The flat network had to go

The whole house sat on one flat subnet. That was fine until I wanted separate networks for IoT devices and for an office. The modem I had couldn't hold static routes for extra subnets, and the managed switch I'd just installed could route but couldn't do NAT. Any split would have needed tricks like proxy ARP or widened masks, and I didn't trust those.

So I bought a real router: a used Sophos SG 230 with six gigabit ports, running OPNsense. All in, it cost under $100 with tax.

Drop-in first, VLANs later

Phase one was a drop-in replacement. The new router took over the old router's address on the LAN, so nothing renumbered. The modem went into bridge mode, the Sophos took over NAT, DHCP, DNS and the VPN, and the switch port just changed what was plugged into it. The VLAN split was a separate phase, done only after the first one was stable.

While I was still building it on the bench, the WAN side pulled an address from the modem's network. The LAN had to sit on a temporary subnet until cutover. The cutover itself happened in the evening with a config backup and a rollback path ready.

Router on a stick

The switch carries one tagged trunk to the router. There are three networks on it: the original range as the native VLAN for trusted devices and servers, an IoT VLAN, and an office VLAN. The switch has no interface addresses on the extra VLANs. That's deliberate. If I'd given them addresses on the switch, it would route between them and skip the firewall entirely.

Wi-Fi was the awkward part. The access points' firmware couldn't put different networks on different SSIDs, so each access point is wired to a single access port in one VLAN. One access point serves the IoT network, one serves the office, and the gaming access point stays on the trusted side. Each access point also needs a static address. Set it before you move its port, because these units fall back to a default address the moment DHCP fails.

What broke, and why

• Renewals were silently ignored. DHCP authoritative mode was off, so clients renewing their old leases got no answer and nothing was logged. Left alone, the servers would have dropped at lease expiry, two days later.
• Reservations aren't optional. The servers had been on DHCP by luck. Each one got a static reservation before cutover.
• Rule order matters. On this version, single-interface filter rules evaluate after multi-interface ones, which surprised me when a rule I expected to win didn't.
• Clients need a reboot to re-DHCP. After a port move, the access point and the clients on it need a restart before they pick up the new network.
• DNS gets redirected. Queries to outside resolvers from the LAN are redirected to the router's own DNS, which runs a blocklist, so ad domains get answered with nothing. Test with real ad subdomains, because a bare parent domain often isn't on the list.
• Browsers try DNS over HTTPS. Chrome upgraded to encrypted DNS and quietly bypassed the router's blocklist. Blocking the provider's DoH hostname in the blocklist sent it back through the router.

What the box does now

The servers and the file server keep their old addresses, so the services that depend on them didn't need changes. The trusted side still carries the servers, and the router handles the internet, DNS filtering, intrusion blocking and reporting.

Live, with loose ends

The VLANs have been live since early October. IoT and office devices sit on their own networks, and the trusted side is unchanged for everything that matters. The loose ends are a couple of devices I still need to identify and move onto the right network, and a few cleanup items on the access points. None of it is urgent, but it's the kind of thing that never gets done unless I write it down.