Just to have a straightforward reply…

Let’s start with the concept piece, which you dont need to explicitly follow, but is a decent ref. You dont need to use this explicitly, this is more about how far/close to enterprise you want, whether its for fun, for practice, whatever. From an enterprise perspective, you’ll typically have:

• Management - The only things that belongs here are network devices. Router, switches, etc, but notably not servers. This also - from just a general security perspective - should not be the default network, the vlan you get an IP from ifz you randomly connect to a port. In the enterprise, this is so people dont see the vlan switches are on, at home its just… Good practice at best.
• Services - servers you trust go here. Ones that are providing local services, not accessed by the outside (except via VPN). This could be auth services, a wiki, automation tools - proxmox servers, as an example, would go here. You may also put a jump service here - a single VM with access to management and logging, so that this becomes the only logical means of access (and a physical on the router or a locked up switch for example)
• Workstations - trusted user accessible devices would go here. Your desktop, laptop, etc go here. If an ssid is associated to this network, its typically hidden.
• IoT (no internet) - IoT devices you dont fully trust (as in, pretty much any IoT device) will get put into a VLAN without internet access. Prevents them from phoning home, usually these are closed off devices. Again, not a requirement for home use, but for personal privacy not a bad choice. This became a problem more recently in the enterprise with people buying more consumer-ish stuff at the direction of someone in C Suite who wants their office to behave like their home office. Also put your TV here. Seriously, don’t give smart tvs internet access. Block them and plug in a Linux box or something.
• Guest - Where everyone else goes, a guest vlan with internet only access. Ideally they will each get NATd and can’t see each other either. If you want these guests to be able to cast/airplay/etc though, you also would want/have:
• Media Services VLAN - this is where you would have a Chromecast, AppleTV, mersive solstice pod, airparrot, crestron air media, etc. So your receiving device lives here, in the one vlan you allow some bonjour, and allow men’s forwarding from workstation and guest to both hit this network (and its devices). Security risk. Manageable, but a risk.

There are MANY variations and unique versions of this. This is more or less a typical enterprise with we home media uses mixed in.

Now for structure purposes, you basically would have:

• Management is inaccessible by anything not a switch, with the exception of that one locked down physical port and maybe that jump VM.
• Each VLAN has its own gateway, each gateway is also NTP and DNS. You then have the upstream DNS provider be your pihole (or technitium, or pihole container, etc - I have 3 that I use so something is always up. DNS is not priority ordering, diff conversation, but having multiple is a good idea. Now your devices get their DNS from the gateway IP, and that gets it from your pihole, so you dont need to expose your pihole to those devices directly
• guest has access to NOTHING. Just internet. Maybe the media services if you’re into that sort of thing.
• IoT can be accessed from other vlans, but should have access to nothing else. As in, initiated from outside (workstation, services, etc) passes, initiated.from inside (a roomba) you block.
• the rest generally doesn’t need too much security, its more device management - workstation, servers, etc.

OK so there are the generics, let’s go back to yours.

192.168.1.x - sounds like default to me. Risky to use for proxmox and network management on a vlan generic endpoints will land in. If you have a different one for default - great! Ignore this. If its management, id move Proxmox into 200 instead.

192.168.100.x - solid choice to group up your externally facing riskier stuff and funnel it all through one connection. I’d make sure when that connection goes down everything else loses connectivity - confirm that kill switch works. Bind their network interfaces to the virtual network that goes to your VPN connection (I’m assuming a docker container here).

192.168.200.x - yup, logical group, makes sense to do. I’d probably put your hypervisor here.

Now LXC vs Docker… I’d call that mostly preference. I prefer LXC. I also keep things at a stable version and upgrade when needed, not automatically. If you want automated, your best bet is docker. If you want rock stable, and d9nt mind.manual updates, LXC is great. You can automate some with ansible and the like, but that can be a lot to set up for minimal need. YMMV.

Anything I build from source (honestly, most of what I do) I put in an LXC. Anything I take someone else’s image (rare, but happens), is docker. I have a local git repo I keep synced to projects on codeberg, github, and the like, so my setups are all set to build from that local repo. Makes sure I’ve got the latest if something is taken down, but also a local spot to make changes, test, etc for anything I may push back upstream.

Hope that helps!

Edit: Forgot to talk security!

OK first off, figure out your threat model. Where would threats come from? How serious would they be? What risks are worth taking, which are not?

Security is an ogre (onion) - its got layers. For example, I have zero concern with region blocking. No one is hitting my network from China, so I’m not allowing some random to try and get in.

What I am concerned about is user credentialing for access - one login for all services, MFA is hard required, and I don’t do text/email as MFA - that’s baby town frolics levels of security, I don’t like it.

