Internet traffic
—
· last 24 h
Independent network · in production 24/7
Redparra Network
$ An independent, self-hosted network focused on networking, automation and modern architectures.
It is not a lab: it is a real production network, running 24/7, that connects homes and datacenters in 3 countries and carries the everyday traffic of the people behind them. It hosts services such as Linux mirrors, DNS, VPN, SD-WAN and IPv6, all deployed through automation pipelines.
Built to learn, test and share — run like production, combining reliability, simplicity and curiosity.
- Routers
- 23
- WireGuard tunnels
- 63
- Sites
- 21
- Firewall rules as code
- 380
- VLANs
- 103
- Hand-made changes
- 0
// right now · real data
The network, right now
Real measurements from our monitoring, published every few minutes as totals only.
Sites online
—
last 24 h
Healthy tunnel endpoints
—
last 24 h
VPN users connected
—
last 24 h
Devices with a lease
—
last 24 h
// network map · real state, every 5 minutes
The mesh, as the code defines it
This map is generated from the production inventory on every build: 3 cores in full mesh, 18 edge sites and 2 cloud nodes, every edge dual-homed to every core over WireGuard, with BGP for routing and BFD for sub-second failover. In Real mode every tunnel shows its real state and activity, refreshed every 5 minutes; Simulation mode lets you play failures. Tap a router to inspect it.
- Throughput
- —
- Tunnels up
- —
- BGP sessions
- —
- Avg latency
- —
- Real
- —
// what we do
Real production networking, running 24/7
SD-WAN over WireGuard
63 encrypted tunnels built automatically. Every site is dual-homed; BGP chooses the path and BFD detects failures in milliseconds.
Network as code
Each router is a YAML file. Python configlets render firewall, LAN, WAN, WiFi, VPN and DHCP, and push them through the RouterOS API. Idempotent, with dry-run and clean-up.
Segmentation & security
380 firewall rules versioned in git, global and per site. Safe, DMZ, services, guest and lab VLANs; RADIUS for WiFi and VPN users.
IPv6 dual-stack
Public IPv6 addressing planned per site, with static and SLAAC prefixes carried across the mesh alongside IPv4.
Observability
Sites, tunnels, VPN users and leases are polled continuously and stored as time series; netwatch events stream over MQTT.
Source of truth
Devices, cables, circuits and sites are synchronised with NetBox, so documentation never drifts from reality.
// fleet
What the network is made of
Counted from the inventory and the DHCP reservations on every build. Only totals are published.
412 devices with a reserved address, by kind
Show as table
| Item | Count |
|---|---|
| Smart home (lights, sensors, relays) | 170 |
| Servers & services | 54 |
| TV & media | 41 |
| Network gear | 32 |
| Cameras | 25 |
| Computers & printers | 13 |
| Energy & power | 10 |
| Vehicles | 4 |
| Other | 63 |
Routers by model
Show as table
| Item | Count |
|---|---|
| MikroTik hEX | 5 |
| MikroTik hAP ax² | 4 |
| MikroTik hAP ac² | 3 |
| Linux VPS (OVH) | 2 |
| MikroTik hAP ac³ LTE6 | 2 |
| MikroTik RB5009UG+S+IN | 2 |
| MikroTik CHR (cloud) | 1 |
| MikroTik Chateau 5G ax | 1 |
| MikroTik LtAP mini | 1 |
| MikroTik L009 | 1 |
| MikroTik Chateau 5G | 1 |
Network segments · sites with each VLAN
- Safe21
- DMZ21
- Guest21
- Services20
- Lab20
Per-router features · of 21 routers
- BFD fast failover
- IPv6 dual-stack
- User VPN server
- WiFi managed as code
// architecture
How it is designed
The principles behind the configuration — simplified, but exactly what the code enforces.
A packet's journey
A laptop in one home opens a file on a NAS in another home. The packet never crosses the internet unencrypted.
- LaptopSafe VLAN · site A
- LAN
- Edge routerBGP · BFD
- 🔒 WireGuard
- Core3× · full mesh
- 🔒 WireGuard
- Edge routerBGP · BFD
- LAN
- NASServices VLAN · site B
Segmentation and firewall policy
- Safe holds trusted devices and can reach every segment.
- Every segment reaches the internet and the shared services: DNS, NTP, logs and monitoring.
- Everything else is denied and logged by default, between segments and between sites.
- Exceptions are explicit host-to-host rules, reviewed and versioned in git.
When a link fails
- 0 msA tunnel or an internet link goes down.
- < 1 sBFD stops receiving keepalives and declares the neighbour down.
- + msBGP withdraws the routes learnt through that tunnel.
- < 1 sTraffic flows through another core. Nobody notices.
Addressing plan
- Each site gets its own IPv4 block and IPv6 prefixes, derived from its site id.
- Static IPv6 for infrastructure, SLAAC for clients, on every VLAN that needs it.
- Addresses, DNS records and reverse zones are generated, never typed.
// gitops
From a commit to 23 routers
Nobody types configuration on a router. A change is a pull request; the pipeline does the rest.
- 01
Describe
Inventory, VLANs, firewall and DHCP in YAML.
config_prod/ - 02
Test
The whole suite runs on every push and blocks bad changes.
pytest - 03
Render
GitHub Actions on a self-hosted runner renders the intended state.
mikro_main.py - 04
Apply
Diff against every router and push only what changed, in parallel.
RouterOS API - 05
Observe
Monitoring and NetBox close the loop.
InfluxDB · NetBox
# 2026-10-25 21:13 UTC · commit local
$ git commit -m "Add sonos to secure VLAN #push" && git push
✓ pytest · all tests passed
✓ loaded 23 devices from inventory
✓ rendered 63 WireGuard links · 380 firewall rules · 535 DHCP reservations
✓ pushed changes to 21 routers in parallel
→ network converged. 0 manual steps.// stack
Built with
Self-hosted. 🚀