Help us improve
Share bugs, ideas, or general feedback.
From ecc
Reviews homelab network readiness before changing VLANs, DNS filtering, or WireGuard-style remote access. Use to plan staged migrations and avoid lockout.
npx claudepluginhub aaione/everything-claude-code-zh --plugin everything-claude-codeHow this skill is triggered — by the user, by Claude, or both
Slash command
/ecc:homelab-network-readinessThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill before changing a home or small-lab network that mixes VLANs,
Designs a home or small-lab network with guidance on gateways, IP ranges, DHCP, DNS, cabling, and common mistakes. Helps plan scalable networks for NAS, servers, VLANs, and VPN access.
Designs VLAN architectures and configures managed switches like Cisco Catalyst for network segmentation, isolating zones (corporate, servers, DMZ, IoT) to limit lateral movement and meet compliance.
Configures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping for network segmentation and security in enterprise/SMB environments.
Share bugs, ideas, or general feedback.
Use this skill before changing a home or small-lab network that mixes VLANs, Pi-hole or another local DNS resolver, firewall rules, and remote VPN access.
This is a planning and review skill. Do not turn it into copy-paste router, firewall, or VPN configuration unless the target platform, current topology, rollback path, console access, and maintenance window are all known.
Collect this before giving implementation steps:
| Area | Questions |
|---|---|
| Internet edge | What is the modem or ONT? Is the ISP router bridged or still routing? |
| Gateway | What routes, firewalls, handles DHCP, and terminates VPNs? |
| Switching | Which switch ports are uplinks, access ports, trunks, or unmanaged? |
| Wi-Fi | Which SSIDs map to which networks, and are APs wired or mesh? |
| Addressing | What subnets exist today, and which ranges conflict with VPN sites? |
| DNS/DHCP | Which service currently hands out leases and resolver addresses? |
| Management | How will the operator reach the gateway, switch, and AP after changes? |
| Recovery | What can be reverted locally if DNS, DHCP, VLANs, or VPN routes break? |
Start with intent rather than vendor syntax.
| Zone | Typical contents | Default policy |
|---|---|---|
| Trusted | Laptops, phones, admin workstations | Can reach shared services and management only when needed |
| Servers | NAS, Home Assistant, lab hosts, DNS resolver | Accepts narrow inbound flows from trusted clients |
| IoT | TVs, smart plugs, cameras, speakers | Internet access plus explicit exceptions only |
| Guest | Visitor devices | Internet-only, no LAN reachability |
| Management | Gateway, switches, APs, controllers | Reachable only from trusted admin devices |
| VPN | Remote clients | Same or narrower access than trusted clients |
Before recommending VLAN IDs or subnets, confirm:
Pi-hole or another local resolver should be introduced as a dependency, not as a single point of failure.
home.arpa names.Useful validation evidence:
Client gets expected DHCP lease
Client receives expected DNS resolver
Public DNS lookup succeeds
Local home.arpa lookup succeeds
Blocked test domain is blocked only where intended
Gateway and DNS admin interfaces are not reachable from guest or IoT networks
For WireGuard-style access, decide what the VPN is allowed to reach before generating keys or opening ports.
| Mode | Use when | Risk notes |
|---|---|---|
| Split tunnel to one subnet | Remote admin for NAS or lab hosts | Keep route list narrow |
| Split tunnel to trusted services | Access selected apps by IP or DNS | Requires precise firewall rules |
| Full tunnel | Untrusted networks or travel | More bandwidth and DNS responsibility |
| Overlay VPN | Simpler remote access with identity controls | Still needs ACL review |
Do not recommend port forwarding until the operator confirms:
Prefer small, reversible changes:
homelab-network-setupnetwork-config-validationnetwork-interface-health