<!-- skill: Home Network | version: 1.0.0 | description: VLANs, VPN, NAS and Pi-hole for fast safe home net | category: System & Productivity -->
## Instructions
- Segment network: Main LAN, Guest/IoT, Work — use VLANs 10/20/30 or separate SSIDs if router is basic.
- Isolate IoT/cameras on guest net with client isolation ON and no access to NAS or main PCs.
- Run Pi-hole or AdGuard Home on Pi/mini-PC for network adblock: set as DHCP DNS, allowlist banking/CDN.
- Use WireGuard for remote access: phone/laptop VPN home, never expose SMB/RDP directly to internet.
- Set NAS with SMB for Windows/Mac + NFS for Linux/media; create shares Media, Backups, Docs with quotas.
- Follow 3-2-1 backup: 3 copies, 2 media (NAS + USB), 1 offsite (Backblaze/rclone) — test restores quarterly.
- Reserve DHCP leases for printers, NAS, cameras; document IPs in spreadsheet to avoid conflicts.
- Update router firmware + change default admin/password; disable WPS and remote admin from WAN.
- Troubleshoot speed by wire first: iperf3 to router, then WiFi survey channels 1/6/11 or 5GHz DFS.
- Label cables and ports: patch panel map, colored cables WAN blue/LAN yellow/IoT green for sanity.
- Enable UPS for modem/router/NAS with auto-shutdown script to survive 30-min outages cleanly.
- Monitor with Uptime Kuma + router logs; alert on NAS SMART errors before disks die.
## Examples
- Example 1: Family fix: IoT bulbsFLAP on Guest 2.4GHz only, main 5GHz clean, Zoom drops stop.
- Example 2: Pi-hole: blocks 35% queries, allowlist bank + streaming CDN, secondary DNS 1.1.1.1 fallback.
- Example 3: Remote files: WireGuard phone to home, SMB via VPN only, no port 445 open.
- Example 4: Slow WiFi: survey finds neighbor on Ch6, move to Ch11 + 80MHz 5GHz, 40→320Mbps.
## Workflows
- Workflow A — Setup: 1. Update firmware 2. VLAN/SSID 3. DHCP reserves 4. Pi-hole DNS 5. WireGuard 6. NAS shares.
- Workflow B — Speed triage: 1. Wired speedtest 2. iperf3 LAN 3. WiFi analyzer 4. Change channel 5. Re-test per room.
- Workflow C — NAS backup: 1. SMB shares 2. Quotas 3. Snapshot schedule 4. USB copy 5. Offsite rclone 6. Restore test.
- Workflow D — Guest onboarding: 1. QR code guest SSID 2. Isolated VLAN 3. Bandwidth limit 4. Expire weekly.
## Templates
- WireGuard config (redacted example):
```ini
[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/24
DNS = 192.168.10.2  # Pi-hole
[Peer]
PublicKey = <server-public-key>
Endpoint = home.example.duckdns.org:51820
AllowedIPs = 192.168.10.0/24, 192.168.20.0/24
PersistentKeepalive = 25
```
- DHCP reservation table: NAS .10.10, Printer .10.50, Pi-hole .10.2, Camera1 .20.11 — export CSV from router.
- SMB share plan: //NAS/Media (read family), //NAS/Backups (write only backup user), //NAS/Docs (private).
- Speed log: Date Room Wired WiFi-5G WiFi-2.4 Notes — test with fast.com + iperf3 -c 192.168.10.1.
## Tools
- OpenWrt / UniFi / MikroTik — VLANs, guest nets, WireGuard server without ISP router limits.
- Pi-hole / AdGuard Home — DNS blocklists, query log to find chatty IoT phoning home.
- WireGuard + Tailscale — self-hosted vs zero-config VPN for remote NAS and cameras.
- TrueNAS / Synology — SMB/NFS shares, snapshots, SMART alerts for home NAS.
- iperf3 + WiFi Analyzer + Uptime Kuma — prove speed issues are WiFi vs ISP vs LAN.
- Backblaze B2 + rclone — cheap offsite for 3-2-1, encrypted before upload.
## Advanced
- Run VLAN trunk to managed switch: port profiles untagged IoT vs tagged trunk to APs.
- Failover with dual-WAN or LTE USB: policy route work VLAN to stable link, IoT to cheap link.
- Cache with Prometheus + Grafana: SNMP router stats, Pi-hole API, NAS temps on dashboard.
- Harden DNS with DoH upstream (Quad9/Cloudflare) in Pi-hole to stop ISP snooping.
- Snapshot replication: hourly NAS snapshots kept 30d, replicate nightly to second NAS at parents.
- Document all in NetBox or Obsidian map: topology PNG, passwords in Vaultwarden, QR for guests.
## Documentation
- OpenWrt / UniFi VLAN guides — guest isolation and inter-VLAN firewall rules reference.
- Pi-hole docs — DHCP DNS setup, allowlist regex, updating gravity lists safely.
- WireGuard quickstart — keygen, AllowedIPs split-tunnel vs full-tunnel patterns.
- TrueNAS/Synology SMB/NFS — permissions, snapshots, SMART test schedules.
- SmallNetBuilder + Jim's guides — WiFi channel planning and iperf3 interpretation.