Best way to think of it is a row of bikes. A thief is going to come by and steal one. Which one will they go for?

Do you need to have 7 bike locks and encase the whole thing in concrete? Or do you need to be enough of a pain in the ass (u lock, braided steel cable or chain looped through the wheel and frame) that the other bike (with a $5 cable lock you can pop open with a bic pen).

Take a networking class. You have numerous fundamental misunderstandings and make wild assumptions on bridging gaps that has specific requirements to occur, which also requires a complete lack of any other security methods.

Take a networking class, please. You need it.

Edit: You’re mad and still down voting, I want to point out you dont even understand the link you provided.

You should probably read that. But looooooong before then, you should take an actual class on networking.

You need it.

Take a networking class instead of spewing nonsense please.

HOW WOULD YOU GET SHELL ACCESS TO HIS ROUTER FROM A FIREWALLED OFF VLAN THAT DOES NOT GAIN ACCESS TO THE MANAGEMENT VLAN THE ROUTER IS ON.

Holy crap dude.

BASIC networking.

Thats my line.

I’m also done having any sort of discussion with you, there is a fundamental misunderstanding of logical network design here, and I have no interest in correcting that. Enjoy your day.

That’s not how any of this works… At all.

No, its managed by the firewall. The existence of a VLAN does not grant it access to egress. The firewall needs to permit that behavior.

Your entire understanding of how a logical network works is wrong. I’m not trying to be a dick - this is just really bad information that you’re sharing.

Your understanding is correct.

Multiple routers is irrelevant and ridiculous.

You are aware that a firewall rule is how you would address - in software, with logic - someone trying to get from VLAN C to VLAN A, right?

That its part of the method you’d use as a layer of security to prevent someone gaining access to.your router?

Assuming the router is compromised from the start is similarly just nutso.

Yes.

And to be clear about things, because that comment doesn’t make any sense for VLANs - a VLAN can contain multiple subnets. You will not have a single subnet across multiple VLANs.

Your config is fine in that regard.

Because the overwhelming majority of multiple vlan use, and proper use at that, is going to be managed by a single firewall at the end. Because that firewall is going to manage intra and inter vlan communication, and to suggest that requires a different physical router is… Wild.

Because logical network design - regardless of egress - is a vital component of any security implementation.

Because having a multiple egress solution that doesn’t rely on a software based connection (VPN) would be absolutely bonkers for a self hosted solution at home.

There are just… So many things that are absolutely buck wild crazy to me in what you’ve said. And not in a fun ‘yee haw’ kind of way, but a “boy oh boy if that could be bottled it would sell like hotcakes on the street” sort of way.

That’s… Insane feedback.

But sure.

Your first sentence was about physical switches…

There already is a logical separation that makes perfect sense - out through VPN with no network access initiated by that VLAN to the other two internal. That’d a security step that’s pretty clear and valid off the bat.

So again - I don’t follow anything of what you’re driving at, no. Because from the first sentence in your first comment forward isn’t making any sense.

Please, clarify, because I don’t know why you’d even bring up different switches for an extremely basic logical separation.

You dont need to have the same subnet on different vlans. You also dont need them to each have a router, that isn’t how this works.

Each VLAN gets a gateway, in a subnet accessible within that VLAN.

Under no circumstances do you need a separate physical router for having 2 VLANs on the same network. That’s not how VLANs work.

Doing all of this on a router doesn’t make sense without a physical separation though

I’m going to have to say, I have zero idea why you would suggest this for something that is logical, and specifically not physical.

Logical separations and vlan segregation for trust models is standard practice (though hopefully more will trend towards a zero trust model, but irrelevant here). There is zero need for any physical separation. What are you talking about?

Not OP, but logical separation and firewall rules is a needed first step for security. They already mentioned in the post that one vlan has dedicated outbound (via VPN only) and doesn’t have access to their .200.

Physical switches per vlan is completely unnecessary, and entirely why vlans are used rather than subnets.

HP/Lenovo/Dell workstation tiny/mini/micro will be cheaper and better supported. Price-wise, I’ve set up 4-5 reasonably powerful t/m/m machines for the cost of my M2 Mac mini.

Which is nice for some of the development work I do, but for a server I personally won’t use anything other than Linux, and I wouldn’t recommend anything else either. Apple adds some funkiness that can be a complete pain (IMO) with some tools, Linux is the only server solution worth using.

So if you want a Mac, go for it, but if you want a server as the most important part, I’d say get an x86 based bit of hardware.

No worries, hope it works out for you!

You could use Authelia with MFA, avoid the CA.

One of the rare situations where that specific mustache can make me laugh!

I remember seeing your toaster progress pretty recently!

Congrats!