// as2.no — IP plan

Public IP, LAN subnet plan, and static assignments.

arild@as2.no:~/ip-plan$ cat public.md

# Public

ItemValue
Public IP85.165.99.110 (dynamic)
Domainsas2.no, arildsorli.no
DDNSdomeneshop-ip-updater (5-min systemd timer)
arild@as2.no:~/ip-plan$ cat lan.md

# LAN — 192.168.10.0/24

RangePurpose
192.168.10.1Router / default gateway (ASUS)
192.168.10.2 – 20Static — infrastructure, switches, servers
192.168.10.100 – 250DHCP pool

# Static assignments

IPDeviceMACNotes
.1ASUSC8:7F:54:D5:C2:E0Default gateway
.2C2960CX-300:57:D2:DA:48:40Switch
.3Server4-WinBC:24:11:3F:1D:C2VM 101
.4C2960CX-100:57:D2:DA:4A:40Switch
.5C2960CX-2F8:A5:C5:E9:EE:40Switch
.6C2960CX-408:CC:A7:92:47:C0Switch (powered off)
.7AP4800-178:72:5D:FB:8F:EAHosts the embedded WLC (Mobility Express) — controller VIP .7
.8HT-PCA8:A1:59:66:30:16Living-room HTPC
.9Yamaha RX-S600D00:A0:DE:A2:F8:D6AV receiver
.10EPSON545C1944:D2:44:54:5C:19Printer - offline
.11JellyfinBC:24:11:9C:7D:89Jellyfin media server — LXC 111 on Server4-Proxmox. Web UI http://192.168.10.11:8096. Media read-only (CIFS) from Server4-Win.
.14Server4-Win11-testBC:24:11:A0:7C:E7VM 102
.15Server4-Ubuntu2BC:24:11:B9:DC:62This server — VM 104 (as2.no)
.16CML ServerBC:24:11:6E:41:AACisco Modeling Labs — VM 105
.17CML LAB ext-conn
.18Eve-ngBC:24:11:E9:B7:1EVM 106
.19Eve-ng ext-conn
.20Server4-Proxmox04:D9:F5:64:FB:B8Hypervisor host (cabled to C2960CX-3)

# Proxmox host — 192.168.10.20

ItemValue
NodeServer4-Proxmox
LocationBod — cabled to C2960CX-3 (.2)
HardwareIntel Core i7-9700 (8 cores), 64 GB RAM
VersionProxmox VE 9.1.4 (kernel 6.17.4-2-pve)
Web UIhttps://proxmox.as2.no (valid cert; also https://192.168.10.20:8006)

Live per-device inventory (MAC, connection, location) lives on clients.html.

arild@as2.no:~/ip-plan$ cat vpn.md

# WireGuard VPN — 10.8.0.0/24

IPPeerNotes
10.8.0.1wg-easy (server)Container on host 192.168.10.15, UDP 51820
10.8.0.2Arild-S26Phone
10.8.0.3Jonas-S24Phone
10.8.0.4 +—Auto-assigned by wg-easy
  • Clients route 0.0.0.0/0 through the tunnel (full tunnel).
  • Client DNS: 192.168.10.15 (dnsmasq) — returns LAN IP for *.as2.no, avoids NAT loopback.
  • NAT masquerade -s 10.8.0.0/24 -o eth0 happens inside the wg-easy container, so traffic leaves with src 172.18.0.2 (the container's bridge IP) when reaching the host.
arild@as2.no:~/ip-plan$ cat docker.md

# Docker bridges

SubnetInterfaceNetwork
172.17.0.0/16docker0Default bridge — portainer (172.17.0.2)
172.18.0.0/16br-788993b8e3bcwg-easy_default — wg-easy (172.18.0.2)
172.19.0.0/16br-8755c7ff5b67dnsmasq_default — dnsmasq (172.19.0.2)
172.20.0.0/16br-8063c00146f6monitoring_default — influxdb, loki, grafana, telegraf, axosyslog (172.20.0.2–6)
arild@as2.no:~/ip-plan$ cat labs.md

# Lab networks (routed)

NetworkLabRoute
10.0.0.0/16CML LAB1Static route on ASUS → 192.168.10.17 (CML LAB ext-conn)
10.1.0.0/16CML LAB2Static route on ASUS → 192.168.10.17 (CML LAB ext-conn)
10.2.0.0/16EVE-NGStatic route on ASUS → 192.168.10.19 (EVE-NG ext-conn)
arild@as2.no:~/ip-plan$ cat dns.md

# DNS

  • LAN resolver: dnsmasq on 192.168.10.15:53 (UFW allows 192.168.10.0/24; reached from WG via dnsmasq container's published port)
  • Upstream: OpenDNS 208.67.222.222, 208.67.220.220
  • *.as2.no resolves to 192.168.10.15 on the LAN and over WireGuard
  • Public A records (as2.no, arildsorli.no) point to public IP, maintained by DDNS updater
  • UFW on host: ports 80/443 open to 192.168.10.0/24 and 172.18.0.0/16 (lets WG clients reach nginx after MASQUERADE)
arild@as2.no:~/ip-plan$ ls ../
index.html — homepage
wiki.html — server wiki
network.html — network topology
monitoring.html — metrics & logs
hardware.html — hardware specs
games.html — browser games
arild@as2.no:~/ip-plan$ cd ..

// as2.no — powered by too much coffee