RTFM · Networking

Deployment models

Home, business, remote, and multi-site networks all work with Saphira, but they solve different problems.

Home

An ISP router normally owns the public IPv4 address and gives private addresses such as 192.168.1.0/24 to the house. You may use explicit port forwarding, a DMZ Host/Exposed Host setting for a dedicated edge machine, or native IPv6 with firewall rules. CGNAT may prevent inbound IPv4 entirely.

Home

Internet → ISP router → 192.168.1.50 Saphira edge → nftables → MailDragon/webDragon

Business or local network

A business network should be described as routed zones, not as a giant home LAN. Users, servers, guests, management, voice, and infrastructure may have separate VLANs and subnets. A firewall routes between them according to policy. Public services belong on a controlled edge or server network; internal DNS can provide private answers while public DNS provides public answers.

Business

VLAN 10 users       192.168.10.0/24   2001:db8:10::/64
VLAN 20 servers     192.168.20.0/24   2001:db8:20::/64
VLAN 30 management  192.168.30.0/24   2001:db8:30::/64
VLAN 40 guest        192.168.40.0/24   2001:db8:40::/64
                         │
                    Saphira firewall

Remote server

A VPS, datacentre server, hosted rack, or remote physical host may have a public address directly on its interface. There may be no home-router NAT, but provider firewalls and the host firewall still matter. Reverse DNS is normally controlled by the provider, and an outbound mail IP must have a usable PTR and matching forward record.

Multi-site

Home, office, branch, and datacentre networks can remain separate while a VPN routes selected prefixes between them. Keep management private, keep public MailDragon/webDragon listeners on the intended edge, and avoid silently joining every broadcast domain.

Multi-site

Branch: 192.168.20.0/24 / 2001:db8:20::/64
                 │ encrypted routed VPN
Head office: 192.168.10.0/24 / 2001:db8:10::/64

Pick a model by the boundaries you control

Deployment choice before configuration
Environment	First boundary to inspect	Common mistake	Natural next page
Home	ISP router WAN address, NAT/CGNAT, IPv6 firewall	Forwarding a port before the server has a fixed LAN address and host firewall.	Home router
Business/local	VLAN/subnet map, routing firewall, internal DNS	Putting users, database, management, and public services in one trusted LAN.	Business network
Remote server	Provider address assignment/firewall and host policy	Assuming a public address means a service is safely configured.	Remote server
Multi-site	Unique prefixes, routes in both directions, VPN interface policy	Joining overlapping 192.168.1.0/24 networks and hoping the tunnel chooses correctly.	Multi-site

The reusable questions are consistent: which address receives traffic, which route carries it, which firewall permits it, which name identifies it, and how does the return traffic get back? The answer may be an ISP router at home, a dedicated Saphira edge at work, a provider virtual network, or a WireGuard gateway between sites.