The Dreamwall appliance sits at 192.168.1.1 and handles:
- NAT for outbound internet access (selective)
- Port forwarding for external SSH access
- Inter-VLAN routing rules
| Service |
External Endpoint |
Internal Target |
| SSH to PVE1 |
108.31.169.90:2225 |
192.168.1.90:22 |
| SSH to PVE2 |
108.31.169.90:2226 |
192.168.1.9:22 |
- Subnet: 192.168.1.0/24
- Gateway: 192.168.1.1 (Dreamwall)
- Used by: PVE1, PVE2, AWX, Portal, Wiki.js, Guacamole, Proxy Gateway
- Subnet: 10.50.1.0/24
- Gateway: 10.50.1.1 (PVE1)
- Bridges: pod01net through pod20net
- Used by: DC01, DC02, student workstations (future)
- Subnet: 192.168.50.0/24
- VLAN ID: 50
- Host: PVE2
- Used by: CDW VMs (Guacamole, VPN, Kali, Scanner, Wazuh, Capture)
| IP |
Host |
Role |
| 192.168.1.1 |
Dreamwall |
Edge firewall / gateway |
| 192.168.1.9 |
PVE2 |
Secondary hypervisor |
| 192.168.1.42 |
crc-wiki-01 |
Wiki.js documentation |
| 192.168.1.51 |
crc-guac-gateway-01 |
Guacamole (student access) |
| 192.168.1.55 |
crc-proxy-gateway-01 |
Nginx reverse proxy |
| 192.168.1.61 |
crc-ai-ide-01 |
OpenHands + CyberLab Portal |
| 192.168.1.90 |
PVE1 |
Primary hypervisor |
| 192.168.1.103 |
crc-awx-k8s-01 |
AWX automation server |
| 192.168.1.169 |
crc-lms-001 |
Learning Management System |
| 192.168.1.227 |
crc-pbs-001 |
Proxmox Backup Server |
PVE1 acts as the router between the management LAN and the lab network:
vmbr0 interface: 192.168.1.90 (management)pod01net interface: 10.50.1.1 (lab gateway)- NAT/masquerade rules on PVE1 allow lab VMs to reach 10.50.x.x
- SSH (port 22) via port forwarding on Dreamwall
- WinRM (port 5985) on DC01 from PVE1 (internal only)
- HTTP/HTTPS for Wiki.js (port 80/443 on 192.168.1.42)
- AWX Web UI (port 30080 on 192.168.1.103, internal only)
- Guacamole (port 8080 on 192.168.1.51, proxied via crc-proxy-gateway-01)
- Password auth should be disabled on PVE1/PVE2 SSH (key-only)
- rpcbind should be disabled on PVE1 and PVE2
- Dreamwall firewall rules need periodic review/cleanup