cabling, and common beginner mistakes.4---5
6# Homelab Network Setup
7
8Use this skill to design a home or small-lab network that can grow without
9needing a full rebuild.
10
11## When to Use
12
13- Planning a new home network or redesigning an ISP-router-only setup.
14- Choosing gateway, switch, and access point roles.
15- Designing IP ranges, DHCP scopes, static reservations, and DNS.
16- Preparing for future VLANs, Pi-hole, NAS, lab servers, or VPN access.
17- Troubleshooting a new network that has double NAT, unstable Wi-Fi, or changing
18 server addresses.
19
20## How It Works
21
22Start by separating device roles:
23
24```text
25Internet
26 |
27Modem or ONT
28 |
29Gateway or router NAT, firewall, DHCP, DNS, inter-VLAN routing
30 |
31Managed switch wired clients, AP uplinks, optional VLAN trunks
32 |
33Access points Wi-Fi only; ideally wired backhaul
34Servers and NAS stable addresses, DNS names, monitoring
35Clients and IoT DHCP pools, isolated later if VLANs are available
36```
37
38Pick a gateway that matches the operator, not just the feature checklist:
39
40| Option | Best fit | Notes |
41| --- | --- | --- |
42| ISP router | Basic internet only | Limited control and often poor VLAN support |
43| UniFi gateway | Managed home network | Good UI, ecosystem lock-in |
44| OPNsense or pfSense | Flexible homelab | Strong VLAN, firewall, VPN, and DNS control |
45| MikroTik | Advanced network users | Powerful, but easy to misconfigure |
46| Linux router | Tinkerers | Document rollback before using as primary gateway |
47
48## IP Plan
49
50Avoid the most common default, `192.168.1.0/24`, when you expect to use VPNs.
51It often conflicts with hotels, offices, and ISP routers.
52
53```text
54Example small homelab plan:
55
56192.168.10.0/24 trusted clients
57192.168.20.0/24 IoT and media devices
58192.168.30.0/24 servers and NAS
59192.168.40.0/24 guest Wi-Fi
60192.168.99.0/24 network management
61
62Gateway convention: .1
63Infrastructure reservations: .2 through .49
64Dynamic DHCP pool: .50 through .240
65Spare room: .241 through .254
66```
67
68Use `home.arpa` for local names. It is reserved for home networks and avoids the
69leakage/conflict problems of ad hoc names like `home.lan`.
70
71```text
72nas.home.arpa
73pihole.home.arpa
74gateway.home.arpa
75switch-01.home.arpa
76```
77
78## DHCP And DNS
79
80- Use DHCP reservations for anything you SSH into, bookmark, monitor, or expose
81 as a service.
82- Hand out the gateway as DNS until a local resolver is intentionally deployed.
83- If using Pi-hole or another DNS filter, give it a reservation first, then point
84 DHCP DNS options at that address.
85- Keep a small static/reserved range per subnet so replacements do not collide
86 with dynamic leases.
87
88## Cabling And Wi-Fi
89
90- Prefer wired AP backhaul over mesh when you can run Ethernet.
91- Use a PoE switch for APs and cameras if the budget allows it.
92- Label both ends of each cable and keep a simple port map.
93- Put the gateway, switch, DNS server, and NAS on UPS power if outages are common.
94
95## Examples
96
97### Beginner Upgrade
98
99Goal: Keep the ISP router but stabilize a small lab.
100
1011. Set DHCP reservations for NAS, Pi, and any SSH hosts.
1022. Move local names to `home.arpa`.
1033. Disable duplicate DHCP servers on secondary routers or APs.
1044. Wire the main AP instead of relying on wireless backhaul.
105
106### VLAN-Ready Plan
107
108Goal: Prepare for future segmentation without enabling it immediately.
109
1101. Choose non-overlapping /24 ranges for trusted, IoT, servers, guest, and
111 management.
1122. Reserve .1 for the gateway and .2-.49 for infrastructure on every subnet.
1133. Buy a gateway and switch that support VLANs and inter-VLAN firewall rules.
1144. Document which SSIDs and switch ports will eventually map to each network.
115
116## Anti-Patterns
117
118- Double NAT without a reason or documentation.
119- Using `192.168.1.0/24` when VPN access is planned.
120- Dynamic addresses for NAS, Pi-hole, Home Assistant, or other service hosts.
121- Consumer routers repurposed as APs while their DHCP servers are still enabled.
122- Flat networks with cameras, smart plugs, laptops, and servers all sharing the
123 same trust boundary.
124
125## See Also
126
127- Skill: `network-interface-health`
128- Skill: `network-config-validation`
RajanthaR