109 lines
3.0 KiB
Markdown
109 lines
3.0 KiB
Markdown
---
|
|
created: '2026-04-16T00:45:29+00:00'
|
|
id: 3e42a2bb-5912-44fc-b73f-f27453f12fde
|
|
keywords:
|
|
- ana-gw
|
|
- FortiGate-80F
|
|
- ana-docker
|
|
- ana-nas
|
|
- ana-webhost
|
|
- ana-tacticalrmm
|
|
- ana-wg
|
|
- VPN
|
|
- WireGuard
|
|
- IPsec
|
|
links: []
|
|
modified: '2026-04-16T00:45:29+00:00'
|
|
summary: 'Complete network topology for the ana-colo environment: FortiGate-80F firewall,
|
|
5 network zones, 10+ servers, 4 VPN tunnels, and firewall policy summary.'
|
|
tags:
|
|
- infrastructure
|
|
- ana-colo
|
|
- network
|
|
- firewall
|
|
- fortigate
|
|
- vpn
|
|
title: Ana Colo — Network Topology
|
|
---
|
|
|
|
# Ana Colo — Network Topology
|
|
|
|
> **Last surveyed:** 2026-04-15
|
|
|
|
## ana-gw — FortiGate-80F
|
|
|
|
| Property | Value |
|
|
|---|---|
|
|
| Model | FortiGate-80F |
|
|
| Firmware | v7.2.10 |
|
|
| Mode | NAT |
|
|
| HA | Standalone (no HA pair) |
|
|
| Hostname | `ana-gw` |
|
|
|
|
## Public IPs
|
|
|
|
| IP | Assignment |
|
|
|---|---|
|
|
| 38.120.12.41 | Gateway |
|
|
| 38.120.12.42 | wan1 primary — WireGuard, Kokoro TTS |
|
|
| 38.120.12.44 | Docker/Traefik (`ana-docker`), also NAS WebDAV |
|
|
| 38.120.12.45 | Webhost (`ana-webhost`) |
|
|
| 38.120.12.46 | TacticalRMM (`ana-tacticalrmm`) |
|
|
|
|
## Network Zones
|
|
|
|
| Zone | Subnet | Description |
|
|
|---|---|---|
|
|
| internal | 10.250.0.0/24 | Gateway itself |
|
|
| userland | 10.250.10.0/24 | User workstations (via internal1 VLAN) |
|
|
| servers | 10.250.50.0/24 | All servers and Docker hosts |
|
|
| sfsrv | 10.250.150.0/24 | File server (`ana-nas`) |
|
|
| mgmt | 10.250.250.0/24 | Management network |
|
|
|
|
## Server Map (10.250.50.0/24)
|
|
|
|
| IP | Hostname | Purpose |
|
|
|---|---|---|
|
|
| 10.250.50.50 | ana-nas | File server (NFS), WebDAV :8444 from WAN |
|
|
| 10.250.50.51 | ana-srv-ml1 | Ollama (:11434), Kokoro TTS (:8880) |
|
|
| 10.250.50.52 | ana-webhost | Web hosting, HTTP/HTTPS/SSH from WAN on .45 |
|
|
| 10.250.50.55 | (unnamed) | Pterodactyl game server host, UDP :7777 from WAN |
|
|
| 10.250.50.57 | ana-tacticalrmm | TacticalRMM, HTTPS from WAN on .46 |
|
|
| 10.250.50.70 | ana-docker | All Docker services, primary target of .44 |
|
|
| 10.250.50.80 | (unnamed) | Shared PostgreSQL for Gitea, Vaultwarden, Mattermost |
|
|
| 10.250.50.252 | ana-wg | WireGuard gateway, UDP :31337 from WAN on .42 |
|
|
|
|
## VPN Tunnels (4)
|
|
|
|
| Tunnel | Type | Peer | Local Source | Remote Dest |
|
|
|---|---|---|---|---|
|
|
| PFI_Ana-ESH | WireGuard | esteban.phasefinal.com (DDNS) | All zones | All remote |
|
|
| ana-nh3 | WireGuard | 70.230.226.88 | All zones | All remote |
|
|
| ana-to-eshudm | IPsec | — | All zones | 10.0.0.0/16 |
|
|
| pfi-ana-nh3 | IPsec | — | All zones | 10.100.0.0/16 |
|
|
|
|
### VPN Routes
|
|
|
|
| Destination | Tunnel |
|
|
|---|---|
|
|
| 10.0.0.0/16 | ana-to-eshudm |
|
|
| 10.100.0.0/16 | pfi-ana-nh3 |
|
|
|
|
## SSL VPN
|
|
|
|
- **User:** lkraven
|
|
- **Group:** ra-users
|
|
- **Policies:** Split tunnel + full tunnel
|
|
- **Reach:** All zones plus all VPN remote subnets
|
|
|
|
## Firewall Policy Summary
|
|
|
|
### Outbound (Internal → WAN)
|
|
- All zones → wan1: **ALLOW ALL**
|
|
|
|
### Cross-Zone
|
|
- servers ↔ mgmt ↔ sfsrv: **ALLOW ALL**
|
|
|
|
### WAN Inbound
|
|
- **13 explicit policies** targeting specific destination IPs and ports only
|
|
- See [Port Map](ana-colo-port-map.md) for the full list of exposed services |