Omada SDN controller and Pi-hole DNS for centralized network management, device tracking, and ad-free browsing across the Sanchez home network.
Key metrics for the Sanchez home network.
Physical and logical layout of the Sanchez home network.
Core network management tools and their capabilities.
TP-Link Omada Software Defined Networking controller managing the ER605 gateway, switches, and access points. Provides centralized configuration for VLANs, firewall rules, DHCP, port forwarding, and client monitoring.
Network-wide ad blocking and DNS server. Serves as the primary DNS for all LAN clients, resolving *.home domains locally and blocking ads and trackers across every device on the network.
Host-level firewall with 39 rules. SSH key-only, ports 80/443 for Traefik, DOCKER-USER chain for container port restrictions.
Two tunnels (SanchezFamily + sanchez-web) route all public traffic. No inbound port forwarding for HTTP/HTTPS. Zero Trust access controls.
WireGuard VPN endpoint on ER605 gateway for secure remote access to the LAN from anywhere. Mobile and desktop client configs available.
Primary hosts on the Sanchez network.
| Host | IP | VLAN | Role |
|---|---|---|---|
| ER605 Gateway | 10.0.1.1 | LAN | Router, DHCP, VPN endpoint |
| rod-server | 10.0.1.6 | LAN | Main server, 49 containers, Traefik, Pi-hole, Omada |
| rod-ml (WSL) | 10.0.1.3 | LAN | ML workstation, Ryzen 9 7950X, RTX 4090, 137GB RAM |
| webserver | 10.0.3.3 | WEBSERVER | Isolated web edge, Forgejo Actions runner |
| Mac mini M4 | 10.0.1.35 | LAN | macOS Claude agent, 16GB RAM |
| TinyDesk | 10.0.1.70 | LAN | PowerChute UPS management |
| ROD-5050 | 10.0.1.11 | LAN | Laptop |
Dual-domain architecture for local and public access.
Pi-hole resolves all *.home domains to 10.0.1.6. Traefik routes to the correct container using the local CA wildcard certificate. Fast, direct LAN access without internet.
32 proxied CNAME records through Cloudflare tunnels. Let's Encrypt certificates auto-renewed by Traefik. Zero Trust access controls on admin services.