Network

Addressing Scheme

The lab uses private IPv4 addressing across multiple subnets, organized by function:

tabularx}{}{l l X}

<strong>Subnet</strong> & <strong>Allocation</strong> & <strong>Purpose</strong> \\

---

10.10.8.0/21 & chonk, chonk-wifi, music.lan (via skynet) & Main office / desk area\\

10.10.12.0/& time, node90x, odroid-c1, blowfish, ns1 & Core infrastructure\\

10.10.13.0/ & ldap/bbb1 & Directory services (moved to working hosts)\\

10.10.14.0/ & blowfish (reassigned) & New allocation for blowfish\\

10.10.15.0/ & femputer & Guest / temporary hosts\\

10.10.16.0/& stargate, skynet, edge-t & Lab backbone / staging

tabularx}

Note: The full subnet masks vary by role and DHCP scope configuration on the Dream Machine (DHCP server).

DHCP

The dhcp} Ansible role manages the DHCP server configuration stored at roles/dhcp/files/dhcpd.conf}. Key reserved hosts include:

• <strong>chonk</strong>: 10.10.8.60, MAC fc:9d:05:01:27:02 -- Franklin's desk
• <strong>chonk-wifi</strong>: 10.10.8.61 -- wireless client
• <strong>chonk-ten-gig-1</strong>: 10.10.8.?? -- dedicated ten-gig link
• <strong>blowfish</strong>: 10.10.8.15 / 10.10.12.15, MAC 98:b7:85:21:ad:77 -- database host
• <strong>femputer</strong>: 10.10.15.1, MAC d8:bb:c1:af:21:17 -- temporary/guest

DNS

The DNS infrastructure is managed by the dns} Ansible role (BIND/named). Zones maintained include:

• Forward zone: db.home.lab
• Reverse zones for each subnet
• A records and PTR records for all lab hosts

DNS role molecule testing confirms BIND packages install correctly and named.conf.options are written. The DNS server (ns1) has been offline during recent audits, which explains why many hosts in the 10.10.x.0/24 range cannot resolve -- ns1 is a single point of failure for lab DNS resolution.

Firewall and Access Control

• The Dream Machine provides built-in DHCP and handles basic routing between subnets
• odroid-c1 serves as the KDC and likely has pf firewall rules managing cross-subnet Kerberos traffic
• OpenBSD hosts (blowfish planned) use pf for host-level firewalls
• stargate has configured SSH access from chonk via openclaw key pair

Physical Topology

The lab spans multiple physical locations and subnets:

• Main office where Franklin and Sly have their desks monitors (music.lan)
• Server racks hosting core infrastructure (time, odroid-c1/KDC)
• Jetson cluster (node900--node903) for GPU compute
• Public cloud (wonderland/178.62.60.55) for external-facing services

Routing between the 192.168.86.x subnet (music) and the rest of the lab requires hopping through skynet due to the non-standard routing configuration.