This is the real thing — not a mockup. I run two ISPs into the house: Entel over a Huawei ONT that I patched to escape CG-NAT and get a real, reachable IP, and Mundo Pacífico — allegedly the fastest internet in LatAm — on a 10-Gigabit-capable FiberHome ONT, running the 2 Gbps plan. Through an RJ45-to-SFP+ transceiver, I connect from the router to a 2.5G switch backed by a 10G gateway, so the upper floor can make use of the line's speed without depending on Wi-Fi.
Everything hanging off WAN1 goes through a FortiGate 60D I picked up somewhere — no further questions, please — which right now only runs the DMZ, connected to a 24-port TP-Link switch that every server and lab sits on. WAN2 from Mundo Pacífico, on the other hand, goes straight into a Huawei WiFi AX2 router that acts as the main router for the rest of the house, bypassing the firewall entirely. The architecture is deliberately spread out: an old Core 2 Duo does nothing but reverse-proxy everything through Caddy so no single box is a single point of failure, a Ryzen 5 does the actual heavy lifting, and an old HP ProLiant sits mostly idle as backup muscle. The setup spans two floors: the main rack lives in the central living room, and there's a second, smaller setup upstairs in my bedroom.
| Segment | Gear | Purpose |
|---|---|---|
| WAN1 | Entel · Huawei HG8145X6 | Primary internet, CG-NAT bypassed for a reachable public IP |
| WAN2 | Mundo Pacífico · FiberHome HG5853SF | Used for home stuff and then some, like VoIP for gaming with my family. Computers use this link to get online through 2.5G adapters |
| DMZ | FortiGate 60D + TP-Link TL-SG1024 | Every ground-floor server and lab lives here — no further segmentation yet |
| 2P | 2.5GbE HORACO switch / 10G SFP+ transceiver | Direct from the ISP router, so the upper floor can use the line's full speed without depending on Wi-Fi. With a 10G uplink, it's a full backbone that serves 2.5G to everything else and uses the Linksys SE3005 as a secondary gigabit switch for things that don't need more speed. |
-
Done
CG-NAT bypass on Entel — got a real, reachable public IP on WAN1 instead of sharing one behind carrier NAT.
-
Done
Split gateway from compute — moved reverse-proxy duty onto its own dedicated box (the ThinkCentre) so the lab server going down doesn't take routing with it.
-
Done
Wire the house for 2 Gbps — the Mundo Pacífico line can already deliver it; the internal cabling, not yet.
-
Done
10G/2.5G RJ45 transceiver — off the Mundo Pacífico router's 10G port, finally giving the 2nd-floor rack a real uplink instead of relying on Wi-Fi.
-
Done
Expand the bedroom patch panel — to match what the transceiver upgrade ended up delivering.
-
Idea
Segment the DMZ — as the lab grows past "one flat zone," proper VLANs are the obvious next step. Not committed yet.