3.0 KiB
3.0 KiB
created, id, keywords, links, modified, summary, tags, title
| created | id | keywords | links | modified | summary | tags | title | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026-04-16T00:45:29+00:00 | 3e42a2bb-5912-44fc-b73f-f27453f12fde |
|
2026-04-16T00:45:29+00:00 | Complete network topology for the ana-colo environment: FortiGate-80F firewall, 5 network zones, 10+ servers, 4 VPN tunnels, and firewall policy summary. |
|
Ana Colo — Network Topology |
Ana Colo — Network Topology
Last surveyed: 2026-04-15
ana-gw — FortiGate-80F
| Property | Value |
|---|---|
| Model | FortiGate-80F |
| Firmware | v7.2.10 |
| Mode | NAT |
| HA | Standalone (no HA pair) |
| Hostname | ana-gw |
Public IPs
| IP | Assignment |
|---|---|
| 38.120.12.41 | Gateway |
| 38.120.12.42 | wan1 primary — WireGuard, Kokoro TTS |
| 38.120.12.44 | Docker/Traefik (ana-docker), also NAS WebDAV |
| 38.120.12.45 | Webhost (ana-webhost) |
| 38.120.12.46 | TacticalRMM (ana-tacticalrmm) |
Network Zones
| Zone | Subnet | Description |
|---|---|---|
| internal | 10.250.0.0/24 | Gateway itself |
| userland | 10.250.10.0/24 | User workstations (via internal1 VLAN) |
| servers | 10.250.50.0/24 | All servers and Docker hosts |
| sfsrv | 10.250.150.0/24 | File server (ana-nas) |
| mgmt | 10.250.250.0/24 | Management network |
Server Map (10.250.50.0/24)
| IP | Hostname | Purpose |
|---|---|---|
| 10.250.50.50 | ana-nas | File server (NFS), WebDAV :8444 from WAN |
| 10.250.50.51 | ana-srv-ml1 | Ollama (:11434), Kokoro TTS (:8880) |
| 10.250.50.52 | ana-webhost | Web hosting, HTTP/HTTPS/SSH from WAN on .45 |
| 10.250.50.55 | (unnamed) | Pterodactyl game server host, UDP :7777 from WAN |
| 10.250.50.57 | ana-tacticalrmm | TacticalRMM, HTTPS from WAN on .46 |
| 10.250.50.70 | ana-docker | All Docker services, primary target of .44 |
| 10.250.50.80 | (unnamed) | Shared PostgreSQL for Gitea, Vaultwarden, Mattermost |
| 10.250.50.252 | ana-wg | WireGuard gateway, UDP :31337 from WAN on .42 |
VPN Tunnels (4)
| Tunnel | Type | Peer | Local Source | Remote Dest |
|---|---|---|---|---|
| PFI_Ana-ESH | WireGuard | esteban.phasefinal.com (DDNS) | All zones | All remote |
| ana-nh3 | WireGuard | 70.230.226.88 | All zones | All remote |
| ana-to-eshudm | IPsec | — | All zones | 10.0.0.0/16 |
| pfi-ana-nh3 | IPsec | — | All zones | 10.100.0.0/16 |
VPN Routes
| Destination | Tunnel |
|---|---|
| 10.0.0.0/16 | ana-to-eshudm |
| 10.100.0.0/16 | pfi-ana-nh3 |
SSL VPN
- User: lkraven
- Group: ra-users
- Policies: Split tunnel + full tunnel
- Reach: All zones plus all VPN remote subnets
Firewall Policy Summary
Outbound (Internal → WAN)
- All zones → wan1: ALLOW ALL
Cross-Zone
- servers ↔ mgmt ↔ sfsrv: ALLOW ALL
WAN Inbound
- 13 explicit policies targeting specific destination IPs and ports only
- See Port Map for the full list of exposed services