| name | ecc-homelab-network-readiness |
| description | Readiness checklist for homelab VLAN segmentation, local DNS filtering, and WireGuard-style remote access before changing router, firewall, DHCP, or VPN configuration. |
| origin | community |
Homelab Network Readiness
Use this skill before changing a home or small-lab network that mixes VLANs,
Pi-hole or another local DNS resolver, firewall rules, and remote VPN access.
This is a planning and review skill. Do not turn it into copy-paste router,
firewall, or VPN configuration unless the target platform, current topology,
rollback path, console access, and maintenance window are all known.
When to Use
- Preparing to split a flat network into trusted, IoT, guest, server, or
management VLANs.
- Moving DHCP clients to Pi-hole, AdGuard Home, Unbound, or another local DNS
resolver.
- Adding WireGuard, Tailscale, ZeroTier, OpenVPN, or router-native VPN access.
- Reviewing whether a homelab change can lock the operator out of the gateway,
switch, access point, DNS server, or VPN server.
- Turning an informal home-network idea into a staged migration plan with
validation evidence.
Safety Rules
- Keep the first answer read-only: inventory, risks, staged plan, validation,
and rollback.
- Do not expose gateway admin panels, DNS resolvers, SSH, NAS consoles, or VPN
management UIs directly to the public internet.
- Do not provide firewall, NAT, VLAN, DHCP, or VPN commands without a confirmed
platform and a rollback procedure.
- Require out-of-band or same-room console access before changing management
VLANs, trunk ports, firewall default policies, or DHCP/DNS settings.
- Keep a working path back to the internet before pointing the whole network at
a new DNS resolver or VPN route.
