Give your home server one room of its own

A spare machine is often the first honest place to run a product.

It is close, cheap, and already yours. You can put GlobalStacks on it, run a real workload, and learn what the platform needs before paying for a production-shaped version of every problem.

But a machine in the house usually joins the same network as everything else. Laptops, phones, cameras, the router, and a host running code you may not fully trust all end up in one room.

That is the part worth changing first.

The question is not whether a home server can be made to resemble a data centre. It cannot, and it does not need to. The useful question is: can a compromised workload on this host reach the rest of the house?

If the answer is yes, the host is connected. It is not contained.

A VLAN creates a separate room, not a lock

A VLAN is a separate logical network on the same switches and cabling. It gives the GlobalStacks host its own address range and a controlled path back to the trusted network.

For a first boundary, keep the existing home LAN as it is. Add one VLAN for the host and its workloads.

The VLAN itself is not the security boundary. A router that freely forwards traffic between both networks has merely put a label on the door.

The firewall policy is the boundary.

Decide the policy before opening the controller

The design is deliberately asymmetric.

Your trusted LAN needs to reach the GlobalStacks console and whichever management services you have explicitly approved. The host may need DNS, time synchronisation, package mirrors, a backup destination, and carefully chosen external services.

The workloads on the isolated VLAN should not begin connections to your laptop, phone, router, switch, or controller.

That means the decision is not “allow the VLAN”. It is a small set of explicit paths, plus a default that denies lateral access.

A useful first policy looks like this:

This is the distinction that tends to disappear in home-server advice. Network separation gives you a place to enforce a rule. It does not tell the router what that rule is.

Configure one boundary and prove it

The controller workflow is usually straightforward, whether it is Omada or another managed network stack.

1. Create the isolated network and choose a subnet that does not overlap with the existing LAN.
2. Put the switch port for the GlobalStacks host into that VLAN.
3. Add the few allow rules the host genuinely needs.
4. Add deny rules for access from the isolated VLAN to the trusted LAN and network-management interfaces.
5. Move the host, then test the policy from both sides before treating the change as complete.

The last step matters more than the first four.

A host receiving an address such as 10.120.0.10 proves only that it joined the new network. It does not prove that the firewall is doing what you intended.

From the trusted LAN, connect to the approved management surface. From the isolated host, try to reach a trusted laptop and the router’s management address. Check that DNS and time synchronisation still work. If the workload needs outbound access, test only the destinations you meant to allow.

If there are two devices routing traffic in the house, decide which one owns this policy before adding rules. A second Wi-Fi access point is usually just an access point. A second router can introduce another path around the boundary. The topology matters because the policy is only real at the point that forwards the traffic.

What GlobalStacks should take responsibility for

A network VLAN protects the house from the host. It does not decide what a workload inside the host can reach.

That is where GlobalStacks needs its own egress policy. A workload may be allowed to resolve names, contact a package registry, or call one approved API. It should not acquire unrestricted outbound access because the machine hosting it happens to have internet access.

The platform should make those permissions visible before a workload runs, preserve the evidence after it runs, and default to less authority when the operator has not made a decision.

The first VLAN is useful because it makes the remaining question harder to ignore: once code is isolated from the household, what authority does it still have outside its own boundary?

← All writing