---
created: '2026-04-16T00:45:29+00:00'
id: 3e42a2bb-5912-44fc-b73f-f27453f12fde
keywords:
- ana-gw
- FortiGate-80F
- ana-docker
- ana-nas
- ana-webhost
- ana-tacticalrmm
- ana-wg
- VPN
- WireGuard
- IPsec
links: []
modified: '2026-04-16T00:45:29+00:00'
summary: 'Complete network topology for the ana-colo environment: FortiGate-80F firewall,
  5 network zones, 10+ servers, 4 VPN tunnels, and firewall policy summary.'
tags:
- infrastructure
- ana-colo
- network
- firewall
- fortigate
- vpn
title: Ana Colo — Network Topology
---

# Ana Colo — Network Topology

> **Last surveyed:** 2026-04-15

## ana-gw — FortiGate-80F

| Property | Value |
|---|---|
| Model | FortiGate-80F |
| Firmware | v7.2.10 |
| Mode | NAT |
| HA | Standalone (no HA pair) |
| Hostname | `ana-gw` |

## Public IPs

| IP | Assignment |
|---|---|
| 38.120.12.41 | Gateway |
| 38.120.12.42 | wan1 primary — WireGuard, Kokoro TTS |
| 38.120.12.44 | Docker/Traefik (`ana-docker`), also NAS WebDAV |
| 38.120.12.45 | Webhost (`ana-webhost`) |
| 38.120.12.46 | TacticalRMM (`ana-tacticalrmm`) |

## Network Zones

| Zone | Subnet | Description |
|---|---|---|
| internal | 10.250.0.0/24 | Gateway itself |
| userland | 10.250.10.0/24 | User workstations (via internal1 VLAN) |
| servers | 10.250.50.0/24 | All servers and Docker hosts |
| sfsrv | 10.250.150.0/24 | File server (`ana-nas`) |
| mgmt | 10.250.250.0/24 | Management network |

## Server Map (10.250.50.0/24)

| IP | Hostname | Purpose |
|---|---|---|
| 10.250.50.50 | ana-nas | File server (NFS), WebDAV :8444 from WAN |
| 10.250.50.51 | ana-srv-ml1 | Ollama (:11434), Kokoro TTS (:8880) |
| 10.250.50.52 | ana-webhost | Web hosting, HTTP/HTTPS/SSH from WAN on .45 |
| 10.250.50.55 | (unnamed) | Pterodactyl game server host, UDP :7777 from WAN |
| 10.250.50.57 | ana-tacticalrmm | TacticalRMM, HTTPS from WAN on .46 |
| 10.250.50.70 | ana-docker | All Docker services, primary target of .44 |
| 10.250.50.80 | (unnamed) | Shared PostgreSQL for Gitea, Vaultwarden, Mattermost |
| 10.250.50.252 | ana-wg | WireGuard gateway, UDP :31337 from WAN on .42 |

## VPN Tunnels (4)

| Tunnel | Type | Peer | Local Source | Remote Dest |
|---|---|---|---|---|
| PFI_Ana-ESH | WireGuard | esteban.phasefinal.com (DDNS) | All zones | All remote |
| ana-nh3 | WireGuard | 70.230.226.88 | All zones | All remote |
| ana-to-eshudm | IPsec | — | All zones | 10.0.0.0/16 |
| pfi-ana-nh3 | IPsec | — | All zones | 10.100.0.0/16 |

### VPN Routes

| Destination | Tunnel |
|---|---|
| 10.0.0.0/16 | ana-to-eshudm |
| 10.100.0.0/16 | pfi-ana-nh3 |

## SSL VPN

- **User:** lkraven
- **Group:** ra-users
- **Policies:** Split tunnel + full tunnel
- **Reach:** All zones plus all VPN remote subnets

## Firewall Policy Summary

### Outbound (Internal → WAN)
- All zones → wan1: **ALLOW ALL**

### Cross-Zone
- servers ↔ mgmt ↔ sfsrv: **ALLOW ALL**

### WAN Inbound
- **13 explicit policies** targeting specific destination IPs and ports only
- See [Port Map](ana-colo-port-map.md) for the full list of exposed services