🏗 Network Architecture — PentAGI Stack

Complete Network Design · VLAN Layout · WireGuard Tunnels · Deployment

1. Overview & Subnet Design

IP Allocation

2. Home Network (Protectli + TL-SG108E)

Hardware

Cabling

3. TL-SG108E VLAN Configuration

Step 1: Reset & Configure Management IP

# Connect to the switch web UI at 192.168.0.1
# Default credentials: admin / admin

# Go to System → System Info → IP Address
# Change to Static: 10.1.0.100 / 255.255.255.0 / Gateway: 10.1.0.1

Step 2: Create VLANs

# Go to VLAN → 802.1Q VLAN → Create

VLAN 20  Name: Trusted
  Tagged: Port 1
  Untagged: Port 2

VLAN 30  Name: DMZ
  Tagged: Port 1
  Untagged: Port 3

VLAN 40  Name: IoT
  Tagged: Port 1
  Untagged: Port 4

VLAN 60  Name: FieldOps
  Tagged: Port 1
  Untagged: Port 5

Step 3: Set PVID per Port

# Go to VLAN → 802.1Q VLAN → PVID Setting

Port 1: 1     (trunk — carries all VLANs)
Port 2: 20    (untagged VLAN 20)
Port 3: 30    (untagged VLAN 30)
Port 4: 40    (untagged VLAN 40)
Port 5: 60    (untagged VLAN 60)
Ports 6-8: 1   (VLAN 1 / management)

4. pfSense Configuration

4.1 Enable VLANs in pfSense

# Interfaces → Assignments → VLANs → Add

VLAN Tag: 20  Description: Trusted
VLAN Tag: 30  Description: DMZ
VLAN Tag: 40  Description: IoT
VLAN Tag: 60  Description: FieldOps

4.2 Assign Interfaces

# Interfaces → Assignments

LAN (native):   10.1.0.1/24     (VLAN 1 — Management)
OPT1 (VLAN 20): 10.1.1.1/24    (Trusted)
OPT2 (VLAN 30): 10.1.2.1/24    (DMZ)
OPT3 (VLAN 40): 10.1.3.1/24    (IoT)
OPT4 (VLAN 60): 10.1.4.1/24    (Field Ops)

4.3 Firewall Rules

# Firewall → Rules → per interface

WAN (Internet):
  Allow UDP 51820 # WireGuard outbound (auto)

Trusted (VLAN 20):
  Allow Any → Any (to all except IoT)

DMZ (VLAN 30):
  Allow Any → Any           # Services can reach out
  Allow TCP 22,443 from 10.1.1.0/24  # Admin SSH/HTTPS from Trusted

IoT (VLAN 40):
  Allow Any → WAN only      # Internet egress only
  Block Any → RFC1918       # No access to private nets

Field Ops (VLAN 60):
  Allow TCP 22 from 10.1.1.0/24   # SSH from Trusted to Pi 5s
  Allow Any → WAN          # Outbound internet

4.4 Outbound NAT

# Firewall → NAT → Outbound → Hybrid Outbound NAT
# pfSense will auto-add rules for each VLAN
# Each VLAN's traffic will NAT to the WAN IP

5. WireGuard Tunnels

5.1 VPS — WireGuard Server

# On the Hostinger VPS (10.100.0.1)

apt install wireguard

mkdir -p /etc/wireguard && cd /etc/wireguard
wg genkey | tee server.key | wg pubkey > server.pub

cat > /etc/wireguard/wg0.conf << 'WGEOF'
[Interface]
Address = 10.100.0.1/16
ListenPort = 51820
PrivateKey = $(cat /etc/wireguard/server.key)

# PostUp/postDown for iptables to NAT between WireGuard and Docker
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# ── Home (Protectli pfSense) ──────────────────────────
[Peer]
PublicKey = <home_public_key>
AllowedIPs = 10.100.1.1/32, 10.1.0.0/16
PersistentKeepalive = 25

# ── Field (Mudi GL-E750V2) ───────────────────────────
[Peer]
PublicKey = <mudi_public_key>
AllowedIPs = 10.100.2.1/32, 10.2.0.0/16
PersistentKeepalive = 25
WGEOF

systemctl enable --now wg-quick@wg0

5.2 Home — pfSense WireGuard Client

# pfSense web UI:
# System → Package Manager → Available → Install wireguard

# VPN → WireGuard → Tunnels → Add

Enabled:           ✓
Description:       VPS Tunnel
Listen Port:       51820
Interface Address: 10.100.1.1/16
Private Key:       (generate)

# VPN → WireGuard → Peers → Add
Enabled:           ✓
Tunnel:            VPS Tunnel
Public Key:        (VPS server's public key)
Allowed IPs:       10.100.0.0/16, 10.2.0.0/16
Endpoint:          VPS_PUBLIC_IP:51820
Persistent Keepalive: 25

