windyboy
27fe9c078e
Move self-described historical/upstream docs to docs/archive/: - agent-runbook-guide.md - lan-core-switch-upgrade-plan.md - lan-rb5009-upgrade.md - se5420-review-claim-verification-2026-08.md Update archive/README.md manifest and fix relative links in active docs and archived docs. Update AGENTS.md docs/ layout description.
247 lines
15 KiB
Markdown
247 lines
15 KiB
Markdown
# LAN network overview
|
||
|
||
A standalone, live-verified map of the **internal LAN** hosts and the software
|
||
deployed on them. Written for a future self / another agent to get oriented fast.
|
||
Focused per-host facts and runbooks live in [`../hosts/`](../hosts/) and are linked
|
||
from each section below.
|
||
|
||
> **Scope:** this document covers the real LAN only. It deliberately excludes the public VPS
|
||
> hosts (`mx2`, `us2`, `us4`, `hk2`, `synapse`) and any dormant/stub software. The
|
||
> WireGuard VPN server is external (`us4.wsvc.info`); there is **no WireGuard interface on
|
||
> the LAN side**.
|
||
|
||
> **Verified live on 2026-08-06** by read-only SSH from the WSL client. No
|
||
> changes were made. `gfw.windy.lan` root SSH was re-verified the same day after
|
||
> the key was installed; its facts below are from the fresh probe.
|
||
>
|
||
> **IPv6 re-verified 2026-08-20** (read-only): UniFi controller `Default`
|
||
> network IPv6 enabled (SLAAC/RA), both APs hold global SLAAC addresses, and
|
||
> `zhiqiangf` key-only AP SSH re-confirmed. See
|
||
> [unifi-network.md](unifi-network.md).
|
||
|
||
---
|
||
|
||
## Topology
|
||
|
||
```
|
||
Internet
|
||
│ PPPoE (pppoe0, MTU 1492, IPv6 PD /60)
|
||
▼
|
||
┌───────────────────────────────────────────────┐
|
||
│ gw — EdgeRouter X (192.168.66.254) │
|
||
│ eth0 = LAN66 · switch0(eth1-3) = LAN55 │
|
||
│ WAN_IN active on pppoe0 (default-drop) │
|
||
│ port-forwards: hass/transmission/ssh/openvpn │
|
||
LAN66 └───────────────┬──────────────────────────────┘
|
||
(192.168.66.0/24) │
|
||
|
||
│ gfw.windy.lan — OpenWrt / OpenClash (192.168.66.1)
|
||
│ dns.windy.lan — AdGuard Home + Mihomo (192.168.66.36)
|
||
│ ubnt — UniFi Network Controller (192.168.66.46)
|
||
```
|
||
|
||
> **SE5420 live (2026-08-22):** TP-Link `TL-SE5420` (purchased 2026-08-09) is
|
||
> online — management `192.168.66.253` reachable, web UI on :80/:443; LAN55
|
||
> 上联为 ER-X `switch0` **单口**（`eth1` up、`eth2`/`eth3` down，2026-08-22
|
||
> 只读核实）→ `switch0` 不再是 LAN55 全量抓包点（同段有线单播在 SE5420 本地
|
||
> 交换），全量点只能靠 SE5420 port mirroring。迁移状态见部署计划
|
||
> [lan-se5420-deployment-guide.md](lan-se5420-deployment-guide.md). Design/planning refs:
|
||
> [lan-erx-se5420-network.md](lan-erx-se5420-network.md),
|
||
> [lan-core-switch-upgrade-plan.md](archive/lan-core-switch-upgrade-plan.md).
