Design a Secure Home Network from Scratch

Table of Contents

1. Project Overview
2. Learning Objectives
3. Prerequisites
4. Understanding Home Networks
5. Planning Your Network
6. Hardware Selection
7. IP Addressing Scheme
8. Network Topology Design
9. Security Implementation
10. WiFi Design & Optimization
11. Network Segmentation (VLANs)
12. Device Configuration
13. Testing & Verification
14. Documentation
15. Sample Home Network Design
16. Budget Planning

Project Overview

In this project, you will design a complete home network from scratch. You'll plan the topology, select appropriate hardware, design an IP addressing scheme, implement security measures, and create professional documentation. This project simulates a real-world scenario where you are asked to design a network for a family of 4-5 people with varying device needs.

Scenario

The Chen family lives in a 3-bedroom house (2,400 sq ft). They have:

• 2 parents working from home (need VPN access)
• 2 teenagers (online gaming, streaming)
• 1 grandparent (basic browsing, video calls)
• 25+ connected devices (smartphones, laptops, smart TV, gaming consoles, smart home devices)

Your task: Design a secure, reliable, and high-performance home network that meets their needs.

** Free Lab Setup**: This entire project can be completed for free using Cisco Packet Tracer (free registration required). No physical hardware needed! Use Packet Tracer's virtual router, switches, PCs, and access points to design and test your network. Diagrams can be created with draw.io (free). Budget section is for reference only if you ever build the real network.

** Your Step-by-Step Task:**

1. Read the scenario and understand the family's needs (below)
2. Gather requirements — list all devices, bandwidth needs, and coverage areas
3. Select hardware using the comparison table (or use Packet Tracer virtually)
4. Design IP addressing scheme — subnets, DHCP, reservations
5. Create a network topology diagram using draw.io (free)
6. Configure security — firewall rules, WiFi encryption, VLANs
7. Test your design — verify connectivity, coverage, and isolation
8. Build a budget (or skip this if using simulation)
9. Complete the deliverables checklist
10. Take the quick quiz

Learning Objectives

After completing this project, you will be able to:

• Design a network topology for a residential environment
• Select appropriate networking hardware
• Plan and implement IP addressing schemes
• Configure basic network security measures
• Design WiFi coverage for optimal performance
• Create professional network documentation
• Budget and justify hardware recommendations

Prerequisites

Before starting this project, you should understand:

• Basic networking concepts (IP addresses, subnet masks, default gateway, DNS)
• Difference between routers, switches, and access points
• Basic understanding of WiFi standards (802.11ac, 802.11ax)
• Familiarity with common network security terms

Understanding Home Networks

The Modern Home Network

A home network connects all digital devices within a household to each other and to the internet. Modern home networks have evolved from simple single-router setups to complex systems supporting various device types, security requirements, and performance needs.

Key Components

Typical Home Network Challenges

• Coverage dead zones — WiFi doesn't reach all rooms
• Bandwidth contention — Too many devices competing
• Security vulnerabilities — IoT devices, open ports
• Interference — Neighboring networks, cordless phones, microwaves
• Cable management — Messy wiring, improper termination

Planning Your Network

Step 1: Requirements Gathering

Start by documenting all requirements:

User Requirements Table:

Total Estimated Bandwidth Need: 160 Mbps (recommend ISP plan: 300+ Mbps)

Step 2: Site Survey

Map the house layout:

+--------------------------------------------------+
|  Master Bedroom        |  Teen Room 1            |
|  (Parent 1/2 office)   |  (Gaming PC, Console)   |
|                        |                         |
+------------------------+-------------------------+
|  Living Room            |  Teen Room 2           |
|  (Smart TV, Streaming)  |  (Laptop, Console)     |
+------------------------+-------------------------+
|  Kitchen                |  Grandparent Room      |
|  (Smart home hub)       |  (Tablet, Phone)       |
+------------------------+-------------------------+
|  Garage / Utility       |  Hallway               |
|  (Modem/Router here)    |  (Central location)    |
+------------------------+-------------------------+

Hardware Selection

Router Options — All Free Using Packet Tracer

🆓 For this project: Use a virtual router in Cisco Packet Tracer — 100% free, no hardware needed.

