windy/vps
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
d43fc5aa0140e9301a81855b6b461e6472d3904c
vps/docs/lan-overview.md
T

184 lines
11 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# LAN network overview
A standalone, live-verified map of the **internal LAN** hosts and the software
deployed on them. Written for a future self / another agent to get oriented fast.
Focused per-host facts and runbooks live in [`../hosts/`](../hosts/) and are linked
from each section below.
> **Scope:** this document covers the real LAN only. It deliberately excludes the public VPS
> hosts (`mx2`, `us2`, `us4`, `hk2`, `synapse`) and any dormant/stub software. The
> WireGuard VPN server is external (`us4.wsvc.info`); there is **no WireGuard interface on
> the LAN side**.
> **Verified live on 2026-08-06** by read-only SSH from the WSL client. No
> changes were made. `gfw.windy.lan` root SSH was re-verified the same day after
> the key was installed; its facts below are from the fresh probe.
---
## Topology
```
Internet
│ PPPoE (pppoe0, MTU 1492, IPv6 PD /60)
▼
┌───────────────────────────────────────────────┐
│ gw — EdgeRouter X (192.168.66.254) │
│ eth0 = LAN66 · switch0(eth1-3) = LAN55 │
│ WAN_IN active on pppoe0 (default-drop) │
│ port-forwards: hass/transmission/ssh/openvpn │
LAN66 └───────────────┬──────────────────────────────┘
(192.168.66.0/24) │
│ gfw.windy.lan — OpenWrt / OpenClash (192.168.66.1)
│ dns.windy.lan — AdGuard Home + Mihomo (192.168.66.36)
│ ubnt — UniFi Network Controller (192.168.66.46)
```
> **SE5420 purchased (2026-08-09):** TP-Link `TL-SE5420` acquired; deployment plan is
> [lan-se5420-deployment-guide.md](lan-se5420-deployment-guide.md). Design/planning refs:
> [lan-erx-se5420-network.md](lan-erx-se5420-network.md),
> [lan-core-switch-upgrade-plan.md](lan-core-switch-upgrade-plan.md).
---
## Hosts
| Host | Role | SSH | IPv4 | Facts |
|------|------|-----|------|-------|
| **gw** | EdgeRouter X primary LAN gateway | `ssh -4 zhiqiang@192.168.66.254` | `192.168.66.254` | [hosts/gw.md](../hosts/gw.md) |
| **PVE** | Proxmox host (`.66.26`/vmbr0 · `.55.26`/vmbr1) — hosts gfw/dns/ubnt/haos VMs | `ssh -4 root@192.168.66.26` | `192.168.66.26` | — |
| **gfw.windy.lan** | OpenWrt LAN gateway / OpenClash — **PVE VM 140** | `ssh -4 root@192.168.66.1` | `192.168.66.1` | [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) |
| **dns.windy.lan** | AdGuard Home LAN DNS + Mihomo explicit proxy — **PVE VM 120** (`pihole`) | `ssh -4 windy@192.168.66.36` | `192.168.66.36` | [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) |
| **ubnt** | UniFi Network Controller — **PVE VM 160** | `ssh -4 windy@192.168.66.46` | `192.168.66.46` | [hosts/ubnt.md](../hosts/ubnt.md) |
| **haos** | Home Assistant (HAOS) — **PVE VM 180** (LAN55) | — | `192.168.55.11` | — |
| **NAS/FreeNAS** | NAS; `transmission` jail runs here (`.51`) | — | — | — |
| **U6 Lite** | UniFi AP (LAN66) | `ssh -4 zhiqiangf@192.168.66.6` | `192.168.66.6` | [docs/unifi-network.md](../docs/unifi-network.md) |
| **UAP-AC-Lite** | UniFi AP (LAN55) | `ssh -4 zhiqiangf@192.168.55.5` | `192.168.55.5` | [docs/unifi-network.md](../docs/unifi-network.md) |
> **Positioning facts (verified 2026-08-09):** `dns`/`ubnt`/`gfw`/`haos` are all VMs on PVE
> (no separate physical hosts); `transmission` is a FreeNAS/NAS jail. Only gw, PVE,
> NAS, U6, UAP-AC-Lite, and wired PCs/NAS are physical SE5420 ports. See
> [lan-se5420-deployment-guide.md](lan-se5420-deployment-guide.md) §1.
