Skip to content

Network Layout

Physical Network Layout

    subgraph Rack1
    GW[GW - pfSense] 
    AP[AP 1] -->|Port20| SWITCH1
    SWITCH1[Switch 1] -->|Port1 / em0| GW
    SWITCH2[Switch 2] --> |Port47/48| SWITCH1
    NAS1[NAS 1] --> |Port3| SWITCH1
    NAS2[NAS 2] --> |Port5/6/7| SWITCH1
    MONSTER[Monster 1/2/3/4] --> |Port11-18| SWITCH1
    LEIGHOOB[Leigh OOB] --> |Port19| SWITCH1
    AP4[AP4 - B/G] --> |Port21| SWITCH1
    MINISWITCH[Netgear Switch]

    subgraph Mill
    MILL[Mill Network - VLAN 1] --> MILLROUTER[Mill Router - Draytek]

    MILLROUTER --> INTERNET((Internet))
    AAISP[Andrews Arnold] --> INTERNET

    GW -->|em3| MINISWITCH
    GW -. L2TP via Mill Network .-> AAISP

    subgraph Pi Room
    PIROOMPC[Pi Room PCs] -->|Port1-42| SWITCH2
    PRINTERS[HP Printer] -->|Port44| SWITCH2
    PIROOMAP[AP 2] --> |Port43| SWITCH2

    subgraph Classroom
    CLASSROOMPC[Class Room PCs] -->|Port1-42| SWITCH2

    subgraph Bar
    AP3[AP3] -->|Port22| SWITCH1

    subgraph Fabrication
    SWITCH3[Switch 3] -->|Port1 / Port46| SWITCH1
    3DPRINTERS[3D Printer Pis] --> |Port2-4| SWITCH3
    LASER[Laser-1] --> |Port5| SWITCH3
    CAD1[CAD-1] --> |Port6| SWITCH3


Name Manf Model Type Location Status Notes
GW HP Unknown Router Rack 1 Live HP desktop system running pfSense
Switch 1 HP Procurve 2510-48G L2 Switch Rack 1 Live For Rack 1 hardware
Switch 2 HP Procurve 2510-48G L2 Switch Rack 1 Live For wired clients in the rooms
Switch 3 HP Procurve 2824 L2 Switch Fabrication Live Switch for the fabrication area
AP 1 Linksys WRT1900ACS AP Top of Rack Live Uses stock firmware
AP 2 BT Business Hub 5 Type A AP Pi Room Live Uses stock firmware (supports OpenWRT)
AP 3 Cisco RV110W AP Bar Live Uses stock firmware
AP 4 Linksys Wireless-G ADSL Gateway AP Behind Rack 1 Live B/G Only network for old devices
NAS 1 QNAP TS-431+ NAS Rack 1 Live
NAS 2 HP Microserver G8 NAS Rack 1 Live
UPS APC ??? UPS Rack 1 Live Powers the NAS systems only
Leigh OOB Raspberry Pi 2 B+ Server Rack 1 Live Gives us 'out of band' access to Hackspace network and devices
Mini Switch Netgear ??? L2 Switch Rack 1 Live Multiple ports on the Mill network, needs switching to Switch 1
Blade Server HP SL2x170z G6 Server Rack 1 Live Proxmox Cluster 'Monster'

L3 Layout / VLANs

TL;DR: All VLANs can access Shared Services, Automation is only accessible via Shared Services.

graph LR
    SHARED[Shared Services - VLAN 225]
    WiFi[WiFi - VLAN 226]
    WIRED[Wired - VLAN 227]
    AUTOMATION[Automation VLAN 229]
    DMZ[DMZ - VLAN 230]
    STORAGE[Storage - VLAN 231]
    ADLAB[AD Lab - VLAN 232]

    SHARED --> DMZ
    SHARED <--> WiFi


    WIRED --> DMZ

    WiFi --> DMZ
    WiFi --> INTERNET
    WiFi <--> WIRED

Mill Network - VLAN '1'

The mill provides internet access via a 100mbps internal network. It can be a bit unreliable but it works for our general usage.

