Keeping the lab away from the family

Why

Four people share this internet connection and only one of them is running experiments on it. I wanted to be able to unplug things, misconfigure things and leave half-finished containers running overnight without any of that touching my wife's laptop or the kids' tablets. So the lab gets its own network, the household keeps its own, and the rule between them is that the experiment can never reach the people.

The design is boring on purpose. One gateway, two networks. Everything the household uses sits on one of them; the lab machines sit on the other. Between them there is a wall, and the wall has a direction.

Lab to household: denied, all traffic. That is the rule I care about, and it is the one I refuse to relax as a troubleshooting shortcut, because “just open it for a minute” is how every one of these ends. Household to lab: allowed. I want my laptop to reach the lab box without ceremony — a shell, the home-automation dashboard — and the risk I am defending against runs the other way. Lab to internet: allowed, because the lab needs to fetch updates and call APIs. Internet to lab: denied, except the return traffic for connections the lab started itself.

Nothing in here has a port opened to the internet. Not the shell, not the dashboard, not the dashboards I have not built yet. When I want to reach the lab from outside the house, it goes through an encrypted tunnel, and that is the only door.

Two things I learned by getting them wrong.

The first is that a separate WiFi name is not a separate network. My mesh broadcasts a second network name that looks like it isolates smart-home gadgets. It does not. The mesh hardware has no support for tagging traffic, so in access point mode every wireless client lands on the household side whichever name it joined. It is a label, not a boundary, and I had been treating it as a boundary.

That same limitation decides where things physically live. Because the mesh cannot carry a tag, the lab network can only exist downstream of the managed switch. My lab machine had been built somewhere that switch does not reach, plugged into a mesh satellite, which meant it could never join the network it was built for. It moved. That cost me nothing — the box is headless and I reach it over the network anyway, so it has no reason to be near a person — but the alternatives were sixty to a hundred and sixty dollars of extra hardware, and I only avoided them because the box happened to be portable.

The second thing: I do not trust my own memory of what the rules say. The rules are checked from outside by something that actually tries the traffic — eighteen checks matching, none open, none unmeasured. “Blocked” means somebody proved it blocked: from the lab machine, the laptop is unreachable by ping and by the tools I would actually use to log in, while the lab machine’s own internet access still works. That is one test, not two claims.

Running it caught a rule I had written badly. I had added a broad catch-all that dropped everything from the household to the lab except a single exception above it. It contradicted the household-to-lab half of the design, it blocked household-to-lab pings entirely, and it was the reason one of the checks had been reporting a problem that did not exist. I removed it, and now there is a check whose only job is to notice if it ever comes back.

What broke

The remote-access design, on contact with the real world. I planned a VPN server on my own gateway, scoped so a phone could reach only the lab side — and it cannot work here, because the equipment my provider puts in front of the gateway hands it a private address. The dynamic-DNS name resolves to something the internet cannot reach, and the inbound port would have to be forwarded on a device I do not control. Worse, when I went looking I found a VPN server already switched on that I never configured, listening on that same unreachable address with no clients enrolled — on because it shipped on rather than because anyone chose it, which put it straight onto the list of things to switch off. The mesh discovery hurt more: I had already built the lab machine at the far end of the house before learning it could never be on the lab network there.