# LAN network overview A standalone, live-verified map of the **internal LAN** hosts and the software deployed on them. Written for a future self / another agent to get oriented fast. Focused per-host facts and runbooks live in [`../hosts/`](../hosts/) and are linked from each section below. > **Scope:** this document covers the real LAN only. It deliberately excludes the public VPS > hosts (`mx2`, `us2`, `us4`, `hk2`, `synapse`) and any dormant/stub software. The > WireGuard VPN server is external (`us4.wsvc.info`); there is **no WireGuard interface on > the LAN side**. > **Verified live on 2026-08-06** by read-only SSH from the WSL client. No > changes were made. `gfw.windy.lan` root SSH was re-verified the same day after > the key was installed; its facts below are from the fresh probe. --- ## Topology ``` Internet │ PPPoE (pppoe0, MTU 1492, IPv6 PD /60) ▼ ┌───────────────────────────────────────────────┐ │ gw — EdgeRouter X (192.168.66.254) │ │ eth0 = LAN66 · switch0(eth1-3) = LAN55 │ │ WAN_IN active on pppoe0 (default-drop) │ │ port-forwards: hass/transmission/ssh/openvpn │ LAN66 └───────────────┬──────────────────────────────┘ (192.168.66.0/24) │ │ gfw.windy.lan — OpenWrt / OpenClash (192.168.66.1) │ dns.windy.lan — AdGuard Home + Mihomo (192.168.66.36) │ ubnt — UniFi Network Controller (192.168.66.46) ``` --- ## Hosts | Host | Role | SSH | IPv4 | Facts | |------|------|-----|------|-------| | **gw** | EdgeRouter X primary LAN gateway | `ssh -4 zhiqiang@192.168.66.254` | `192.168.66.254` | [hosts/gw.md](../hosts/gw.md) | | **gfw.windy.lan** | OpenWrt LAN gateway / OpenClash | `ssh -4 root@192.168.66.1` | `192.168.66.1` | [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) | | **dns.windy.lan** | AdGuard Home LAN DNS + Mihomo explicit proxy | `ssh -4 windy@192.168.66.36` | `192.168.66.36` | [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) | | **ubnt** | UniFi Network Controller | `ssh -4 windy@192.168.66.46` | `192.168.66.46` | [hosts/ubnt.md](../hosts/ubnt.md) | | **U6 Lite** | UniFi AP (LAN66) | `ssh -4 zhiqiangf@192.168.66.6` | `192.168.66.6` | [docs/unifi-network.md](../docs/unifi-network.md) | | **UAP-AC-Lite** | UniFi AP (LAN55) | `ssh -4 zhiqiangf@192.168.55.5` | `192.168.55.5` | [docs/unifi-network.md](../docs/unifi-network.md) | --- ## gw — EdgeRouter X (LAN gateway) | Item | Value | |------|-------| | Platform | EdgeOS v3.0.1 (Build 5862409), kernel 4.14.54-UBNT | | Interfaces | `eth0`=192.168.66.254/24 (LAN66) · `switch0`=192.168.55.254/24 (LAN55) · `eth4`=WAN PPPoE · `pppoe0`=WAN default route (MTU 1492, IPv6 PD /60) | | WAN | `pppoe0`=113.68.54.159 (PPPoE) · IPv6 SLAAC /64 on both LANs | | Firewall | `WAN_IN` **active** on pppoe0 (established/related accept, invalid drop, default drop) · `LAN_IN`/ `LAN_OUT` defined but **inactive** (not attached) | | DHCP | LAN1 (66) + LAN2 (55), 24h leases, client DNS = `192.168.66.36`, pools .38–.243, static mappings for infra hosts | | DNS | `service dns forwarding` cache 512, listen on eth0 + switch0; DHCP advertises `192.168.66.36` as client DNS | | Port-forwards | `hass`→192.168.55.11:8123 · `transmission`→192.168.66.51:51413 · `ssh`→192.168.66.36:22 (orig 5822) · `openvpn`→192.168.66.32:1194 · WAN iface pppoe0 | | Management | SSH TCP 22 · EdgeOS GUI HTTP 80 / HTTPS 443 | **Static DHCP mappings (LAN66):** `OnePlus-12`=.37, `gfw`=.1, `hp-nas`=.32, `pihole`=.36, `pve`=.26, `transmission`=.51, `ubnt-6`=.6, `ubnt-app`=.46, `windy-pc`=.99. LAN55: `Aqara-Hub-M3-10CB`=.248. > **Note:** `LAN_IN`/`LAN_OUT` are defined but not applied to an interface, so LAN55 > and LAN66 are bidirectionally reachable by default. Do not rely on those rules as > an access boundary. See [hosts/gw.md](../hosts/gw.md). --- ## gfw.windy.lan — OpenWrt / OpenClash gateway | Item | Value | |------|-------| | IPv4 | `192.168.66.1` | | OS | **ImmortalWrt 25.12.0** (r37854), Linux 6.12.87, x86/64 | | SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) | | OpenClash | `/etc/openclash/clash` (clash_meta core) + config `/etc/openclash/pass-cat.yaml` | | Mode | **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`, `en_mode=fake-ip`, `proxy_mode=rule`) | | DNS | dnsmasq → clash DNS `127.0.0.1#7874`; `mosdns` also listens on `127.0.0.1:6052` (not the active path) | | nft | `table inet fw4` with OpenClash TPROXY/redirect + DNS-hijack rules; residual `table inet passwall` (0 packets, unused) | **OpenClash listeners:** HTTP `7890` · SOCKS `7891` · Redirect `7892` · Mixed `7893` · TPROXY `7895` · DNS `7874` · dashboard `9090`. `8443` is **not** an OpenClash listener (only in its TLS-sniffing port list). > **Operational note:** a LAN client request logged as ` --> localhost:8443` + refusal is normally an explicit-proxy client sending its own loopback to the gateway. Fix the > originating host's `NO_PROXY`/`no_proxy` config; do not create a listener on this router to mask it. See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md). --- ## dns.windy.lan — AdGuard Home + Mihomo (DNS & proxy host) | Item | Value | |------|-------| | IPv4 | `192.168.66.36` | | OS | Debian 12 (kernel 6.1.0-43) | | SSH | `ssh -4 windy@192.168.66.36` | | AdGuard Home | Docker container `adguardhome` (host network, pinned digest), `/opt/adguardhome` | | DNS | TCP/UDP `53` (no source ACL — serves both LAN55 and LAN66) | | UI | `192.168.66.36:80` (LAN66 only via nft `agh_ui_access`) | | Upstreams | `https://dns.alidns.com/dns-query` + `https://doh.pub/dns-query` (load-balanced) · bootstrap `223.5.5.5`/`223.6.6.6` · fallback `https://adg.chans.xyz/dns-query` | | DNSSEC | **disabled** (upstream path failed known-bad-signature check) | | Rewrites | `hass.local` + `hass.windy.lan` → same Home Assistant address | | Query log | 14 days, anonymized client IPs | | Mihomo | **systemd service** (NOT Docker) — `/usr/local/bin/mihomo -d /etc/mihomo`, config `/etc/mihomo/config.yaml` | | Mihomo listeners | HTTP `7890` · SOCKS `7891` · Mixed `7892` · DNS `1053` · external-controller `9090` · `allow-lan: true` · mode `rule` | | nft | `table inet agh_ui_access` permits only `192.168.66.0/24` to TCP/80, drops other TCP/80 input | **Routing boundary:** read-only checks found no host TUN policy routing or nftables/iptables transparent-redirection on this host. A Mihomo listener alone does not mean it intercepts AdGuard traffic; the default gateway (`gfw.windy.lan`) can still affect outbound, so inspect its OpenClash rules separately before changing upstream routing. --- ## ubnt — UniFi controller host | Item | Value | |------|-------| | IPv4 | `192.168.66.46` | | Compose | `/home/windy/unifi-9/compose.yml` · service `unifi` · container `unifi-controller` | | Image | `jacobalberty/unifi:v9.5.21` (host network) | | HTTPS UI | `https://192.168.66.46:8443` | | Inform | `http://192.168.66.46:9080/inform` (not 8080) | | Health | `docker inspect --format '{{.State.Health.Status}}' unifi-controller` → `healthy` (2026-08-06) | | Also running | **dockge** (`louislam/dockge:1`, healthy) — compose UI, `/opt/stacks` | | Dormant | `semaphoreui` (semaphore + postgres, exited 9 months) · `homarr` dir (no container) | **Proxy contract:** the container keeps `NO_PROXY`/`no_proxy` enabled with `localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12` so a controller request to `localhost:8443` stays local instead of going to the OpenClash gateway. See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md). --- ## Managed access points | Name | Model | Mgmt IP | Firmware | Network | Inform | |------|-------|---------|----------|---------|--------| | U6 Lite | U6 Lite (UAL6) | `192.168.66.6` | 6.7.54.15663 | LAN66 | `:9080` | | UAP-AC-Lite | U7LT | `192.168.55.5` | 6.8.2.15592 | LAN55 | `:9080` | Both reported **Connected** to `http://192.168.66.46:9080/inform` on 2026-08-06. AP SSH account is `zhiqiangf` (key-only, verified). See [docs/unifi-network.md](../docs/unifi-network.md). --- ## Quick orientation (who runs what) | Service | Host | How to reach | |---------|------|--------------| | LAN gateway / routing / DHCP | gw | `ssh -4 zhiqiang@192.168.66.254` | | Transparent/explicit proxy (OpenClash) | gfw.windy.lan | `ssh -4 root@192.168.66.1` | | LAN DNS (AdGuard Home) + Mihomo proxy | dns.windy.lan | `ssh -4 windy@192.168.66.36` | | UniFi controller + dockge | ubnt | `ssh -4 windy@192.168.66.46` | | Wi-Fi APs | U6 Lite / UAP-AC-Lite | via controller | --- ## Related docs - [hosts/gw.md](../hosts/gw.md) — EdgeRouter X detail, firewall, verification record - [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) — OpenClash listeners - [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) — AdGuard Home + Mihomo detail - [hosts/ubnt.md](../hosts/ubnt.md) — UniFi controller + proxy contract - [docs/unifi-network.md](../docs/unifi-network.md) — APs, inform endpoint, recovery - [docs/edgerouter-x-configuration.md](../docs/edgerouter-x-configuration.md) — effective gw config - [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md) — proxy bypass - [runbooks/adguard-home-health.md](../runbooks/adguard-home-health.md) — AGH health