The SSID is i3detroit, with no encryption. There is also an SSID of i3detroit-wpa with encryption; the passphrase is on posters with QR codes scattered about the space.

There is also a i3detroit-iot SSID for IoT devices; ask Amelia Meyer for connection details if you need to get a device on this. It restricts internet and routing access for network security purposes.

Internally, we are using the 10.13.0.0/16 supernet. It should sidestep most VPN overlap problems, should we establish any connections to other locations. At present, we are using three subnets of this:

Purpose	Subnet	Netmask	Gateway/DNS	DNS Search Domain	VLAN ID
Management	10.13.42.0/22	255.255.255.0	10.13.42.1	net.i3.lc	1 (default, if untagged)
General Use	10.13.0.0/22	255.255.252.0	10.13.0.1	i3.lc	2 (default, practically)
Internet of Things	10.13.107.0/24	255.255.255.0	10.13.107.1	iot.i3.lc	107
Cameras	10.13.201.0/24	255.255.255.0	10.13.201.1	cameras.i3.lc	201

This subnet is for networking devices only, like access points and switches. See A-Side Network Switches and B-Side Network Switch.

This subnet is default for most new wired and wireless clients. The DHCP range handed out by the firewall is 10.13.0.100-10.13.3.254, DHCP reservations are available if needed.

This subnet is for IoT devices and is the default for connections on the IoT SSID. External connections are limited to a very small whitelist of domains and inter-VLAN devices.

This subnet is for security cameras only, and is routed only for camera tagged switch ports and the NVR server. Similarly to the IoT VLAN, it routing rules make it isolated from general access.

We have split horizon DNS using the search domains listed in the previous table. You should access i3 services by simply typing in their hostname (e.g. device.i3.lc) instead of their IP, which is subject to change. This will only work if your device is configured to use the gateway as the DNS server, and you of course won't be able to resolve anything if you're offsite.

Because we own these domains and are just not using public DNS, we are still able to issue certs for them and have an acmeproxy instance running to do exactly this.