Imma shame myself now publicly.

Got 3 Wifi SSIDs, one for internal, one for legacy internal (2.4 only - mostly IOT), one for guests (and my work devices)

AP and FW are from Unifi and i made the guest wifi to be with client isolation.

My entire internal network is one vlan and one subnet.

I plan on fixing that, but yeah…

I’ve got a synology nas that got its webserver ports exposed and synology photo backup ports.

I plan on putting it similary like you, when i get time and a cheap managed switch.

• Putting servers in a managed vlan
• Putting my gaming pc and shady VM (because of mods and root level anti-cheat software, which i dont trust either of them even a tiny bit) into a seperate vlan
• putting my externable reachable stuff (soon to be also a proper reverse proxy with basic and cert auth, for Homeasssitant, jellyfin, […] access without a vpn (because vpn and android auto dont work together and i use my gps tag for automations in Homeassistant)
• putting all other internal devices that i trust, such as my phones and CCTV cams and whatnot in a vlan
• though maybe i would split that too, because i like to keep my cameras and other iot stuff without an internet connection.

Regarding your setup: i think it is pretty strong, only a dmz for externaly reachable stuff is missing. But the rest? Pretty decent!

Very kind of you to share. Made me grin :3 ❤️

The fuck is this abomination?