Homelab Zero-Leak Gateway — Mission Control & Interactive Wizard

Active agy Agent Roster

5 / 5 Targets Complete

UI & Layout Agent DONE

Responsive stepper & dark-mode dashboard

Visual Topology Agent DONE

3-tier interactive SVG topology engine

Template Engine Agent DONE

Reactive SSID & Subnet string interpolation

Scripting & Exporter Agent DONE

Turnkey USB scripts & JSZip payload compiler

QA & Zero-Leak Auditor VERIFIED

6-part tcpdump leak test runner validation

Live Parameter Customizer

Edit any field to immediately update every configuration snippet and export script below.

Friend Wi-Fi SSID

Friend Wi-Fi Password

T490 Wi-Fi NIC

T490 Ethernet

Proxmox NIC

Transit Subnet

T490 Transit IP

Proxmox Uplink IP

Proxmox VM Subnet (vmbr1)

Live 3-Tier Layer 3 Routing Topology

Hover over nodes to inspect

Step 1 of 5

Physical Cat6 Cabling & ThinkPad BIOS Optimization

Connect the ThinkPad T490 Ethernet port directly to the ThinkStation Ethernet port using a standard patch cable (Auto-MDIX negotiates automatically).

BIOS Power Settings (Press F1 on boot)

Sleep State: Linux (Legacy S3)
Power on with AC: Enabled
Wake on LAN: Enabled on AC

Anti-Leak Security Settings

Intel AMT Control: Disabled
UEFI IPv4 Stack: Disabled
Prevents firmware-level Wi-Fi discovery

ThinkPad T490 Edge Gateway Automated Setup

Configure Netplan, sysctl kernel hardening, nftables NAT, isolated dnsmasq, TLP battery thresholds (75-80%), and lid-closed server mode.

Run Automated 1-Shot Installer on T490:

sudo bash setup-t490-gateway.sh

Generated `/etc/netplan/01-homelab-gateway.yaml`:

ThinkStation Proxmox VE Dual-Bridge Configuration

Configure `vmbr0` (transit uplink) and `vmbr1` (internal isolated switch) with kernel packet forwarding.

Run Automated Installer on Proxmox Host:

sudo bash setup-proxmox.sh

Generated `/etc/network/interfaces`:

Coordinated Dual-Node Tailscale Mesh Setup

Deploy Tailscale on both nodes: T490 as an Out-of-Band Bastion, and Proxmox as a Workload Subnet Router.

1. ThinkPad T490 (Bastion)

sudo tailscale up --ssh --advertise-tags=tag:gateway --accept-routes=false

Allows direct SSH access to T490 even if Proxmox is powered off.

2. Proxmox (Subnet Router)

sudo tailscale up --advertise-routes=192.168.45.0/24 --advertise-tags=tag:homelab-core --ssh

Advertises all 192.168.45.X workloads to your remote Tailnet.

Zero-Leak Verification Test Battery

Execute the 6-part packet capture test suite on the T490 to empirically prove zero broadcast/multicast leakage.

Run Automated 6-Test Verification Suite on T490:

sudo bash verify-zero-leak.sh

1. Rogue DHCP

0 offers on wlan0

2. Un-NATed IPs

0 internal IPs on WAN

3. mDNS / SSDP

0 discovery broadcasts

4. Proxy ARP

0 spoofed ARP replies

5. ICMP Redirects

0 Type-5 ICMP packets

6. Lateral Isolation

Friend LAN blocked