Skip to content

RTFM · Networking

Business and local networks

A business deployment is a routed, segmented network with explicit trust boundaries, not simply a home router with more devices.

Saphira Linux dragon mascot

Draw the zones

Start with users, servers, management, guests, voice, storage, public edge, and VPN as separate zones where their trust differs. Give each VLAN or routed interface a documented IPv4 subnet and, where IPv6 is available, a separate /64. Route between zones at a firewall or Saphira gateway and write down the allowed directions.

Zones
Users      192.168.10.0/24  → web/API only
Servers    192.168.20.0/24  → internal services
Management 192.168.30.0/24  → SSH and administration
Guest      192.168.40.0/24  → Internet only
Public edge 192.168.50.0/24 → HAProxy and public hosts

Internal and external DNS

Public DNS should publish only names and addresses intended for the Internet. Internal DNS can resolve private names and service addresses for staff and systems. Split-horizon DNS is useful, but do not let an internal-only name become the only way a public service is found. Mail's public MX, A/AAAA, SPF, DKIM, DMARC, and PTR relationships still need to work from outside.

Separate management traffic from public service traffic even when both happen to run on Saphira. A VPN or management VLAN is safer than exposing SSH beside HTTPS.

OVS and virtual networks

Open vSwitch provides software bridges and ports. An internal port gives the host a Layer-3 address on a bridge; vnet or tap interfaces connect virtual machines. A bridge can be a switched segment, while Saphira routes between segments through gateway interfaces and nftables.

OVS inspection
sudo ovs-vsctl show
sudo ovs-vsctl list bridge
sudo ovs-vsctl list port
ip link
ip addr
ip route
ip -6 route

An illustrative topology may contain servernet0/servergw0, datanet0/datagw0, ns1network0/ns1gw0, internet0/igw0, and ns0net0/ns0gw0, with vnet interfaces attached to the appropriate bridges. The names are examples, not a promise of a prebuilt topology.

Saphira's support boundary

The current akadata-network configuration supports its documented interface types and OVS integration. It does not automatically create every possible OVS patch port, GRE, VXLAN, bond, or tunnel. Configure unsupported objects with their own deliberate tooling and document the dependency before making them part of a production route.