# Homelab Zero-Leak Wi-Fi to Ethernet Gateway ## ThinkPad T490 & ThinkStation (Proxmox VE 8.x) Architecture This project provides a comprehensive, production-grade blueprint for converting a **ThinkPad T490** laptop into an air-tight, zero-leak edge gateway. The laptop associates with an upstream Wi-Fi network (`10.0.0.0/24`) and routes gigabit internet access over a direct Cat6 Ethernet patch cable to a **ThinkStation running Proxmox VE 8.x** (`192.168.45.0/24`), while keeping internal hypervisor workloads **100% invisible** to the upstream LAN. --- ## 1. Architectural Problem Statement & Physical Constraints ### Why Layer 2 Bridging Fails Over Wi-Fi (802.11 3-Address Frame Format) When bridging an Ethernet interface (`eth0`) to a Wi-Fi client interface (`wlan0`), standard Linux software bridging (`brctl` / `ip link add vmbr0 type bridge`) fails due to the IEEE 802.11 MAC frame format: 1. **3-Address Frame Limitation**: In standard Wi-Fi Client Station (STA) mode, frames contain only three MAC addresses: - **Address 1**: Receiver Address (AP BSSID) - **Address 2**: Transmitter Address (Authenticated STA MAC — the T490 Wi-Fi card) - **Address 3**: Destination or Source Address 2. **Access Point MAC Enforcement**: Standard Wi-Fi Access Points drop any frame whose transmitter MAC (`Address 2`) does not match the single authenticated MAC associated during 802.11 association/4-way handshake. If VMs or the Proxmox host transmit packets using their own virtual MACs across a bridged `wlan0`, the AP silently discards them or disassociates the client. 3. **Inviability of Layer 2 Workarounds**: - *WDS / 4-Address Mode*: Requires AP-side configuration and vendor-specific protocol support, which is not possible on a friend's router. - *Proxy ARP (`parprouted`)*: Fragile, breaks DHCP lease distribution, drops IPv6 neighbor discovery, and leaks host state. 4. **The Robust Solution**: **Pure Layer 3 Routing with Egress Source NAT (MASQUERADE)** on the ThinkPad T490. --- ## 2. 3-Tier Network Architecture ``` ==================================================================================================== FRIEND'S WI-FI LAN (WAN) Subnet: 10.0.0.0/24 Wi-Fi Gateway: 10.0.0.1 ==================================================================================================== ▲ │ 802.11ac/ax Wi-Fi Association │ DHCP Client IP: 10.0.0.X / MAC: T490-WLAN-MAC ▼ ┌──────────────────────────────────────────────────────────────────────────────────────────────────┐ │ THINKPAD T490 (EDGE GATEWAY) │ │ OS: Ubuntu Server 24.04 LTS │ │ │ │ [wlan0] 10.0.0.X/24 (DHCP) │ │ │ │ │ ├───► [nftables Engine]: │ │ │ • Single Outbound SNAT / MASQUERADE on wlan0 │ │ │ • Ingress Flowtable Fastpath Hardware/Software Offloading │ │ │ • TCP MSS Clamping to PMTU (1460 bytes / 1240 for WireGuard) │ │ │ • ZERO-LEAK Filter: DROP UDP 5353 (mDNS), 5355 (LLMNR), 137/138 (NetBIOS), │ │ │ DROP UDP 1900 (SSDP), DROP 224.0.0.0/4 (Multicast), │ │ │ DROP 255.255.255.255 (Broadcast), DROP ICMP Redirects │ │ │ │ │ ├───► [Kernel L3 Routing]: net.ipv4.ip_forward = 1 │ │ │ • Static Route: 192.168.45.0/24 via 172.16.100.2 dev eth0 │ │ │ │ │ [eth0] 172.16.100.1/24 (Static, Gigabit enp0s31f6) │ │ │ • dnsmasq strictly bound to eth0 (DHCP + DNS for 172.16.100.0/24 only) │ │ │ │ │ [Tailscale OOB Node]: tag:gateway (Out-of-Band Bastion, SSH, Wake-on-LAN target) │ └───────────────────────────────────────────────┬──────────────────────────────────────────────────┘ │ │ Direct 1Gbps Cat6 Ethernet Patch Cable (Auto-MDIX) │ Transit Point-to-Point Subnet: 172.16.100.0/24 ▼ ┌──────────────────────────────────────────────────────────────────────────────────────────────────┐ │ THINKSTATION (PROXMOX VE 8.x HYPERVISOR) │ │ │ │ [eno1] Physical Gigabit Ethernet Interface │ │ │ │ │ [vmbr0] 172.16.100.2/24 (Uplink Bridge) │ │ • Default Gateway: 172.16.100.1 │ │ • DNS Nameservers: 1.1.1.1, 9.9.9.9 │ │ • Proxmox Host Management IP / Web GUI (https://172.16.100.2:8006) │ │ │ │ [Kernel L3 Router]: net.ipv4.ip_forward = 1 (Zero-NAT Pure Forwarding) │ │ │ │ [vmbr1] 192.168.45.1/24 (Internal Isolated Workload Bridge, bridge-ports none) │ │ │ • Acts as Default Gateway (192.168.45.1) for all Guest VMs & LXC Containers │ │ │ │ │ ├───► [VM 101]: IP 192.168.45.101/24 ──► GW 192.168.45.1 ──► DNS 1.1.1.1 │ │ ├───► [VM 102]: IP 192.168.45.102/24 ──► GW 192.168.45.1 ──► DNS 1.1.1.1 │ │ ├───► [LXC 150]: IP 192.168.45.150/24 ──► GW 192.168.45.1 ──► DNS 1.1.1.1 │ │ └───► [VM 200]: IP 192.168.45.200/24 ──► GW 192.168.45.1 ──► DNS 1.1.1.1 │ │ │ │ [Tailscale Subnet Router]: tag:homelab-core │ │ • Advertises Route: 192.168.45.0/24 │ │ • Remote access directly to all VMs and Proxmox Web GUI from any Tailnet client │ └──────────────────────────────────────────────────────────────────────────────────────────────────┘ ``` ### Subnet Allocation & Boundary Table | Network Segment | Subnet CIDR | T490 Interface / Role | Proxmox Node / Role | Security & Isolation Boundary | | :--- | :--- | :--- | :--- | :--- | | **Tier 1: Upstream WAN** | `10.0.0.0/24` | `wlan0`: DHCP Client (`10.0.0.X`) | *Invisible* | Upstream Wi-Fi router (`10.0.0.1`). Only T490's single MAC/IP is visible. | | **Tier 2: Transit Link** | `172.16.100.0/24` | `enp0s31f6`: `172.16.100.1/24` | `vmbr0`: `172.16.100.2/24` | Dedicated point-to-point Cat6 cable. No VM broadcasts traverse this link. | | **Tier 3: Workloads** | `192.168.45.0/24` | Static Route via `172.16.100.2` | `vmbr1`: `192.168.45.1/24` | Isolated software bridge. VM IP `.X` matches VM ID (e.g. VM 101 -> `192.168.45.101`). | | **Overlay Mesh** | `100.64.0.0/10` | `tag:gateway` (OOB Bastion) | `tag:homelab-core` (Subnet Router) | End-to-end WireGuard tunnel. Access Proxmox GUI & VMs remotely from anywhere. | --- ## 3. Operating System Recommendation Matrix | Feature / Requirement | Linux (Ubuntu Server 24.04 LTS / Debian 12) | Windows 11 Pro with Hyper-V / WinNAT | Engineering Verdict | | :--- | :--- | :--- | :--- | | **Deterministic Routing** | **Native Netfilter**: Full kernel flowtable offloading, stateful conntrack, and surgical MASQUERADE. | **Fragile WinNAT**: Rigid ICS forces `192.168.137.1`; WinNAT lacks granular route metrics. | **Linux is superior** | | **Zero-Leakage Assurance** | **100% Deterministic**: Kernel-level drop rules for mDNS (`5353`), LLMNR (`5355`), NetBIOS (`137-139`), SSDP (`1900`), and all multicast. | **High Risk**: Emits LLMNR, SSDP, and WSD discovery packets across all adapters by default. | **Linux is mandatory** | | **Subnet Flexibility** | **Arbitrary CIDRs**: Clean separation of transit (`172.16.100.0/24`) and VM subnet (`192.168.45.0/24`). | **Severely Constrained**: ICS forces `192.168.137.0/24`; lacks built-in DNS forwarder. | **Linux is superior** | | **Headless Operation** | **Native**: Sub-300MB RAM idle, lightweight SSH, reliable headless boot without GPU stalls. | **Poor**: GUI background load, display driver stalls on headless boot. | **Linux is superior** | | **Lid & Power Lifecycle** | **Deterministic**: `systemd-logind` ignores lid switch; sleep targets masked completely. | **Unreliable**: Modern Standby (S0ix) frequently overrides policies and sleeps NICs. | **Linux is mandatory** | | **Battery Longevity** | **Kernel Hardware Thresholds**: `tlp` enforces 75–80% charge threshold to eliminate battery swelling. | **Vendor App Dependent**: Requires Lenovo Vantage background service. | **Linux is superior** | --- ## 4. Repository Structure & Navigation This guide is modularized into detailed, step-by-step documentation and ready-to-use configuration files: - [`thinkpad-t490-gateway-setup.md`](./thinkpad-t490-gateway-setup.md): Complete setup guide for the ThinkPad T490 under Ubuntu Server 24.04 LTS (Netplan, sysctl, nftables, dnsmasq, TLP, logind, Wi-Fi watchdog). - [`thinkstation-proxmox-setup.md`](./thinkstation-proxmox-setup.md): Complete setup guide for Proxmox VE 8.x (`/etc/network/interfaces`, kernel routing, Tailscale subnet router, and VM cloud-init automation script). - [`windows-11-fallback-guide.md`](./windows-11-fallback-guide.md): Fallback guide if you prefer to retain Windows 11 on the T490 (Hyper-V switch, WinNAT, discovery suppression, powercfg). - [`verification-and-troubleshooting.md`](./verification-and-troubleshooting.md): 6-part `tcpdump` zero-leak verification battery, connectivity validation, and troubleshooting runbook. - [`configs/`](./configs/): Ready-to-copy configuration files: - [`configs/nftables.conf`](./configs/nftables.conf) - [`configs/99-homelab-gateway-hardening.conf`](./configs/99-homelab-gateway-hardening.conf) - [`configs/homelab-transit.conf`](./configs/homelab-transit.conf) - [`configs/interfaces`](./configs/interfaces) - [`scripts/`](./scripts/): Operational scripts: - [`scripts/wifi-watchdog.sh`](./scripts/wifi-watchdog.sh): Rate-limited Wi-Fi health watchdog. - [`scripts/create-homelab-vm.sh`](./scripts/create-homelab-vm.sh): Automated Proxmox VM provisioning script matching ID to IP octet.