I've got some updates on the old diagram, and two new ones to add in!

I've migrated over to XCP 8.3 LTS since it's released! Alongside that I've installed a few applications, condensed some others into group names in the chart, and migrated the ZFS pools for OS storage to better NVME hardware, also added L2ARC in front of the HDD storage.

Since MxGPU is no longer supported in the way that it was, I instead had to change the number of VDI max from 4 to 2. Instead of MxGPU, each GPU is PCI-passthru directly to the VMs instead.

I've also expanded upon how the Dev section is setup, as it has it's own write-up

This environment is composed of three core network zones, designed to mimic a typical hybrid enterprise setup:

Development VLAN
Functions as a proxy-to-internet zone used to hijack or intercept DNS and service calls as needed. It enables testing of redirect logic, hostname spoofing, or simulating cloud resources and CDN endpoints.

Internal Host Transit Network
A dedicated transit layer that links all Opnsense VMs with static routing only, simulating WAN connectivity across isolated customer domains while allowing controlled traffic flows between them.

Domain Networks (White, Gray, Black)
Each domain resides in its own internal network segment with no direct internet access. These simulate fully isolated customer environments. All connectivity is routed through the Opnsense perimeter via the transit network.

Domain, OS Generation, Windows Stack, Linux Stack
White, Modern, Server 2022/Windows 11, RHEL 9, Ubuntu 24
Gray, Prior Gen, Server 2019/Windows 10, RHEL 8, Ubuntu 22
Black, Legacy, Server 2012 R2/Windows 7, RHEL 6, Ubuntu 16

And then I've also setup my old classroom, this was as simpler design used when I taught A+ and Net+ certifications.

The first years focused on A+ and we had hardware examples, as well as I created VMs that were broken/infected/improperly configured and general virtualization for anything else. We avoided using the actual workstations in examples lol.

Second years had their own server rack with it's own network gear and server for use, they primarily focused on Net+

Been fun all the way and XCP-NG has made a lot of it possible. Thanks for all ya do!

Hey everyone!

I've been playing with IT for a long time, can't ever say I'm a professional of any sort but I do find myself enthusiastic about it. I started long ago with a cheap Google Search Appliance (Poweredge 2950) under my couch and just kept acquiring parts since then and eventually stuck it all into a rack.

XCP-NG has been a part of that journey for a long time and currently trying to practice diagram creation. I figured I'd started with a full summary reference diagram and break it down from there, but let me know how it looks! Either my diagram or the architecture itself!

This diagram includes 6 sections broken down into:

Home Logical Topology
Home Physical Topology (simple)
Colo (Virginia)
Hardware setup template
Home network equipment summary
Networking and VLANs

The diagrams cover my home architecture, and my off-site locations in a colo connected via S2S VPN.

Appreciate it everyone!

Appreciate the assistance on it all. This is only a homelab turned private cloud setup, but XCP-NG has been a pleasure to work with, thanks for all you and the team do!

So I'm not 100% but I've resolved the symptom.

I have 3 VLANS involved

DATA - Endpoints
PRIV - Reverse proxy manager exists here
MGMT - Where XOA exists.

Myself and users access XOA via the reverse proxy, which access the webserver in the MGMT vlan.

My hosts had their primary management access on the DATA vlan, a holdover setup from prior, and a secondary management access on the MGMT VLAN and a third for data migrations.

XOA was connected to the MGMT IPs of each host.

Watching packet capture I see packets moving from the originating endpoint in DATA, to the reverse proxy, from it to the XOA backend server. Then suddenly I see XOA in the MGMT VLAN try to access the hosts directly in the DATA VLAN which was blocked.

Problem is, it seemed to send packets meant to originate from the MGMT-VLAN as sourced from the DATA-VLAN.

The resolution was I just removed the secondary management IP and switched the primary management of each host to the MGMT-VLAN alongside XOA.

They're happier now at least.