diff --git a/infrastructure/ana-colo-network.md b/infrastructure/ana-colo-network.md
new file mode 100644
index 0000000..ee92541
--- /dev/null
+++ b/infrastructure/ana-colo-network.md
@@ -0,0 +1,109 @@
+---
+created: '2026-04-16T00:45:29+00:00'
+id: 3e42a2bb-5912-44fc-b73f-f27453f12fde
+keywords:
+- ana-gw
+- FortiGate-80F
+- ana-docker
+- ana-nas
+- ana-webhost
+- ana-tacticalrmm
+- ana-wg
+- VPN
+- WireGuard
+- IPsec
+links: []
+modified: '2026-04-16T00:45:29+00:00'
+summary: 'Complete network topology for the ana-colo environment: FortiGate-80F firewall,
+  5 network zones, 10+ servers, 4 VPN tunnels, and firewall policy summary.'
+tags:
+- infrastructure
+- ana-colo
+- network
+- firewall
+- fortigate
+- vpn
+title: Ana Colo — Network Topology
+---
+
+# Ana Colo — Network Topology
+
+> **Last surveyed:** 2026-04-15
+
+## ana-gw — FortiGate-80F
+
+| Property | Value |
+|---|---|
+| Model | FortiGate-80F |
+| Firmware | v7.2.10 |
+| Mode | NAT |
+| HA | Standalone (no HA pair) |
+| Hostname | `ana-gw` |
+
+## Public IPs
+
+| IP | Assignment |
+|---|---|
+| 38.120.12.41 | Gateway |
+| 38.120.12.42 | wan1 primary — WireGuard, Kokoro TTS |
+| 38.120.12.44 | Docker/Traefik (`ana-docker`), also NAS WebDAV |
+| 38.120.12.45 | Webhost (`ana-webhost`) |
+| 38.120.12.46 | TacticalRMM (`ana-tacticalrmm`) |
+
+## Network Zones
+
+| Zone | Subnet | Description |
+|---|---|---|
+| internal | 10.250.0.0/24 | Gateway itself |
+| userland | 10.250.10.0/24 | User workstations (via internal1 VLAN) |
+| servers | 10.250.50.0/24 | All servers and Docker hosts |
+| sfsrv | 10.250.150.0/24 | File server (`ana-nas`) |
+| mgmt | 10.250.250.0/24 | Management network |
+
+## Server Map (10.250.50.0/24)
+
+| IP | Hostname | Purpose |
+|---|---|---|
+| 10.250.50.50 | ana-nas | File server (NFS), WebDAV :8444 from WAN |
+| 10.250.50.51 | ana-srv-ml1 | Ollama (:11434), Kokoro TTS (:8880) |
+| 10.250.50.52 | ana-webhost | Web hosting, HTTP/HTTPS/SSH from WAN on .45 |
+| 10.250.50.55 | (unnamed) | Pterodactyl game server host, UDP :7777 from WAN |
+| 10.250.50.57 | ana-tacticalrmm | TacticalRMM, HTTPS from WAN on .46 |
+| 10.250.50.70 | ana-docker | All Docker services, primary target of .44 |
+| 10.250.50.80 | (unnamed) | Shared PostgreSQL for Gitea, Vaultwarden, Mattermost |
+| 10.250.50.252 | ana-wg | WireGuard gateway, UDP :31337 from WAN on .42 |
+
+## VPN Tunnels (4)
+
+| Tunnel | Type | Peer | Local Source | Remote Dest |
+|---|---|---|---|---|
+| PFI_Ana-ESH | WireGuard | esteban.phasefinal.com (DDNS) | All zones | All remote |
+| ana-nh3 | WireGuard | 70.230.226.88 | All zones | All remote |
+| ana-to-eshudm | IPsec | — | All zones | 10.0.0.0/16 |
+| pfi-ana-nh3 | IPsec | — | All zones | 10.100.0.0/16 |
+
+### VPN Routes
+
+| Destination | Tunnel |
+|---|---|
+| 10.0.0.0/16 | ana-to-eshudm |
+| 10.100.0.0/16 | pfi-ana-nh3 |
+
+## SSL VPN
+
+- **User:** lkraven
+- **Group:** ra-users
+- **Policies:** Split tunnel + full tunnel
+- **Reach:** All zones plus all VPN remote subnets
+
+## Firewall Policy Summary
+
+### Outbound (Internal → WAN)
+- All zones → wan1: **ALLOW ALL**
+
+### Cross-Zone
+- servers ↔ mgmt ↔ sfsrv: **ALLOW ALL**
+
+### WAN Inbound
+- **13 explicit policies** targeting specific destination IPs and ports only
+- See [Port Map](ana-colo-port-map.md) for the full list of exposed services
\ No newline at end of file