Access Point Placement Strategy

      [Modem]
         |
      [Router] --- [Switch (wired devices)]
      /     \
     /       \
[AP1 Living]  [AP2 Hallway]

WiFi Coverage Planning:

Hardware Used in This Project

All hardware can be simulated for free in Cisco Packet Tracer:

IP Addressing Scheme

Subnet Planning

DHCP Reservation Table

DNS Configuration

• Primary DNS: 1.1.1.1 (Cloudflare) — privacy-focused
• Secondary DNS: 8.8.8.8 (Google) — reliable backup
• Local DNS: Enable router's DNS proxy or use Pi-hole for ad-blocking

Network Topology Design

Logical Topology Diagram (Text Representation)

                     INTERNET
                         |
                     [ISP Modem]
                    192.168.100.1
                         |
                  [Router/Firewall]
                  192.168.1.1 (LAN)
                  192.168.2.1 (Guest)
                  192.168.3.1 (IoT)
                  192.168.100.254 (MGMT)
                         |
              +----------+----------+
              |                     |
        [Switch 8-port]        [PoE Switch]
        192.168.1.2            192.168.1.3
              |                     |
    +----+----+----+       +----+----+----+
    |         |            |              |
[Parent 1] [Gaming]   [AP Living]   [AP Hallway]
 Laptop     PC         192.168.1.4   192.168.1.5
 .1.50      .30

Physical Topology Considerations

1. Modem placement: Near ISP entry point (garage/utility room)
2. Router placement: Near modem, ventilated area
3. Switch placement: Near router, central wiring point
4. AP placement: Ceiling-mounted, central locations
5. Cable routing: Along baseboards, through walls (if possible), using CAT6 cabling

Security Implementation

Firewall Rules

Security Checklist

• Change default admin credentials on all devices
• Disable WPS (WiFi Protected Setup) — major security flaw
• Enable WPA3 encryption (fallback to WPA2 if needed)
• Disable remote administration from WAN
• Enable SPI firewall on router
• Enable automatic firmware updates
• Disable UPnP unless absolutely needed
• Set up guest network for visitors
• Implement IoT network isolation
• Enable logging and review periodically
• Disable SSID broadcast only for hidden devices (not primary SSID)
• MAC address filtering (optional, adds minor security)

VPN Configuration

For parents working from home:

VPN Setup Options:
1. Router-based VPN (OpenVPN/WireGuard) — All traffic routed through work
2. Split tunneling — Only work traffic through VPN
3. Client VPN on work laptop — Managed by employer

Recommended: Use router-based WireGuard VPN for performance

WiFi Design & Optimization

Channel Selection

2.4 GHz Band:

• Channels: 1, 6, 11 (only non-overlapping channels)
• Use a WiFi analyzer app to check which channels are least congested
• Best for: Range, wall penetration, IoT devices

5 GHz Band:

• Channels: 36-48 (low), 149-165 (high)
• More channels available, less interference
• Best for: Speed, streaming, gaming

6 GHz (WiFi 6E/7):

• Newest band, least interference
• Requires WiFi 6E/7 compatible devices

Optimization Settings

Band Steering

Enable band steering to encourage dual-band devices to connect to 5 GHz for better performance. 2.4 GHz remains available for older devices and longer range.

Network Segmentation (VLANs)

VLAN Design

Inter-VLAN Routing Rules

Main → Internet:          ALLOW
Main → IoT:               ALLOW (limited, management only)
Main → Guest:             BLOCK
IoT → Internet:           ALLOW (limited ports)
IoT → Main:               BLOCK
Guest → Internet:         ALLOW (web only)
Guest → Main/IoT:         BLOCK
Management → All:         ALLOW
All → Management:         BLOCK

Device Configuration

Router Configuration (Example: TP-Link ER605)

1. Connect to router via web interface (default: 192.168.0.1)
2. Set WAN interface to DHCP (gets IP from ISP modem)
3. Configure LAN interface:
   - IP: 192.168.1.1
   - Subnet: 255.255.255.0
   - DHCP Range: 192.168.1.100 - 192.168.1.200
4. Create VLANs 10, 20, 30, 99 with corresponding subnets
5. Set up firewall rules as per the table above
6. Configure DNS: Primary 1.1.1.1, Secondary 8.8.8.8
7. Enable DHCP reservations for fixed devices
8. Set up OpenVPN/WireGuard server for remote access
9. Enable system logging to a syslog server (optional)

Access Point Configuration (Example: TP-Link EAP610)

