technontheos

Write-up · Nov 2026

Home Lab Network Audit: Centralized Device Login and a Segmented Firewall

I audited my home lab of enterprise switches, routers and a wireless controller, then prioritized and fixed what I found, starting with management-plane security.

The problem

I run a home lab of enterprise switches, routers and a wireless controller attached to my home network. I audited its documentation, saved configurations and firewall for blind spots, because every device relied on one shared local account and the records had drifted from what the devices actually ran.

Method

I compared documentation and saved configurations against live device output, read the gateway's firewall policy through its read-only API, and replayed two weeks of centralized logs against the alert rules. Every change followed four parts: pre-checks, implementation, verification and rollback, guided by deny-by-default firewall practice (NIST SP 800-41).

Planned and verified with an AI assistant; all changes applied by me.

Key findings

  • Device logins used one shared local account: no central authentication and no audit trail.
  • Documentation said two edge routers had identical access lists. On the devices, one list was truncated and the other was missing.
  • An automatic gateway update converted the firewall to a zone-based model. I reviewed all 139 migrated policies and confirmed none was lost or changed.
  • New custom firewall zones do not allow reply traffic by default, which would have silently dropped server responses.
  • One alert rule caused most of the noise; seven others had never been tested.

Prioritization

I ranked items by risk to the shared home network, effort, and what each one unblocked. Management-plane security came first: highest risk and a prerequisite for later projects. Anything that could affect family connectivity was staged with a one-step rollback.

Done

  • A hardened jump host requiring an SSH key plus a one-time code.
  • A TACACS+ and RADIUS server on a dedicated management VLAN.
  • That VLAN moved into its own firewall zone with explicit, logged policies, prepared while empty and cut over in one step.
  • Central login and command accounting on the first router, with a console-only break-glass account.

Planned

  • Central login on the remaining routers, switches and wireless controller.
  • 802.1X on access ports.
  • Rebuilding one router's edge filters.
  • Alert tuning.

Skills and tools

Cisco IOSTACACS+RADIUSAAA method listsExtended ACLsZone-based firewall policyVLAN segmentationSSH hardeningMFAnftablesLinux containersProxmoxTailscaleGrafanaLokiSyslogREST API auditingChange managementTechnical documentation

What I learned

Verify against the device and the server's own logs, never against the documentation or a counter that merely looks healthy.