Home network¶

Pi Fortress can run a second network from the same Pi for the other devices in the house. These are phones, laptops, smart TVs, and all other devices that are not AI agents. This guide calls that network the house segment.

What it does and does not do¶

For a comparison with the agent network, refer to use cases and FAQ.

What you need¶

• One more USB Ethernet adapter than your uplink and agent network use. The house network needs its own port. With the recommended cables (built-in port to the router, a USB adapter to the agent), this is a second USB adapter.
• A Wi-Fi router that can operate in access point (AP) mode:
  1. Set its Operation Mode to Access Point (also "AP mode" or "bridge mode"). This disables the address sharing (NAT) of the router. It also disables the DHCP server of the router. A DHCP server gives addresses to devices.
  2. Connect a cable from the Pi USB adapter to a LAN port on the router.
  3. Do not connect a cable to the WAN/internet port of the router.
  4. Set a normal WPA2 or WPA3 Wi-Fi password. Do not leave the network open.
• Do not run two DHCP servers on the same network. After you set up the house network, the Pi is the only DHCP server on it.

Set up house.env and apply¶

Pi

sudo nano /etc/pi-fortress/house.env
sudo pf apply

Set HOUSE_IF to the name of your USB adapter (for example eth1). This is the minimum. The other keys have defaults that work. The table below gives the meaning of each key.

Reserve the admin device¶

Select one device as the admin device for the house network. A laptop is the easiest. Only the address of this device can SSH into the Pi from the house and reach the agent network. Use one of these two methods to reserve the address:

• On the Pi, edit the reservation file:

  sudo nano /etc/pi-fortress/house.hosts
  

  Add a line mac,ip,name, for example aa:bb:cc:dd:ee:ff,10.78.0.20,laptop. Then run sudo pf apply.
• In sudo pf tui, go to Home network → Devices. Press r on the row of the device. Type a name, then an address. To accept the next free address, press Enter.

Then set HOUSE_ADMIN_IP in house.env to the same address. Apply again.

You can also SSH from that device into the desk. To do this, put the same address in the segment file of the desk as SSH_FROM=10.78.0.20. Then apply (pi_setup.md, step 8). This opens SSH into the desk only. The desk gets no path back to the laptop or to other devices on the house network.

One SSID per VLAN¶

An access point can put each SSID on its own VLAN tag. If your access point can do this, the same cable can carry a second network next to the house network. An example is an IoT network on VLAN 30. That network is a plain segment (IF=eth1.30 next to HOUSE_IF=eth1, refer to pi_setup.md, step 8). It is not part of the house network.

The tags are only as strong as the access point. A device on any SSID can tag its traffic onto any network on that cable. Thus apply does these steps:

• It refuses SSH to the Pi or to the agent network from such a segment.
• It refuses the agent network on that cable.
• It shows a warning on each apply.

Use an access point or managed switch that maps each SSID to its own tag. It must not pass tagged frames from its clients.

Devices on such a network usually expect DHCP, as the house network gives them an address. To use DHCP, set DHCP=on in the segment file, with a DHCP_START and DHCP_END in the range of the segment. The Pi then gives addresses on that network too. The Pi is the router and the DNS for that network. The network gets no more trust than the house network.

If the access point has its own DHCP on that SSID, disable it. In AP mode, the access point has no DHCP.

A device that needs a fixed address gets a reservation in /etc/pi-fortress/dhcp.<name>.hosts. Use the same mac,ip,name lines as house.hosts. The address can be in the range or outside it. Apply writes these lines into the DHCP server of that network only. The TUI Devices page has no r for these devices. Thus edit the file and run sudo pf apply --local. The VLAN tutorial has the example.

Settings you can change¶

Change these settings in sudo pf tui, Home network → Settings. The settings are in four groups: Filtering, Apps & ports, DNS & VPN, and Network. The line below the list explains the selected setting.

• For an on/off setting, Enter changes the value.
• For HOUSE_EGRESS, Enter goes to the next value: strict, audit, then open.
• For all other settings, Enter asks for a value.

Each change saves immediately. The change takes effect at the next apply. To apply, press A. The Settings of the agent network are read-only: the agent network always blocks direct IP and plain HTTP.

Lists¶

Edit these lists in sudo pf tui, Home network → Filtering. Press a to add a line, d to delete a line, and A to apply. The last tab shows the block feeds for the home network. Press e to enable or disable a feed.

Check it works¶

Run these commands from a device on the house Wi-Fi, except where the table gives a different location.

Device settings that break it¶

Symptom: dig resolves names correctly, but a browser says that it cannot connect or "could not resolve".

After you change the settings of a device, forget the Wi-Fi network and join it again. Or flush the DNS cache of the device. The device then uses the Pi as its resolver again.

Remove the home network¶

Pi

sudo rm /etc/pi-fortress/house.env
sudo pf apply
sudo nmcli con delete house-net

The apply stops the house DNS and DHCP service. It also removes the house firewall rules. The last command removes the address of the Pi from the USB adapter. The agent network does not change.