1. Adopt APs via controller software (OC200 or software controller)
2. Create SSIDs:
   - Home-Main (VLAN 10, WPA3)
   - Home-Guest (VLAN 20, WPA2, isolated)
   - Home-IoT (VLAN 30, WPA2-PSK)
3. Configure radio settings:
   - 2.4GHz: Channel 6, 20MHz width, Medium power
   - 5GHz: Channel 36/149, 80MHz width, High power
4. Enable band steering
5. Set minimum RSSI for better roaming (-70 dBm)
6. Enable PMF (Protected Management Frames)
7. Schedule auto-reboot weekly (Monday 4 AM)

Testing & Verification

Pre-Deployment Testing

• Verify all equipment powers on and functions
• Test Ethernet cables with a cable tester
• Verify internet connectivity from modem directly

Deployment Testing

• Connectivity test: Ping gateway (192.168.1.1) from all wired ports
• DHCP test: Verify devices receive correct IP addresses
• WiFi coverage test: Walk through house measuring signal strength
• Speed test: Run speed tests from multiple locations
• Roaming test: Video call while walking between AP coverage areas
• VLAN isolation test: Verify IoT devices cannot reach main LAN
• Guest network test: Verify guests cannot access internal resources
• VPN test: Connect remotely and access internal resources
• DNS test: Verify DNS resolution works correctly

WiFi Coverage Mapping

Create a heat map using tools like:

• WiFiMan (mobile app)
• NetSpot (PC/Mac)
• Ekahau HeatMapper (free)

Record signal strength at key points:

Documentation

Network Documentation Template

NETWORK NAME: Chen Residence Network
DATE: [Current Date]
VERSION: 1.0

=== NETWORK OVERVIEW ===
ISP: [ISP Name]
Plan: 300 Mbps Download / 20 Mbps Upload
Public IP: [Dynamic / Static X.X.X.X]

=== HARDWARE INVENTORY ===
1. Modem: ARRIS SB8200 (Firmware: vX.X)
2. Router: TP-Link ER605 (Firmware: vX.X)
3. Switch: TP-Link TL-SG108 (Unmanaged)
4. AP1: TP-Link EAP610 (Living Room, Ceiling)
5. AP2: TP-Link EAP610 (Hallway, Ceiling)

=== IP SCHEME ===
VLAN 10 Main: 192.168.1.0/24 (Gateway: .1)
VLAN 20 Guest: 192.168.2.0/24 (Gateway: .1)
VLAN 30 IoT: 192.168.3.0/24 (Gateway: .1)
VLAN 99 Mgmt: 192.168.100.0/24

=== DHCP SCOPE ===
Range: 192.168.1.100-200 (Main)
Exclusions: 192.168.1.1-99 (Reservations)

=== WIFI SSIDS ===
Home-Main: WPA3, VLAN 10
Home-Guest: WPA2, VLAN 20, Guest isolation
Home-IoT: WPA2, VLAN 30

=== ADMIN CREDENTIALS ===
[Store securely in password manager]
Router Admin: [Username] / [Password]
AP Controller: [Username] / [Password]

Network Diagram

Create a professional network diagram using:

• draw.io (free, web-based)
• draw.io (free, web-based)
• LucidChart (free tier available)
• diagrams.net (open source)

Sample Home Network Design

Complete Design Summary

Bandwidth Allocation

Internet (500 Mbps)
    |
    v
Router (QoS enabled)
    |
    +-- Work Devices: 60% priority (300 Mbps)
    +-- Gaming/Streaming: 30% (150 Mbps)
    +-- IoT/Guest: 10% (50 Mbps)

Budget Planning

🆓 This project is FREE! All work can be done in Cisco Packet Tracer at no cost. No hardware purchase needed.

Sample Budget (Real-World Reference — Skip for Students)

If you were to build this network for real, a rough estimate would be $0 using Packet Tracer for practice. Only spend money if you're actually deploying a physical network.

Deliverables Checklist

Before marking this project complete, ensure you have:

• Requirements document — User needs, device count, bandwidth estimation
• Floor plan — House layout with AP placement marked
• Network topology diagram — Both logical and physical views
• IP addressing scheme — Subnet plan, DHCP scopes, reservations
• Hardware list — Bill of materials with models and prices
• Security configuration — Firewall rules, WiFi settings, VPN setup
• Device configuration guide — Step-by-step setup for each device
• Testing results — Speed tests, coverage map, connectivity verification
• User guide — Simple instructions for family members
• Maintenance plan — Firmware updates, backup configs, password rotation