|
||
|
||
---
|
||
|
||
## Hosts
|
||
|
||
| Host | Role | SSH | IPv4 | Facts |
|
||
|------|------|-----|------|-------|
|
||
| **gw** | EdgeRouter X primary LAN gateway | `ssh -4 zhiqiang@192.168.66.254` | `192.168.66.254` | [hosts/gw.md](../hosts/gw.md) |
|
||
| **PVE** | Proxmox host (`.66.26`/vmbr0 · `.55.26`/vmbr1) — hosts gfw/dns/ubnt VMs | `ssh -4 root@192.168.66.26` | `192.168.66.26` | — |
|
||
| **gfw.windy.lan** | OpenWrt LAN gateway / OpenClash — **PVE VM 140** | `ssh -4 root@192.168.66.1` | `192.168.66.1` | [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) |
|
||
| **dns.windy.lan** | AdGuard Home LAN DNS + Mihomo explicit proxy — **PVE VM 120** (`pihole`) | `ssh -4 windy@192.168.66.36` | `192.168.66.36` | [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) |
|
||
| **ubnt** | UniFi Network Controller — **PVE VM 160** | `ssh -4 windy@192.168.66.46` | `192.168.66.46` | [hosts/ubnt.md](../hosts/ubnt.md) |
|
||
| **hass.windy.lan** | Home Assistant (HAOS) — **x88 Pro physical box** (LAN55) | `ssh hassio@hass.windy.lan` | `192.168.55.11` | [hosts/hass.windy.lan.md](../hosts/hass.windy.lan.md) |
|
||
| **NAS/FreeNAS** | NAS; `transmission` jail runs here (`.51`) | — | — | — |
|
||
| **U6 Lite** | UniFi AP (LAN66) | `ssh -4 zhiqiangf@192.168.66.6` | `192.168.66.6` | [docs/unifi-network.md](../docs/unifi-network.md) |
|
||
| **UAP-AC-Lite** | UniFi AP (LAN55) | `ssh -4 zhiqiangf@192.168.55.5` | `192.168.55.5` | [docs/unifi-network.md](../docs/unifi-network.md) |
|
||
|
||
> **Positioning facts:** `dns`/`ubnt`/`gfw` are VMs on PVE; `haos` is a **physical x88 Pro
|
||
> box** (HAOS bare-metal, `machine: green`), not a PVE VM (corrected 2026-08-15).
|
||
> `transmission` is a FreeNAS/NAS jail. Physical SE5420 ports: gw, PVE, haos, NAS,
|
||
> U6, UAP-AC-Lite, and wired PCs. See [lan-se5420-deployment-guide.md](lan-se5420-deployment-guide.md) §1.
|
||
|
||
---
|
||
|
||
## gw — EdgeRouter X (LAN gateway)
|
||
|
||
| Item | Value |
|
||
|------|-------|
|
||
| Platform | EdgeOS v3.0.1 (Build 5862409), kernel 4.14.54-UBNT |
|
||
| Interfaces | `eth0`=192.168.66.254/24 (LAN66) · `switch0`=192.168.55.254/24 (LAN55) · `eth4`=WAN PPPoE · `pppoe0`=WAN default route (MTU 1492, IPv6 PD /60) |
|
||
| WAN | `pppoe0`=113.68.54.159 (PPPoE) · IPv6 SLAAC /64 on both LANs |
|
||
| Firewall | `WAN_IN` **active** on pppoe0 (established/related accept, invalid drop, default drop) · `LAN_IN`/ `LAN_OUT` defined but **inactive** (not attached) |
|
||
| DHCP | LAN1 (66) + LAN2 (55), 24h leases, client DNS = `192.168.66.36`, pools .38–.243, static mappings for infra hosts |
|
||
| DNS | `service dns forwarding` cache 512, listen on eth0 + switch0; DHCP advertises `192.168.66.36` as client DNS |
|
||
| Port-forwards | `hass`→192.168.55.11:8123 · `transmission`→192.168.66.51:51413 · `ssh`→192.168.66.36:22 (orig 5822) · `openvpn`→192.168.66.32:1194 · WAN iface pppoe0 |
|
||
| Management | SSH TCP 22 · EdgeOS GUI HTTP 80 / HTTPS 443 |
|
||
|
||
**Static DHCP mappings (LAN66):** `OnePlus-12`=.37, `gfw`=.1, `hp-nas`=.32, `pihole`=.36, `pve`=.26, `transmission`=.51, `ubnt-6`=.6, `ubnt-app`=.46, `windy-pc`=.99. LAN55: `Aqara-Hub-M3-10CB`=.248, `SmartThings-Station`=.48, `espressif`=.47,
|
||
`hass`=.11, `hass-wifi`=.250, `ihost`=.12, `midea_ac_0418`=.10,
|
||
`midea_e3_0198`=.42, `roborock-wm-a141`=.43, `samsung-hub`=.251,
|
||
`matter`=.41 (added 2026-08-20).
