Current network reference
This is the canonical record for current networks, addresses, DNS, ingress, routes, and remote access. Runtime values are as of 2026-07-17 unless stated otherwise.
Segments
| Name | CIDR / gateway | Purpose | Confidence |
|---|---|---|---|
| LAN | 192.168.0.0/24; OPNsense 192.168.0.1 |
Clients and administration | Verified 2026-07-02 through OPNsense; Headscale route serving 2026-07-17 |
| DMZ | 192.168.2.0/24; OPNsense 192.168.2.1 |
Proxmox and service LXCs | Verified 2026-07-17 from guests; OPNsense interface last verified 2026-07-02 |
| WANN | 192.168.1.0/24; OPNsense 192.168.1.17 |
Secondary upstream | Verified 2026-07-02 |
| WAN | 100.120.227.147/10 on OPNsense ixv0 |
Starlink/upstream path | Verified 2026-07-02 |
| Tailnet | 100.64.0.0/10 allocation |
Headscale-managed remote access | Nodes/routes verified 2026-07-17 |
| Starlink management | 192.168.100.0/24 |
Starlink-side management/historical conflict | User-confirmed and observed 2026-07-01; not an internal LAN |
The OPNsense SSH path failed authentication on 2026-07-17 and its QEMU guest agent was not running. Interface values newer than 2026-07-02 are therefore Unverified. Next safe step: correct the SSH identity selection or use the authenticated LAN UI/API, then capture interface status without exporting secrets.
Reserved service addresses
| Address | System | Assignment |
|---|---|---|
192.168.2.1 |
OPNsense DMZ | Interface address |
192.168.2.2 |
CT 102 Technitium |
DHCP reservation |
192.168.2.3 |
CT 103 Caddy ingress |
DHCP reservation |
192.168.2.5 |
CT 104 khysite |
DHCP reservation |
192.168.2.10 |
Proxmox pve |
Static host management |
192.168.2.20 |
CT 101 Podman |
DHCP reservation |
192.168.2.70 |
CT 106 RustDesk |
Static guest configuration |
192.168.2.120 |
CT 105 subnet router |
DHCP lease/reservation status unverified |
Do not infer that a guest uses a static address from a stable value in this
table. Check pct config and the OPNsense reservation before changing either
side.
DNS
Technitium at 192.168.2.2 is the client and DMZ policy resolver. On
2026-07-17 it listened on TCP/UDP 53 and its web console listened on TCP
5380. OPNsense Dnsmasq last rendered DHCP option 6 as 192.168.2.2 for LAN
and DMZ on 2026-07-02.
Proxmox is a documented bootstrap exception. Its localhost-only
kh3-pve-dnsmasq.service forwards public queries to 1.1.1.1 and 1.0.0.1
and provides explicit internal bootstrap overrides. This prevents host recovery
from depending on CT 102.
On 2026-07-17:
- Technitium resolved
git.kh3group.comto192.168.2.3. - Technitium resolved
docs.kh3group.comto public Cloudflare addresses, not the internal Caddy address. This is a split-DNS inconsistency, but the Proxmox local override still directspveto192.168.2.3. - The Technitium console listened on all interfaces at
*:5380; firewall or ingress policy must restrict it.
Ingress
Ingress Caddy v2.11.4 listens on TCP 80 and 443 in CT 103. Internal
service names normally resolve to 192.168.2.3, and Caddy reverse proxies to
high ports or internal appliances. Exact routes belong in the
service catalog.
Headscale routes
CT 105 ts-router served these routes on 2026-07-17:
| Route | State | Purpose |
|---|---|---|
192.168.0.0/24 |
Approved, available, serving | LAN access |
192.168.2.0/24 |
Approved, available, serving | DMZ access |
pve retained approval for 192.168.2.0/24 but did not advertise or serve it.
Tailscale SNAT is the documented default; verify tailscale debug prefs before
changing return-routing assumptions.
Safe validation
ssh pvessh 'ip -4 address show; ip route; pct list'
ssh pvessh 'for id in 101 102 103 104 105 106; do pct exec "$id" -- hostname -I; done'
ssh pvessh 'pct exec 102 -- dig +short @192.168.2.2 git.kh3group.com A'
ssh pvessh 'pct exec 103 -- ss -H -lntp | grep -E ":(80|443)"'
ssh ovps-me 'sudo -iu podsvc podman exec headscale headscale nodes list-routes'
For firewall changes, follow OPNsense and obtain an approved change window. Do not infer policy solely from reachability.