Home · Volume 4 · Chapter 02

📖 Chapter 02 — Networking Fundamentals

The layer that connects everything. The minimum network knowledge to run a home lab.

v0.1 · draft Vol 4 · Ch 02
~15 min

Learning Objectives

Introduction

You don't need to be a network engineer to run a home lab. You do need to understand the basics: what an IP address is, what a subnet is, what a router does, what DHCP and DNS do. The rest is configuration; the basics are the foundation.

This chapter is the minimum. If you've set up a home router before, a lot of this is review. If you haven't, this is the chapter that demystifies it.

The model: your home as a small network

Your home network is a small version of an office or data center network. There are three roles:

For most homes, the "router" is a single device (often called a "wireless router" or "mesh router") that contains both the router and the switch and the Wi-Fi access point. The internal workings are hidden behind a simple web UI.

IP addresses

Every device on a network has an IP address. The IP address is how devices find each other. The most common format in 2026 is IPv4: four numbers from 0-255, separated by dots. Example: 192.168.1.10.

For your home network, the router typically assigns addresses in the 192.168.1.x range, or 192.168.0.x, or 10.0.0.x. These are "private" addresses — they only work on your local network; they're not routable on the internet.

Subnets: a group of related IPs

A subnet is a range of IP addresses that can talk to each other directly. The most common home subnet is 192.168.1.0/24, which means "all addresses from 192.168.1.0 to 192.168.1.255, total 256 addresses."

The "/24" notation is the subnet mask. /24 means the first 24 bits of the IP address are the "network" part; the last 8 bits are the "host" part. So 192.168.1.10 and 192.168.1.20 are on the same subnet (192.168.1.0/24); 192.168.2.10 is on a different subnet.

Devices on the same subnet can talk directly. Devices on different subnets need a router to forward packets between them.

The router's role

The router has two network interfaces:

When a device on the LAN wants to talk to a device on the internet, the router forwards the packet. When a device on the LAN wants to talk to another LAN device, the switch handles it directly (no router needed).

This is the basic model. It works for 90% of home networks. The lab adds one more thing: multiple subnets.

DHCP: automatic address assignment

You don't manually assign IP addresses to your devices (usually). Instead, the router runs a DHCP server (Dynamic Host Configuration Protocol). When a device connects to the network, it asks "what's my IP address?" and the DHCP server assigns one.

DHCP also tells the device other useful things:

For most home networks, you don't configure DHCP; the router does it. For the lab, you might want a separate DHCP server (running on the NAS or a Pi) for the lab subnet.

DNS: name to address

Humans use names (nas.local, immich.lan). Computers use IP addresses (192.168.1.10). DNS (Domain Name System) translates between the two.

When you type immich.lan in your browser, your computer asks the DNS server "what's the IP for immich.lan?" The DNS server responds with the IP. Your browser connects to that IP.

For most home networks, the router runs a DNS server (often integrated with DHCP). For the lab, you might run your own DNS server (Pi-hole, AdGuard Home, Technitium) to block ads and resolve lab names locally.

Why the lab needs its own subnet

From Chapter 01: the lab should be isolated from the family data. The dataset permissions enforce this at the file level. Network-level isolation enforces it at the network level.

With the lab on a separate subnet:

The isolation is bidirectional. A compromised lab VM can't scan the family network. A compromised family laptop can't directly attack the lab.

VLANs: subnet boundaries at the switch level

A VLAN (Virtual Local Area Network) is a way to put a "tag" on Ethernet frames that says "this is subnet X" or "this is subnet Y." A VLAN-aware switch can keep the subnets separate even though they share the same physical wires.

For the home lab:

The router enforces the VLAN boundaries with firewall rules. VLAN 10 can reach the internet. VLAN 1 can reach the NAS but not the lab VMs. VLAN 20 can reach the internet but nothing on VLAN 1 or VLAN 10.

For a home network, VLANs are an advanced topic. They're not required to run a home lab; they're an additional layer of isolation for the security-conscious.

A simple home network without VLANs

Most home networks don't use VLANs. The setup:

For the family NAS: 192.168.1.10 (a static IP outside the DHCP range, so it never changes). For the lab VMs: 192.168.1.50-100 (a separate range, statically assigned in the VMs). For the family devices: 192.168.1.101+ (assigned by DHCP).

No VLANs. The family devices and the lab VMs are on the same subnet. The isolation is at the file/dataset level (Chapter 01), not the network level.

This is fine for most home labs. VLANs are an upgrade, not a requirement.

A home network with VLANs

For the security-conscious, the upgrade path:

  1. Buy a VLAN-capable router. Options: Ubiquiti UniFi, MikroTik, pfSense on a small PC. Consumer routers from Netgear, Asus, etc. often support VLANs but the UI is awkward.
  2. Buy a VLAN-capable switch. Most managed switches support VLANs.
  3. Buy a VLAN-capable access point (if you have Wi-Fi). Or expect to use a separate SSID per VLAN.
  4. Configure the VLANs on the router, switch, and access point.
  5. Configure the firewall rules on the router: VLAN 10 (lab) can reach the internet but not VLAN 1 (family).

This is the right setup if you're serious about network security. It's also overkill for most home labs.

The static IP pattern

For the NAS and the lab VMs, you want static IP addresses. Static IPs don't change, which means you can always reach the device at the same address.

For the NAS: configure a static IP in TrueNAS (Network → Interfaces → Edit). 192.168.1.10/24, gateway 192.168.1.1.

For lab VMs: configure a static IP in the VM's network settings. 192.168.1.50/24, gateway 192.168.1.1, DNS 192.168.1.1.

For family devices: leave DHCP. They'll get an address from the router's DHCP server, which is fine for phones and laptops.

DNS for the lab

For lab services, you want names like immich.lab.local or grafana.lab.local instead of 192.168.1.50. There are a few ways to do this:

  1. Router's DNS: most home routers let you add custom DNS records. Add immich.lab.local → 192.168.1.50. The whole network can use the name.
  2. Local DNS server: run Pi-hole or AdGuard Home on the NAS. Configure the router to use it as the DNS server. Add lab records to its local DNS.
  3. /etc/hosts on each device: add 192.168.1.50 immich.lab.local to /etc/hosts on every device that needs to reach the lab. Tedious but works.

The first option is easiest; the second is most powerful.

Network security defaults

For a home network, the conversation's recommended defaults:

Engineering Note

Networking is the layer that everything else depends on. The NAS is a black box without a network. The lab is isolated only if the network enforces the isolation. The smart home works only if the network is reliable. Spend the time to understand your network. The investment pays off for years.

Summary

IPs, subnets, routers, switches, DHCP, DNS, VLANs. The home network is a small version of a data center network. The lab needs its own subnet (or VLAN) for network-level isolation. Static IPs for the NAS and lab VMs. DHCP for family devices. Strong Wi-Fi, no UPnP, no public port forwarding. The network is the foundation; everything else builds on it.

Checklist

Looking Ahead

Chapter 03 is virtualization: the mental model of VMs vs containers, when to use which, and the architectural choices that make the home lab actually useful. The network is the foundation; virtualization is the next layer up.

Previous← Ch 01 · The Lab as a System Next📖 Ch 03 · Virtualization →

Ch 02 · v0.1 · drafted from the original ChatGPT conversation, July 2026