|
||
|
||
> **Note:** `LAN_IN`/`LAN_OUT` are defined but not applied to an interface, so LAN55
|
||
> and LAN66 are bidirectionally reachable by default. Do not rely on those rules as
|
||
> an access boundary. See [hosts/gw.md](../hosts/gw.md).
|
||
|
||
---
|
||
|
||
## gfw.windy.lan — OpenWrt / OpenClash gateway
|
||
|
||
| Item | Value |
|
||
|------|-------|
|
||
| IPv4 | `192.168.66.1` |
|
||
| OS | **ImmortalWrt 25.12.0** (r37854), Linux 6.12.87, x86/64 |
|
||
| SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) |
|
||
| OpenClash | `/etc/openclash/clash` (clash_meta core) + config `/etc/openclash/pass-cat.yaml` |
|
||
| Mode | **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`, `en_mode=fake-ip`, `proxy_mode=rule`) |
|
||
| DNS | dnsmasq → clash DNS `127.0.0.1#7874`; clash `nameserver` = mosdns `127.0.0.1:6052` (DIRECT 规则真实 IP 解析,非客户端路径) |
|
||
| nft | `table inet fw4` with OpenClash TPROXY/redirect + DNS-hijack rules; residual `table inet passwall` (0 packets, unused) |
|
||
|
||
**OpenClash listeners:** HTTP `7890` · SOCKS `7891` · Redirect `7892` · Mixed `7893` · TPROXY `7895` · DNS `7874` · dashboard `9090`. `8443` is **not** an OpenClash listener (only in its TLS-sniffing port list).
|
||
|
||
> **Operational note:** a LAN client request logged as `<client> --> localhost:8443` + refusal is normally an explicit-proxy client sending its own loopback to the gateway. Fix the
|
||
> originating host's `NO_PROXY`/`no_proxy` config; do not create a listener on this router to mask it. See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md).
|
||
|
||
---
|
||
|
||
## dns.windy.lan — AdGuard Home + Mihomo (DNS & proxy host)
|
||
|
||
| Item | Value |
|
||
|------|-------|
|
||
| IPv4 | `192.168.66.36` |
|
||
| OS | Debian 12 (kernel 6.1.0-43) |
|
||
| SSH | `ssh -4 windy@192.168.66.36` |
|
||
| AdGuard Home | Docker container `adguardhome` (host network, pinned digest), `/opt/adguardhome` |
|
||
| DNS | TCP/UDP `53` (no source ACL — serves both LAN55 and LAN66) |
|
||
| UI | `192.168.66.36:80` (LAN66 only via nft `agh_ui_access`) |
|
||
| Upstreams | `https://dns.alidns.com/dns-query` + `https://doh.pub/dns-query` (load-balanced) · bootstrap `223.5.5.5`/`223.6.6.6` · fallback `https://adg.chans.xyz/dns-query` |
|
||
| DNSSEC | **disabled** (upstream path failed known-bad-signature check) |
|
||
| Rewrites | `hass.local` + `hass.windy.lan` → same Home Assistant address |
|
||
| Query log | 14 days, anonymized client IPs |
|
||
| Mihomo | **systemd service** (NOT Docker) — `/usr/local/bin/mihomo -d /etc/mihomo`, config `/etc/mihomo/config.yaml` |
|
||
| Mihomo listeners | HTTP `7890` · SOCKS `7891` · Mixed `7892` · DNS `1053` · external-controller `9090` · `allow-lan: true` · mode `rule` |
|
||
| nft | `table inet agh_ui_access` permits only `192.168.66.0/24` to TCP/80, drops other TCP/80 input |
|
||
|
||
**Routing boundary:** read-only checks found no host TUN policy routing or nftables/iptables transparent-redirection on this host. A Mihomo listener alone does not mean it intercepts AdGuard traffic; the default gateway (`gfw.windy.lan`) can still affect outbound, so inspect its OpenClash rules separately before changing upstream routing.