---
## gw — EdgeRouter X (LAN gateway)
| Item | Value |
|------|-------|
| Platform | EdgeOS v3.0.1 (Build 5862409), kernel 4.14.54-UBNT |
| Interfaces | `eth0`=192.168.66.254/24 (LAN66) · `switch0`=192.168.55.254/24 (LAN55) · `eth4`=WAN PPPoE · `pppoe0`=WAN default route (MTU 1492, IPv6 PD /60) |
| WAN | `pppoe0`=113.68.54.159 (PPPoE) · IPv6 SLAAC /64 on both LANs |
| Firewall | `WAN_IN` **active** on pppoe0 (established/related accept, invalid drop, default drop) · `LAN_IN`/ `LAN_OUT` defined but **inactive** (not attached) |
| DHCP | LAN1 (66) + LAN2 (55), 24h leases, client DNS = `192.168.66.36`, pools .38–.243, static mappings for infra hosts |
| DNS | `service dns forwarding` cache 512, listen on eth0 + switch0; DHCP advertises `192.168.66.36` as client DNS |
| Port-forwards | `hass`→192.168.55.11:8123 · `transmission`→192.168.66.51:51413 · `ssh`→192.168.66.36:22 (orig 5822) · `openvpn`→192.168.66.32:1194 · WAN iface pppoe0 |
| Management | SSH TCP 22 · EdgeOS GUI HTTP 80 / HTTPS 443 |
**Static DHCP mappings (LAN66):** `OnePlus-12`=.37, `gfw`=.1, `hp-nas`=.32, `pihole`=.36, `pve`=.26, `transmission`=.51, `ubnt-6`=.6, `ubnt-app`=.46, `windy-pc`=.99. LAN55: `Aqara-Hub-M3-10CB`=.248.
> **Note:** `LAN_IN`/`LAN_OUT` are defined but not applied to an interface, so LAN55
> and LAN66 are bidirectionally reachable by default. Do not rely on those rules as
> an access boundary. See [hosts/gw.md](../hosts/gw.md).
---
## gfw.windy.lan — OpenWrt / OpenClash gateway
| Item | Value |
|------|-------|
| IPv4 | `192.168.66.1` |
| OS | **ImmortalWrt 25.12.0** (r37854), Linux 6.12.87, x86/64 |
| SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) |
| OpenClash | `/etc/openclash/clash` (clash_meta core) + config `/etc/openclash/pass-cat.yaml` |
| Mode | **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`, `en_mode=fake-ip`, `proxy_mode=rule`) |
| DNS | dnsmasq → clash DNS `127.0.0.1#7874`; `mosdns` also listens on `127.0.0.1:6052` (not the active path) |
| nft | `table inet fw4` with OpenClash TPROXY/redirect + DNS-hijack rules; residual `table inet passwall` (0 packets, unused) |
**OpenClash listeners:** HTTP `7890` · SOCKS `7891` · Redirect `7892` · Mixed `7893` · TPROXY `7895` · DNS `7874` · dashboard `9090`. `8443` is **not** an OpenClash listener (only in its TLS-sniffing port list).
> **Operational note:** a LAN client request logged as `<client> --> localhost:8443` + refusal is normally an explicit-proxy client sending its own loopback to the gateway. Fix the
> originating host's `NO_PROXY`/`no_proxy` config; do not create a listener on this router to mask it. See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md).
