blog

about

talks

projects

book recs

game recs

blog

about

talks

projects

book recs

game recs

Everything about my smart home and homelab setup

Everything about my smart home and homelab setup

Published on 02 Aug 2026

I've written a couple of posts in the past about how my home network and home automation setup is laid out, but it changed so much over time that it's now time for an updated post! This time I'll put everything together in the same post.

--><br>Part 1: Network stack

My network infra is entirely Ubiquity hardware for a simple reason: I wanted something that was designed for power users, but also that didn’t have too much of a learning curve. While I usually fit the criteria of a mega power user for this type of stuff, modern networks are extremely complicated, so I preferred to stop somewhere in the middle of the curve to avoid the stress of being unable to use the internet due to misconfigurations.

By the way, before starting, I would like to note that this setup is extremely overkill for the average home network! I went for this simply because I thought it was cool, so if you’re reading this because you’re looking for equipment recommendations, keep in mind that something considerably less powerful would most likely already do the trick for you.

Router: Cloud Gateway Fiber

For the router, I chose the Cloud Gateway Fiber as this router is a complete bargain for what it brings to the table. Not only does it have three 10 Gbps ports (one of them being RJ45), including one for WAN, it even has a PoE+ port that can power an AP. Usually something like this would be extremely expensive, but for some reason it just… isn’t, and I guess the market agrees, because finding one of these is a massive challenge. They are constantly sold out almost everywhere as of writing.

AP (WiFi): U7 Pro XG

For the AP, I chose the U7 Pro XG, which is a WiFi 7 router with support for the 6 GHz band. This thing even has a 10 Gbps uplink for some reason which I can’t even use as the PoE+ port on the router is “only” 2.5 Gbps, but it was a very cheap upgrade compared to the regular version, so it seemed like a no-brainer. Luckily I do have WiFi 7 devices around already (the newest iPhones), so I can and am already making use of it.

Switch: Flex 2.5G

I prefer connecting things via Ethernet for maximum performance and reliability, so I chose a Flex 2.5G switch particularly because it has the same SFP+ port that the router has, allowing me to connect the two via fiber and get a clean 10 Gbps connection between them. I also have a second switch of the smaller variant on the opposite end of the apartment. Naturally this means I have long Ethernet cables running through the ceiling to reach all the different rooms of the apartment.

DNS: Pi-Hole

I have a simple Raspberry Pi 3b running Pi-Hole to act as my personal DNS server. It runs Unbound and has a cron job to update the root DNS server list every month. I do not enable it globally though; only certain devices make use of it because I want to prevent guests from having issues as the Pi-Hole makes certain types of websites a bit harder to navigate (sometimes it blocks more than it should and breaks the website).

VPN: WireGuard

My router has native WireGuard support, so I use it to have my phone connect to my home network whenever I'm not connected to my home Wi-Fi. The main use for this is for me to make use of the Pi-Hole anywhere, so as a result the VPN automatically sets the Pi-Hole as the DNS server for its connected devices. I also sometimes use it to access the router's admin console remotely. Nothing else is routed through this VPN.

IP Stack: IPv4 and IPv6 Dual Stack

I went through the trouble of enabling and configuring IPv6 on my network for no reason other than I thought it would be cool. Every VLAN and firewall feature mentioned below then accounts for both IPv4 and IPv6. When it comes to IPv6, the internal networks use SLAAC to distribute the prefixes and have ULAs set up to make writing the IPv6 variant of each firewall rule easier.

VLAN and Firewall setup

My network today consists of a combination of “regular” devices (like my phone), servers, and random IoT devices. To connect these effectively and securely, I went for the following setup:

VLAN1: Management

Contains only the Ubiquity hardware. Has full access to everything.

VLAN10: Trusted

Phones, computers, and my local servers (Pi-Hole, etc). Has mostly full access to everything, apart from gateway / admin console access which I have made so that only certain devices can access.

VLAN20: IoT

Everything home automation related that works via Wi-Fi. This VLAN is completely locked down from everything. It has no external internet access, and they cannot even contact each other (via Wi-Fi client isolation). They are only allowed very specific IP+port exceptions that I control at the firewall level, such as allowing some of the devices to send specific bits of information to my Home...