|
||
|
||
---
|
||
|
||
## ubnt — UniFi controller host
|
||
|
||
| Item | Value |
|
||
|------|-------|
|
||
| IPv4 | `192.168.66.46` |
|
||
| Compose | `/home/windy/unifi-9/compose.yml` · service `unifi` · container `unifi-controller` |
|
||
| Image | `jacobalberty/unifi:v9.5.21` (host network) |
|
||
| HTTPS UI | `https://192.168.66.46:8443` |
|
||
| Inform | `http://192.168.66.46:9080/inform` (not 8080) |
|
||
| Health | `docker inspect --format '{{.State.Health.Status}}' unifi-controller` → `healthy` (2026-08-06) |
|
||
| Also running | **dockge** (`louislam/dockge:1`, healthy) — compose UI, `/opt/stacks` |
|
||
| Dormant | `semaphoreui` (semaphore + postgres, exited 9 months) · `homarr` dir (no container) |
|
||
|
||
**Proxy contract:** the container keeps `NO_PROXY`/`no_proxy` enabled with
|
||
`localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12` so a controller
|
||
request to `localhost:8443` stays local instead of going to the OpenClash gateway.
|
||
See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md).
|
||
|
||
---
|
||
|
||
## hass.windy.lan — Home Assistant (HAOS)
|
||
|
||
| Item | Value |
|
||
|------|-------|
|
||
| IPv4 | `192.168.55.11` (LAN55) |
|
||
| DNS | `hass.windy.lan` (AdGuard rewrite; legacy `hass.local` alias) |
|
||
| SSH | `ssh hassio@hass.windy.lan` (key-only, verified 2026-08-13) |
|
||
| Web UI | `http://hass.windy.lan:8123` |
|
||
| WAN | gw port-forward `hass` → `192.168.55.11:8123` |
|
||
| Platform | HAOS on physical x88 Pro box; kernel `6.1.115-haos` (aarch64), `machine: green` |
|
||
|
||
---
|
||
|
||
## Managed access points
|
||
|
||
| Name | Model | Mgmt IP | Firmware | Network | Inform |
|
||
|------|-------|---------|----------|---------|--------|
|
||
| U6 Lite | U6 Lite (UAL6) | `192.168.66.6` | 6.7.54.15663 | LAN66 | `:9080` |
|
||
| UAP-AC-Lite | U7LT | `192.168.55.5` | 6.8.2.15592 | LAN55 | `:9080` |
|
||
|
||
Both reported **Connected** to `http://192.168.66.46:9080/inform` on 2026-08-06.
|
||
AP SSH account is `zhiqiangf` (key-only, verified). See [docs/unifi-network.md](../docs/unifi-network.md).
|
||
|
||
**IPv6 (verified 2026-08-20):** both APs hold global SLAAC IPv6 addresses on
|
||
`br0` — U6 Lite `240e:3bd:235:1fb1::/64` (LAN66), UAP-AC-Lite
|
||
`240e:3bd:235:1fb2::/64` (LAN55) — with RA default routes via `gw`; the
|
||
controller's `Default` network has IPv6 enabled (SLAAC). Prefixes are dynamic
|
||
(PPPoE PD), so they rotate on redial. Details:
|
||
[docs/unifi-network.md](../docs/unifi-network.md).
|
||
|
||
**SSID cleanup (2026-08-21, W1N-207):** the SmartThings Element/vWire provisioning
|
||
SSIDs (`element-8a0d5133c9438f12`, `vwire-8b2d67469e455785`, `vport-F09FC22004E9`)
|
||
were removed/disabled in the controller (`element_adopt` setting off, element wlanconf
|
||
deleted, connectivity `x_mesh_essid`/`x_mesh_psk` cleared, device `x_vwirekey` removed,
|
||
`vwire_enabled`/`mesh_sta_vap_enabled=false`) and cleared from both APs; all
|
||
vwire/vport/element flags on the remaining SSIDs are now `disabled`.
|
||
|
||
**Stable ULA on gw: not feasible (2026-08-21, W1N-207):** EdgeOS v3.0.1
|
||
`interfaces switch switch0` rejects a static `ipv6 address`, and an explicit
|
||
`router-advert` node *replaces* the DHCPv6-PD-slaac RA (drops the delegated GUA
|
||
prefix from radvd → LAN55 loses IPv6 egress after RA expiry). Attempted and rolled
|
||
back cleanly (no `save`; gw config unchanged). Consequence: after a PD rotation,
|
||
restart HA's matter-server (see [hosts/hass.windy.lan.md](../hosts/hass.windy.lan.md))
|
||
to clear stale IPv6 mDNS caches.
