IPv6 on Dad's a Nerd!

VLAN Segmentation on pfSense: Guest & IoT Networks

Tue, 11 Aug 2026 17:31:22 -0400

Split one flat LAN into three isolated networks — trusted LAN, guest Wi-Fi, and IoT — each on its own VLAN and subnet, with firewall rules that actually enforce the isolation rather than just labeling it. Covers renumbering off the default 192.168.1.1, creating the VLANs, and the specific allow/block rules each network needs.

Why segment at all

A single flat network means every device — laptops, phones, guest devices, smart plugs, cameras, the TV — can see and reach every other device. That’s fine until one of them shouldn’t be trusted: a guest’s phone with unknown malware, or an IoT device with a firmware vulnerability the manufacturer never patched (both a genuine, ongoing category of problem, not a hypothetical). Segmentation means a compromised or just poorly-secured device on the Guest or IoT network can’t reach anything on the trusted LAN, because there’s no route there to begin with — not “we trust it not to,” but “the firewall doesn’t permit it.”

Multi-Site VPN on pfSense: Connect Multiple Locations with WireGuard (No Vendor Fees)

Tue, 11 Aug 2026 16:11:27 -0400

Connects multiple pfSense-routed locations into one routed, dual-stack (IPv4 + IPv6) network using WireGuard — a self-hosted multi-site VPN on pfSense in a hub-and-spoke topology. No NAT, no per-site static IP requirement, no recurring vendor fee.

Terminology note: the underlying technique here is a site-to-site VPN — a permanent, routed tunnel connecting two networks. “Multi-site” just means using that same technique more than once: a hub site runs a separate site-to-site tunnel to each additional location. Two sites is the base case (one tunnel, one peer on each end); three or more is that same setup repeated, with the hub acting as the common point. Nothing about the core configuration changes as sites are added — Step 2 through Step 5 are simply repeated per additional spoke.

pfSense WireGuard IPv6 Setup: Full Tunnel and Split Tunnel Guide

Mon, 10 Aug 2026 21:08:26 -0400

Setting up a home WireGuard VPN on pfSense gets you your own private, self-hosted VPN — no subscription, no third-party logging policy to trust, just your own router. This guide walks through a complete pfSense WireGuard setup with IPv6 covering both major connection modes (full tunnel and split tunnel), dual-stack IPv4 and IPv6 addressing, a stable hostname via Cloudflare Dynamic DNS, and the firewall/NAT rules that actually make traffic pass — not just handshake.

IPv6 Subnetting Explained: Full CIDR Prefix & Usable Range Reference

Wed, 05 Aug 2026 21:57:48 -0400

If you learned IPv6 subnetting by carrying over IPv4 habits, a few things break immediately. There’s no broadcast address, no “network address” burned out of every subnet, and the numbers involved are so large that thinking in individual host counts stops being useful past a certain point. This post is a practical IPv6 subnetting reference: what each CIDR prefix actually gives you, how to read the ranges, and a full table you can bookmark.