Hey everyone!

I've been playing with IT for a long time, can't ever say I'm a professional of any sort but I do find myself enthusiastic about it. I started long ago with a cheap Google Search Appliance (Poweredge 2950) under my couch and just kept acquiring parts since then and eventually stuck it all into a rack.

XCP-NG has been a part of that journey for a long time and currently trying to practice diagram creation. I figured I'd started with a full summary reference diagram and break it down from there, but let me know how it looks! Either my diagram or the architecture itself!

This diagram includes 6 sections broken down into:

Home Logical Topology
Home Physical Topology (simple)
Colo (Virginia)
Hardware setup template
Home network equipment summary
Networking and VLANs

The diagrams cover my home architecture, and my off-site locations in a colo connected via S2S VPN.

Appreciate it everyone!

Appreciate the assistance on it all. This is only a homelab turned private cloud setup, but XCP-NG has been a pleasure to work with, thanks for all you and the team do!

So I'm not 100% but I've resolved the symptom.

I have 3 VLANS involved

DATA - Endpoints
PRIV - Reverse proxy manager exists here
MGMT - Where XOA exists.

Myself and users access XOA via the reverse proxy, which access the webserver in the MGMT vlan.

My hosts had their primary management access on the DATA vlan, a holdover setup from prior, and a secondary management access on the MGMT VLAN and a third for data migrations.

XOA was connected to the MGMT IPs of each host.

Watching packet capture I see packets moving from the originating endpoint in DATA, to the reverse proxy, from it to the XOA backend server. Then suddenly I see XOA in the MGMT VLAN try to access the hosts directly in the DATA VLAN which was blocked.

Problem is, it seemed to send packets meant to originate from the MGMT-VLAN as sourced from the DATA-VLAN.

The resolution was I just removed the secondary management IP and switched the primary management of each host to the MGMT-VLAN alongside XOA.

They're happier now at least.