Access to the mill network is provided by a singular CAT5 delivered to the rear of the main space, just above where Rack 1 is.

  • VLAN: 1 (untagged)
  • Subnet:
  • Gateway:
  • DHCP Enabled

Usage is bound by the LBPT Tenant Network Agreement.

Shared Services - VLAN 225

Where the servers, routers, and other central bits are hosted.

IP Range:

The range is split into logical groups:

  • 1 to 9 - Network hardware
  • 10 to 19 - Physical Servers
  • 20 to 29 - Physical Server Management Interfaces
  • 30 to 49 - VMs
  • 50 to 59 - Printers

This subnet does have DHCP enabled, but we encourage static assignments for critical hardware and services. Here is the current list:

Device Name IP Address Location
GW Rack 1
Switch 1 Rack 1
Switch 2 Rack 1
Switch 3 Workshop / Fabrication
NAS 1 Rack 1
NAS 2 Rack 1
Monster 1 Rack 1
Monster 2 Rack 1
Monster 3 Rack 1
Monster 4 Rack 1
Leigh OOB Rack 1
Monster 1 LO100 Rack 1
Monster 2 LO100 Rack 1
Monster 3 LO100 Rack 1
Monster 4 LO100 Rack 1
NAS 2 iLO Rack 1
Apps1 Monster
MX1 Monster
k8s-lab-01 Monster
k8s-lab-02 Monster
k8s-lab-03 Monster
Cobalt RAQ3 Monster
Authentik Monster
RTSP Monster
Discourse Monster
Web1 Monster
HP Laserjet P3015 Pi Room 5/7
GW - VIP 1 VIP for Internal HAProxy
GW - VIP 2 VIP for K8s-Lab

WiFi - VLAN 226

WiFi users, General open access to the internet and internal services. The UnFi APs management interface is in Shared Services on DHCP, only non-UnFi devices are assigned a static IP on the WiFi VLAN.

IP Range:

DHCP enabled, -

Device Name IP Address Location
AP4 Behind Rack 1
Cam1 Rack 1
Cam2 Defunct
Cam3 Social Space
Cam4 Main Space
Cam5 Pi Room
Cam6 Workshop
Cam7 CNC

Channel layouts for the APs:

Device 2.4ghz 5ghz 6ghz
AP1 Auto Auto N/A
AP2 Auto Auto N/A
AP3 Auto Auto N/A
AP4 13 N/A N/A

Wired - VLAN 227

The general hackspace wired network. This covers the Pi Room, Classroom, Electronics, and Fabrication.

IP Range:

DHCP enabled, -

Automation - VLAN 229

Used for any automation devices that do not require open internet access, or need to be secured away from the general network (e.g. Door system).

Accessible via Leighhack-iot WiFi SSID.

IP Range

DHCP enabled, -

This subnet does have DHCP enabled, but we use some static assignment. Here is the current list:

Device Name IP Address Location

DMZ - VLAN 230

Used for internet facing services, all systems are allocated addresses within the A&A delegated IP range.

IP Range:

Device Name IP Address Location
GW Rack 1

Storage - VLAN 231

Non-routed VLAN for VM hosts to connect to storage devices either via iSCSI or NFS, to keep that main broadcast traffic off the main subnets.

Currently not implemented

IP Range:

Device Name IP Address Location

AD Lab - VLAN 232

IP Range:

A non-routed VLAN for our Active Directory lab - GOAD

Consult the GOAD documentation for the breakdown of systems within the environment.


The pfSense has a OpenVPN server, this allocates IPs in the range and is available as a normal interface on pfSense, but it doesn't have a VLAN assigned to it.

OOB Access

Out of band access to the network is available via 'Leigh OOB', this uses Tailscale to handle situations where GW or the L2TP is unavailable.

For access, contact the Infra team, or Andrew Williams.