Auditing the Hotel Network and Designing a Three-Site Link

I worked mostly from 00:12 to 05:49, with short bursts at 06:00, 08:15, 09:30 and 18:54.

Two new engagements

Straight after the house job I started two pieces of work. One is a desk audit and redesign of the hotel network. The other is a link between three sites, one of which is the hotel. Both are desk work for now. Apart from reading one router's config, I haven't touched a device.

A desk audit of the hotel network

I wrote up what I know, then went over every switch, the controller and the firewall configs I captured on the 2nd, criticising everything. The count came to 128 findings: 4 critical, 34 high, 62 medium and 28 low. I'm not going to list them here. Some of the worst I saw on site, and I'm labelling those as observed, since the redacted configs can't prove them.

I also looked at the extra servers. One unlabelled 1U server is powered on and sends a steady one-way stream on the TV VLAN, and a 2U box is on but nearly silent. I won't touch either until the IPTV cutover and a soak period, and I'd rather not build anything permanent on them. Two Windows hosts seem to be doing very little, but my evidence is one five-minute average. The proper check on the 16th is lifetime byte counters and a 24 hour repeat, and I won't clear the statistics.

Along the way I checked what the hotel's existing kit can already do. Client isolation, per-guest logins and rate limiting are all possible. Tying logins to the property system needs a third-party portal or a custom service. My first idea, a FreeRADIUS connector, turned out not to exist.

I turned the findings into a plain-language pack for the owners, written in the first person with no jargon. Each area says what they have, what it allows today, what it should be and why. Free self-hosted options come first, and paid ones come with prices where that's simple. I pushed back on the draft where it was wrong. Hyper-V is free. The cost is Windows Server per physical core whichever hypervisor runs on it. Proxmox support has a production tier at about 370 euros per socket per year, not the cheaper non-production one. I'm reading the pack slowly and will have more questions. I also wrote a 290-line read-only checklist for the visit on the 16th.

Linking three sites

The second engagement started with a simpler question: how can I see a house network remotely? It has a three-node mesh router behind carrier-grade NAT, so the router's own VPN server and web access can't work. Then the scope grew to a warehouse on another site and the hotel, with this access policy: the house sees the warehouse and the hotel, the warehouse sees the hotel and the house, and the hotel sees neither.

Several options didn't work. The mesh vendor's site manager needs the same brand at every site, the warehouse router has no VPN features at all, and someone else manages the hotel's firewall. Router-to-router tunnels would have put every home device on the business LAN. I settled on a Tailscale network owned by the business instead of my personal one, with deny-by-default ACLs and one small subnet-router box per site. The ACLs enforce the direction. Before anything gets set up I want the owner's written okay, then a heads-up to the hotel's IT provider.

To design it I needed the warehouse router's config, and the mobile app can't export it. I cloned an unofficial cloud API client and ran a read-only dump with a verification code. My first attempt failed with a login error I can't explain. The second worked and 27 of 30 calls succeeded. It's a single router, not behind carrier-grade NAT, with a public IPv4 address and about 572 Mbps down and 209 up. Its subnets don't clash with the house or the hotel ranges I know about. UPnP is on, with no port forwards. I wrote the engagement folder and deleted the raw dump.

Small things

At 08:15 I asked whether a new NBN plan's "twin paths" claim applies to my address. It only covers the provider's own core, not the last mile from my home to the exchange, which is a single path whoever I pick.

At 18:54 I ran a read-only check of the nodes to see whether powertop would help. It isn't installed anywhere, and all four use the performance governor. The first three reach C10 but pve04 only reaches C3, and PCIe ASPM is off on every link of pve01 and pve03. Three nodes use USB network adapters, including pve02's only uplink. I'd use powertop only to measure and skip its auto-tune, because USB autosuspend could drop corosync links and trigger fencing. The best gain is probably the Dell BIOS ASPM setting, but a BIOS write once reset pve02 instantly, so I'd evacuate each node first. Nothing changed.

I also fixed a date. The Talos shutdown and the desk power tests were on the 10th, not the 11th, so I corrected the project row, the pve04 runsheet and my notes.

Still open