|
||
|
||
**LAN55 RA environment (observed 2026-08-21):** besides `gw`, the SmartThings
|
||
Station (.48) and Aqara M3 (.248) act as Thread border routers and advertise ULA
|
||
prefixes (`fd00:5a7:6415:1::/64`, `fd97:d580:16fe:1::/64`); several LAN55 hosts
|
||
(HA, PVE, UAP-AC-Lite) have IPv6 forwarding enabled and mark themselves as
|
||
routers in NDP. This is normal Thread-BDR behaviour and was not the Matter
|
||
failure cause.
|
||
|
||
**Matter 灯泡（2026-08-21 实测，W1N-207）：** 两盏 ESP32-C2 Matter 灯泡
|
||
（VP `0x4891/0x4100`，OUI `34:98:7a`）——工作盏 MAC `34:98:7a:25:a1:f0`；故障盏
|
||
MAC `34:98:7a:27:7f:08`（hostname `matter`，动态 .145）。故障盏已在 Aqara fabric
|
||
`4DF2B1455D19402D` 内、宣告 `CM=0`（不在配对模式）且缺 GUA → 找回需**恢复出厂**
|
||
后扫它自己的二维码。DHCP 保留 `matter`（.45 → MAC `34:98:7a:27:10:bc`）与故障盏
|
||
MAC 不符，保留从未租出（待修，见 [hosts/gw.md](../hosts/gw.md)）。完整排障知识：
|
||
[docs/matter-pairing-troubleshoot.md](matter-pairing-troubleshoot.md)。
|
||
|
||
---
|
||
|
||
## Quick orientation (who runs what)
|
||
|
||
| Service | Host | How to reach |
|
||
|---------|------|--------------|
|
||
| LAN gateway / routing / DHCP | gw | `ssh -4 zhiqiang@192.168.66.254` |
|
||
| Transparent/explicit proxy (OpenClash) | gfw.windy.lan | `ssh -4 root@192.168.66.1` |
|
||
| LAN DNS (AdGuard Home) + Mihomo proxy | dns.windy.lan | `ssh -4 windy@192.168.66.36` |
|
||
| UniFi controller + dockge | ubnt | `ssh -4 windy@192.168.66.46` |
|
||
| Home Assistant | hass.windy.lan | `ssh hassio@hass.windy.lan` · UI `:8123` |
|
||
| Wi-Fi APs | U6 Lite / UAP-AC-Lite | via controller |
|
||
|
||
---
|
||
|
||
## Related docs
|
||
|
||
- [hosts/gw.md](../hosts/gw.md) — EdgeRouter X detail, firewall, verification record
|
||
- [hosts/gfw.windy.lan.md](../hosts/gfw.windy.lan.md) — OpenClash listeners
|
||
- [hosts/dns.windy.lan.md](../hosts/dns.windy.lan.md) — AdGuard Home + Mihomo detail
|
||
- [hosts/ubnt.md](../hosts/ubnt.md) — UniFi controller + proxy contract
|
||
- [hosts/hass.windy.lan.md](../hosts/hass.windy.lan.md) — Home Assistant (HAOS) SSH + LAN access
|
||
- [docs/unifi-network.md](../docs/unifi-network.md) — APs, inform endpoint, recovery
|
||
- [docs/unifi-third-party-vlan10-dhcp.md](unifi-third-party-vlan10-dhcp.md) — VLAN Wi-Fi feasibility and DHCP boundary
|
||
- [docs/unifi-openwrt-vlan10-implementation-examples.md](unifi-openwrt-vlan10-implementation-examples.md) — supported topology and examples
|
||
- [docs/edgerouter-x-configuration.md](../docs/edgerouter-x-configuration.md) — effective gw config
|
||
- [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md) — proxy bypass
|
||
- [runbooks/adguard-home-health.md](../runbooks/adguard-home-health.md) — AGH health |