---
## dns.windy.lan — AdGuard Home + Mihomo (DNS & proxy host)
| Item | Value |
|------|-------|
| IPv4 | `192.168.66.36` |
| OS | Debian 12 (kernel 6.1.0-43) |
| SSH | `ssh -4 windy@192.168.66.36` |
| AdGuard Home | Docker container `adguardhome` (host network, pinned digest), `/opt/adguardhome` |
| DNS | TCP/UDP `53` (no source ACL — serves both LAN55 and LAN66) |
| UI | `192.168.66.36:80` (LAN66 only via nft `agh_ui_access`) |
| Upstreams | `https://dns.alidns.com/dns-query` + `https://doh.pub/dns-query` (load-balanced) · bootstrap `223.5.5.5`/`223.6.6.6` · fallback `https://adg.chans.xyz/dns-query` |
| DNSSEC | **disabled** (upstream path failed known-bad-signature check) |
| Rewrites | `hass.local` + `hass.windy.lan` → same Home Assistant address |
| Query log | 14 days, anonymized client IPs |
| Mihomo | **systemd service** (NOT Docker) — `/usr/local/bin/mihomo -d /etc/mihomo`, config `/etc/mihomo/config.yaml` |
| Mihomo listeners | HTTP `7890` · SOCKS `7891` · Mixed `7892` · DNS `1053` · external-controller `9090` · `allow-lan: true` · mode `rule` |
| nft | `table inet agh_ui_access` permits only `192.168.66.0/24` to TCP/80, drops other TCP/80 input |
**Routing boundary:** read-only checks found no host TUN policy routing or nftables/iptables transparent-redirection on this host. A Mihomo listener alone does not mean it intercepts AdGuard traffic; the default gateway (`gfw.windy.lan`) can still affect outbound, so inspect its OpenClash rules separately before changing upstream routing.
---
## ubnt — UniFi controller host
| Item | Value |
|------|-------|
| IPv4 | `192.168.66.46` |
| Compose | `/home/windy/unifi-9/compose.yml` · service `unifi` · container `unifi-controller` |
| Image | `jacobalberty/unifi:v9.5.21` (host network) |
| HTTPS UI | `https://192.168.66.46:8443` |
| Inform | `http://192.168.66.46:9080/inform` (not 8080) |
| Health | `docker inspect --format '{{.State.Health.Status}}' unifi-controller` → `healthy` (2026-08-06) |
| Also running | **dockge** (`louislam/dockge:1`, healthy) — compose UI, `/opt/stacks` |
| Dormant | `semaphoreui` (semaphore + postgres, exited 9 months) · `homarr` dir (no container) |
**Proxy contract:** the container keeps `NO_PROXY`/`no_proxy` enabled with
`localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12` so a controller
request to `localhost:8443` stays local instead of going to the OpenClash gateway.
See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md).
---
## Managed access points
| Name | Model | Mgmt IP | Firmware | Network | Inform |
|------|-------|---------|----------|---------|--------|
| U6 Lite | U6 Lite (UAL6) | `192.168.66.6` | 6.7.54.15663 | LAN66 | `:9080` |
| UAP-AC-Lite | U7LT | `192.168.55.5` | 6.8.2.15592 | LAN55 | `:9080` |
Both reported **Connected** to `http://192.168.66.46:9080/inform` on 2026-08-06.
AP SSH account is `zhiqiangf` (key-only, verified). See [docs/unifi-network.md](../docs/unifi-network.md).
---
## Quick orientation (who runs what)
| Service | Host | How to reach |
|---------|------|--------------|
| LAN gateway / routing / DHCP | gw | `ssh -4 zhiqiang@192.168.66.254` |
| Transparent/explicit proxy (OpenClash) | gfw.windy.lan | `ssh -4 root@192.168.66.1` |
| LAN DNS (AdGuard Home) + Mihomo proxy | dns.windy.lan | `ssh -4 windy@192.168.66.36` |
| UniFi controller + dockge | ubnt | `ssh -4 windy@192.168.66.46` |
| Wi-Fi APs | U6 Lite / UAP-AC-Lite | via controller |
---
## Related docs
- [hosts/gw.md](../hosts/gw.md) — EdgeRouter X detail, firewall, verification record
- [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) — OpenClash listeners
- [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) — AdGuard Home + Mihomo detail
- [hosts/ubnt.md](../hosts/ubnt.md) — UniFi controller + proxy contract
- [docs/unifi-network.md](../docs/unifi-network.md) — APs, inform endpoint, recovery
- [docs/unifi-third-party-vlan10-dhcp.md](unifi-third-party-vlan10-dhcp.md) — VLAN Wi-Fi feasibility and DHCP boundary
- [docs/unifi-openwrt-vlan10-implementation-examples.md](unifi-openwrt-vlan10-implementation-examples.md) — supported topology and examples
- [docs/edgerouter-x-configuration.md](../docs/edgerouter-x-configuration.md) — effective gw config
- [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md) — proxy bypass
- [runbooks/adguard-home-health.md](../runbooks/adguard-home-health.md) — AGH health
Reference in New Issue View Git Blame Copy Permalink