Internet → 100.107.128.1 CGNAT → 192.168.1.1 Archer VR400 → 192.168.8.1 Beryl AX → 192.168.8.0/24
Pinch to zoom, or tap the image to open it full size.
verified reachable
verified NOT answering / needs attention
Layer 1 - Uplink / Edge
| Device | Address | Role |
|---|
| ISP carrier NAT | 100.107.128.1 | CGNAT. Public IP 121.200.5.77, no inbound ports. |
| TP-Link Archer VR400 | 192.168.1.1 | Upstream NAT / gateway |
| GL.iNet Beryl AX (GL-MT3000) | 192.168.8.1 | DHCP + DNS + gateway for the server segment |
| cloudflared | loopback :20241 | Named tunnel → hermes-dash.basestead.com |
Layer 2 - Proxmox VE @ 192.168.8.100
| Guest | Address | Services (live-verified) |
|---|
| LXC 110 - Pi-hole + Unbound | .10 | Web admin :80 :443 · DNS :53 dead |
| LXC 120 - Arr stack | .20 | Sonarr :8989 · Radarr :7878 · Prowlarr :9696 · Bazarr :6767 · ssh :22 |
| LXC 130 - Jellyfin | .30 | Jellyfin 10.11.11 :8096 ("home-stack") · ssh :22 |
| VM - Docker | .40 | gluetun VPN + qBittorrent WebUI :8080 |
| HAOS VM - Home Assistant | .101 | HA :8123 · supervisor :4357 · Mosquitto :1883 :1884 · Zigbee2MQTT |
| LXC 200 - Hermes Agent | .234 | Open WebUI :3000 · dashboard :9119 · API :8642 (loopback) · emailproxy :1993 :1587 (loopback) · cron ×8 |
Proxmox web UI :8006 and ssh :22 open to the whole flat LAN. One 476 GB NVMe, no NAS.
Layer 3 - LAN / Smart home
| Address | Identity | Status |
|---|
.101 + Sonoff ZBDongle-E | Zigbee coordinator → 2.4 GHz mesh | 6 light groups live and responding |
.116 | AirPlay / AirTunes receiver | Unnamed Apple device |
.174 | Unknown | Answers ping, nothing open on 15 common ports |
Findings
| # | Finding |
|---|
| 1 | Pi-hole serves its web admin but not DNS - :53 times out, everything resolves via the GL.iNet. LAN ad-blocking is effectively off. |
| 2 | Guest IDs in old notes are wrong. This LXC's root disk is pve-vm--200--disk--0, so Hermes is guest 200, not .40. |
| 3 | Two unidentified hosts: .174 (nothing exposed) and .116 (unnamed AirPlay). |
| 4 | Proxmox :8006 / :22 reachable from the whole flat LAN. TOTP on root@pam is the floor. |
| 5 | Single 476 GB NVMe, no NAS - one disk failure takes every guest at once. |
| 6 | .40 and .100 filter ICMP while their service ports are open - uptime checks must use TCP there. |
