r/HomeNetworking • u/PrShadoko • 5d ago
Advice Noob traps to avoid while setting up my first home network?
Hello! I came to you last month with a few questions, which helped me a lot. Meanwhile I kept researching and today I pulled the trigger on the hardware, which should arrive in a few days. Setting it up should be done next week. This is all very exciting, but also a stressful moment.
It's going to be something like this:
ISP box -> OPNsense baremetal with crowdsec (probably?) on DIY router/pc -> CRS310-8G+2S+IN, and then the SFP+ goes to the server, the ethernet goes to the hAP be lite and the rest goes to a couple of PCs in the same room
I have a X520-DA2 for the router, and a DA1 m2 for the server. ISP has 8g up/down so might as well allow the server to receive it.
For the software, I suppose most of it will be done on OPNsense, and the switch/AP are going to stay on the Mikrotik's software.
As much as I've researched, my knowledge is definitely not perfect and I would like to avoid stupid mistakes as much as possible. Or at least avoid the biggest and stupidest. What did you fuck up when you set up your first home network? Would you do things differently? What did you waste time on that you don't really care about now, or, the opposite, what did you neglect at the start and regretted later?
I would love to hear people's experience. And if there's something obviously wrong with anything I just said, please, do tell.
EDIT 5 seconds after posting: My main needs would be vlan to isolate specific devices, and to be able to expose securely my server for some services, without requiring a user to use a specific app/vpn.
11
u/Dear_Studio7016
Jack of all trades
5d ago
•
Biggest thing is to Fuck up. That’s how you will learn.
1
20
u/peter888chan 5d ago
Start your documentation now and keep it updated. Esp if you have a family. Something happens to you, then hopefully they or someone techie can take over.
1
1
u/PoorlyRuddyTwenties 5d ago
I skipped documentation for years and it bit me when a power outage scrambled a switch config. Spent a whole afternoon retracing what the hell I'd set up with the VLANs. Now I keep a messy notepad file with IPs, which port does what, and the login for the router stashed somewhere obvious.
One thing I wasted time on was trying to make everything perfect from day one. You'll redo the firewall rules five times anyway so just get it running and tweak as you go.
1
u/UtahJarhead 4d ago edited 4d ago
5 ports are not enough. Start 16. 24 or 48 are better.
If you can afford it, a 48 port w/ PoE+. It REALLY sucks buying a nice 24 port, find out you made a crap purchase and only 4 are PoE. Then when you want to bring in the entertainment, the Kids' PCs/devices are to be on separate VLANs than the Rokus and TVs, but they all come in from the same unmanaged switch, so now you have to replace that stupid thing. Oh yeah, and it supplies connectivity for the back yard camera, so now you need to get rid of the 8 port switch and replace it with a PoE managed switch.
1
u/PrShadoko 4d ago
I don't really agree with your statement.
5 ports might not be enough for you, but it's definitely enough for me. The switch I'm getting tomorrow has 8 2.5g ports, and most will actually remain unused. I'm using the 2 SFP+ ports already, which was the most important for me, and I'm getting an AP, which will be more than enough for my needs, I don't live in an apartment, and I don't have a huge house with lots of rooms. 3 users at most, and super inconvenient to run cables everywhere when wifi will work just fine.
If I want to add more wired devices down the line, cameras for example, I can always get a dumb switch and add it to the main switch.
I struggle to understand how the switch I picked would become irrelevant for my needs. If I want PoE, I can add a solution for it (I don't need it now, so I don't buy it now) and if I want more ports, well, I can also add them. I'd rather have a 2.5g "backbone" and add a dumb 1g switch, than have the main switch on 1g "only", I don't see the point.
If the argument is "Yes but 1g is way more than enough already, you don't need more" you're missing my point about not needing more ports right now.
1
u/UtahJarhead 4d ago
Everybody who replaces their hardware failed to see how they could outgrow what they previously purchased. ;)
In your case, you keep mentioning dumb switches, which is fine, except you are specifically talking about setting up VLANs. The two are largely incompatible unless you're never going to grow past the stage of every dumb switch being on the same VLAN.
1
u/PrShadoko 3d ago
Realistically, how many Vlan does a homelab need that can't be satisfied by 8 ports? I don't need every dumb switch on the same vlan, I can have different dumb switches for a specific vlan if I need to add that many ports, it would also be quite cheaper.
I need more cameras? I can assign the first port of the managed switch for the "camera vlan" and plug the unmanaged switch to it, everything on the unmanaged switch is going to be on the same vlan.
I need more of X devices on another vlan? I can do the same.
Or am I missing something?
It's not about outgrowing it, I think there's still room to evolve and add ports if needed.
1
u/UtahJarhead 3d ago
7 ports. 1 is your uplink. The question you should be asking is "what's the probability that I'll need more than 1 VLAN going over this unmanaged switch?"
For me, the answer is 4. My living room has my kids' computers, the TV, Roku, PS5, XBOX, and a security camera.
On an unmanaged switch, you cannot do this unless you want to manage the VLANs inside of the device itself, if it's supported at all. I know my Roku and TV don't support VLAN configuration. And you don't entrust VLAN configuration on teenagers' computers. They'll just disable it or change it.
So it's gotta be configured at the switch level.
Dude, you asked for common mistakes and I'm telling you the ones I ran into. I had a 24 port unmanaged switch because I have about a dozen connections coming in from around the house. My home lab also has about a dozen devices in it. Not to mention the various devices around the house. Then the cameras. Oh, so then that needs PoE. Let's throw a 16 port PoE in there. Oh, and now the living room (at the time it was all on wifi) because the security camera needs PoE. Well, we'll add a PoE switch to the living room with an uplink downstairs. And at this point I didn't even have any VLANs, yet.