5.3 Field — Mudi WireGuard Client

# GL-E750V2 web UI (192.168.8.1):
# VPN → WireGuard Client → Add

Name:              VPS Tunnel
Private Key:       (generate via button)
Address:           10.100.2.1/16
DNS:               1.1.1.1
Endpoint:          VPS_PUBLIC_IP:51820
Allowed IPs:       10.100.0.0/16, 10.1.0.0/16, 10.2.0.0/16
Persistent Keepalive: 25
Route Allowed IPs: ✓

# Peer:
Public Key:        (VPS server's public key)

5.4 Route Table Summary

6. VPS Server Setup

Running Services

Routing for Docker Services

# Docker containers need to route through WireGuard
# Add VPS's wg0 interface to docker bridge or use --net=host
# Or: use Traefik labels to route traffic through the tunnel

# Enable IP forwarding on VPS:
sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

7. Mudi (GL-E750V2) Configuration

Initial Setup

1. Insert SIM card for 4G LTE
2. Power on Mudi, connect to its WiFi or plug into the LAN port
3. Open http://192.168.8.1 in a browser
4. Set up the 4G LTE connection in the web UI
5. Go to Network → LAN and set IP to 10.2.1.1/24

WireGuard Tunnel

# VPN → WireGuard Client
# Add tunnel with the settings from section 5.3 above
# Also enable "Kill Switch" to route all non-WireGuard traffic
# through 4G LTE (prevents leaking unencrypted traffic)

Field Devices Behind the Mudi

8. BOSGAME P3 Field Relay Deployment

Recommended Model: Ternary Bonsai 27B

Fits the BOSGAME P3's 32GB RAM with ~19-22 GB headroom for OS and tools. The 262K context window captures full pentesting session data including Pi 5 execution logs. Uses Prism ML's llama.cpp fork with custom low-bit CUDA/Metal kernels.

Deployment Script

The script does everything: installs Ubuntu Server prerequisites, Ollama, downloads the model (~7.2 GB), configures the firewall for VLAN 60 access, and runs a verification test.

# On the BOSGAME P3 after fresh Ubuntu Server 24.04 LTS install:

curl -sL https://setup.pentagi.dev/deploy-field-relay.sh | sudo bash

# Or copy the script from the pentagi skill repo:
sudo bash scripts/deploy-field-relay.sh

What the script installs:

1. System packages (build tools, networking, Python)
2. Firewall (UFW) — SSH from Trusted VLAN, Ollama from DMZ + Field VLANs
3. Ollama with systemd override (listen all interfaces, 24h keep-alive)
4. Downloads Ternary Bonsai 27B GGUF from HuggingFace
5. Creates Modelfile with 262K context config
6. Imports into Ollama as bonsai-27b
7. Verification test

9. Bright Data Proxy Integration

On the VPS

# Set up a SOCKS5 proxy tunnel through Bright Data
# Bright Data provides a proxy endpoint like: brd.superproxy.io:22225

# Test the proxy:
curl -x socks5://customer-YOUR_ZONE:YOUR_PASS@brd.superproxy.io:22225 \
  https://api.shodan.io/shodan/host/8.8.8.8?key=SHODAN_KEY

For PentAGI Field Operations

The BOSGAME P3 and Pi 5s can route traffic through the VPS proxy:

# Via the WireGuard tunnel:
# Pi 5 → WireGuard → VPS → Bright Data → Target

# On the VPS, set up a local SOCKS5 forward:
ssh -D 1080 -N -f user@localhost

# Or use a transparent proxy with iptables on the VPS
# to route specific traffic through Bright Data

Integration Points

10. Model Recommendations by Hardware

11. Deployment Scripts

BOSGAME P3 Field Relay

# /opt/data/scripts/deploy-field-relay.sh
# Run on fresh Ubuntu Server 24.04 LTS
# Does: system setup → Ollama → Bonsai 27B → verify

curl -sL https://short.url/deploy-field-relay.sh | sudo bash

GTi15 PentAGI Node (when hardware arrives)

# Install PentAGI + LLM models
# 1. Ubuntu Server 24.04 LTS
# 2. NVIDIA drivers + CUDA for RTX 5060 Ti
# 3. Ollama for local models
# 4. Docker + PentAGI stack
# 5. Connect to VPS via WireGuard

# NVIDIA drivers:
sudo ubuntu-drivers autoinstall && sudo reboot

# Ollama:
curl -fsSL https://ollama.com/install.sh | sh

# Download models (see section 10):
ollama pull gpt-oss:20b
ollama pull devstral:24b

Full Network Bootstrap (tl;dr)

1. Configure TL-SG108E with VLANs (section 3)
2. Set up pfSense — VLAN interfaces, firewall rules, WireGuard (sections 4-5)
3. Set up VPS WireGuard server + add peer keys (section 5.1)
4. Set up Mudi — 4G LTE, WireGuard client, LAN subnet (section 7)
5. Deploy BOSGAME P3 — run deploy script (section 8)
6. Deploy GTi15 — Ubuntu + NVIDIA + Ollama + PentAGI
7. Wire Bright Data into OSINT workflows (section 9)

Generated for PentAGI Stack · last updated July 2026