Office Infrastructure Buildout — Dual-WAN Redundancy and Network Segmentation

Greenfield on-prem network designed and built for an office relocation. A MikroTik RB5009 edge router runs dual WAN (PCC + failover) across two ISPs, three VLANs separate office, server, and management traffic, and two WireGuard instances split employee access from external-partner access. Diagnosed and fixed the session drops and the missing firewall condition that surfaced once a second uplink was live.

Architecture

InfoGrab DevOps / On-prem Infrastructure

2026.02 - Present

Tech Stack

MikroTik Dual WAN VLAN WireGuard Firewall GitLab CI On-prem Network Greenfield

Highlights

Dual WAN across two ISPs — a per-connection classifier distributes new connections over both uplinks, traffic recovers over the remaining path on failure, and the VPN endpoint is pinned via dynamic DNS
Three greenfield VLANs (Office / Server / Mgmt) — static-only addressing on the server VLAN, management VLAN reserved for network gear
Two separate WireGuard instances — employee and external-partner access isolated by port, subnet, and reachable VLANs (partners cannot reach the management VLAN or router services)
Diagnosed session drops after the second uplink went live — the load-balancing hash included ports, so requests to one site exited alternating uplinks; removed ports from the hash input
Full router configuration audit — found the DNS proxy exposed externally because a rule's comment and its actual condition disagreed; added the missing condition plus a default-drop rule with logging

Key Tasks

Dual-WAN and routing buildout

Both ISPs (KT + LG U+) running active with PCC + failover
A per-connection classifier distributes new connections across both uplinks
Two default routes (WAN1 / WAN2) running concurrently with distance policy in the main table
VPN endpoint published over dynamic DNS so uplink address changes need no client redistribution
Bridge trunk configuration — active uplink to the PoE switch plus reserved management and backup ports

Greenfield VLAN design and firewall

Three new VLANs — Office (10), Server (20), Mgmt (100)
Per-VLAN address plan, DHCP servers on Office and Mgmt, static allocation on Server
Inter-VLAN isolation and external exposure paths fixed in firewall rules
Rule conditions standardized on aggregate-internal and BOGON address lists

Two WireGuard instances, isolated

Employee instance (wg-vpn) — routes to office, server, and management networks, with split-tunnel and full-tunnel guides
External-partner instance (wg-ext) — per-peer fixed IPs, no access to the management VLAN or router services
Documented procedure for whitelisting both public IPs at partner sites under dual WAN

Diagnosis after the second uplink

Session-drop report → confirmed the PCC hash included ports, so one destination exited alternating uplinks per request
Changed the classifier from both-addresses-and-ports to both-addresses; verified uplink stickiness and unchanged distribution
Diagnosed router-originated traffic bypassing connection marks and exiting the wrong uplink (output-chain fix drafted)
Full router configuration audit — interfaces, addressing, routing, firewall, services, DHCP, DNS, VPN
Compared design documents against on-site measurement and ranked the gaps by risk

Operations

Closed the externally exposed DNS proxy caused by a missing INPUT-chain condition, added a default-drop rule with logging, and verified the block from outside
Firewall changes follow config backup → safe-mode → rule-order verification → prepared rollback command
GitLab CI announces IaC changes to the internal channel
Changes reported separately in a form office users can read

삶을 기록하는 두 축

Architecture