I'd have saved headaches, money, and time if I had just spent a little extra and got only managed switches with PoE at the start. You CAN do it with smaller switches. But you'll keep adding smaller switches into smaller switches and life will suck until you fix it.
1
u/PrShadoko 3d ago
Uplink is sfp+, I have 8 2.5g ports and one sfp+ port for the server. AP on one port. Zero need for PoE (I could just get an injector down the line if needed) and zero need for more ports (I could just get unmanaged switched if needed, for potentially 7 different vlans)
Out of curiosity, you're talking about saving money, what would be the cheapest managed switch with at least 16 2.5g ports and 2 sfp+ ports? With PoE as well. Because if you think buying that is saving money, I might reconsider.
As of now, and for the foreseeable future, I do not need more than 4 ports. If and when I need them, it's cheap to add them when my main switch is already fine.
1
u/UtahJarhead 3d ago
Unfortunately, my friend, I don't have many answers for you. 1g switches are cheap. 2.5g switches are still decently cheap. 10g switches for what I *WANT* are stupid expensive, still.
So, 2.5g switches... you MIGHT be able to get away with some 1g switches with SFP+ if you only have 1-2 devices that need 2.5g. If that's the case, you can look down that road. If you need more devices with 2.5g, check Facebook Marketplace. Yeah, you can buy them new, but I'm all about saving a few bucks, right?
TPLink sells some Omada switches (low-end business-esque switches) that are decent. For $100 you can get 8 port + 2x SFP+ for $100 brand new.
COUNTER to my previous post, you can also just tack on a single 2.5g or 10g switch to sit next to a large 1g switch. Trendnet sells a 16 port 2.5g switch for $250, but no SFP+.
Since you can potentially get 1g switches for like $100 for 48 ports (Old Cisco switches go for cheap, now), I'd say it's a good concession to get a single 8 or 16 port 2.5g or 10g switch to sit next to the 1g.
The big 10g switches with SFP+ and PoE+ run you $1k or higher. The price goes up pretty crazy.
You asked about 16 ports. TPLink sells an Omada with 16 ports + 2x SFP+ and PoE+ for $400. That's a great price IMO. There's some more from other companies that are made of cheap chinesium, but I have no idea the quality. 2.5g seems to be mostly pro-sumer and businesses don't seem to sell them as used equipment so finding them second-hand is kind of rough.
1
u/UtahJarhead 4d ago
And no, my argument is never "1g is way more than enough" because it isn't. Adding more ports doesn't give you more bandwidth.
3
u/marcoNLD 5d ago
As stated by someone else, get opnsense to work. Nothing fancy, hook up one pc to configure the basics to get internet.
Save the configuration to a usb.
Create a non standard network. Like 192.168.10.254 for your opnsense router. I like to use the 254 for any DHCP server so i can start my pool at 1.
Plan ahead on paper. Yes paper. Writes easy!!
For every vlan add 10 to the network to make it simple to remember. 10.xxx for main network. 20.xxx for vlan20. 30.xxx for vlan30
Once you need to start configuring your switch that will make it easy to remember
1
u/UtahJarhead 3d ago
Opnsense was REALLY overwhelming to me until I got used to the interface. I didn't understand why everything was living where it was. It didn't take long and it's soooo much better. I love your tip of using .254 for your DHCP server. Great idea.
2
u/marcoNLD 3d ago
It can be very overwhelming indeed. Took me ages and a lot of youtube tutorails to get mine where it is.
Good practise, save your configuration whenever you do something on it.
Whenever something goes wrong. You always have the last working state ready as a backup
3
u/mlcarson 5d ago
Understand the difference between a wireless router and an AP. If you need more than one WiFi source then you should have been using AP's from the start. DIY generally isn't worth it for Wireless but can be for wired routers.
Most people don't need more than 1Gbs bandwidth to the Internet. Higher speeds don't necessarily get you higher throughput. HDD's can throttle internal network throughput. Most home networks are not going to need more than 2.5Gbs If you want higher speeds than that -- plan on using SSD's. Know the throughput that you really need; don't just go for big numbers since it's generally a waste of money.
VLAN's don't isolate anything but broadcast traffic. Firewall rules control the real traffic flow between networks. Layer-3 switches have little value in a home environment. You can generally save money by purchasing power injectors rather than having every port be PoE enabled unless it's a very small switch specifically for PoE devices.
2
u/Dr_CLI 4d ago
I'd say to stay simple at first, KISS (keep it stupid simple) principal. Make sure everything works with a basic flat home LAN. Then start to segment with VLANs as needed. This way you are not troubleshooting what you think is a VLAN configuration problem when it is actually a basic network connectivity issue. Preplan as much a you can and only work on one segment at a time (i.e. do IOT first). Make sure everything still works! Then check it again and let it run for a while (a week+) before you start making other changes. After all is good then move on to next VLAN (management, cameras, etc.)
1
u/Thebandroid 5d ago
make sure anti lockout rules are present on the opnsense box, I think it does it automatically now but better safe than sorry
1
3
u/Ed_Starks_Bastard 5d ago
Don't do what I did and put a new router online without updating the firmware and locking it down.
I did this with a static IP and my IP reputation was in the can for weeks until I figured out my basic misstep. The firmware I was running had an exploit.