Mikrotik RB5009UPr+S+IN as my main router
I don't see why you want that model given that you have an Internet router already — the FritzBox — and you want to add a PoE switch.
If it were me designing it, I'd move the PoE role to a separate switch, then either choose the non-PoE model of the 5009 and put it in place of the FritzBox, or leave the FritzBox as the main router and skip the 5009. Dual routers implies dual NAT, which is almost always bad. I don't see how you justify having both.
Dual PoE isn't as bad, but it does lead to the situation which others have called out, where your design becomes incoherent because you've split the PoE responsibilities, putting PoE devices both at the border routing layer and ahead of it.
Firewall and the intervlan routing.
While it is nice to put those two responsibilities into a single box, it's something you do when the network is much smaller so that having a single choke point makes sense. In this network, I think you're much better off splitting the roles.
I think you should look at the CRS328-24P for the core switch, and let
it hoist the major VLAN processing load, since
it will do VLAN filtering in hardware, on the switch ASIC. Only packets destined for the Internet go from there up to the router. If you decide to replace the FritzBox with the RB5009, you can do it over a 10G fiber link.
(VLAN filtering isn't quite "inter-VLAN routing," but it's a big component of it, and likely enough for everything you need from VLANs. If you need true inter-VLAN routing, that can bounce up to the main router and back down into the core switch.)
Yes, the CRS328 is overkill for your purposes, but alas, there isn't anything smaller that doesn't lose important features, IMHO. I've been wanting an 8+4 port PoE/SFP+ switch from MikroTik for years now, but the closest they've come so far is the
CSS610, which only runs the "lite" version of the already lite-beer SwOS. If they'd give us a what we might call a
CRS610 or a PoE version of the
CRS310, that's what I'd be recommending instead for this network.
My suggestion to move the PoE stuff off the RB5009 leaves its wired ports unused except for the single uplink. You might benefit from switching to a smaller router.
Your model of the FritzBox is designed for 300 Mbit/sec DSL uplinks. Although it seems you're not using that function, and are using it for GigE routing to the fiber modem, that still makes the 5009 massively overkill. A
hEX S is plenty of router for this situation unless you have short-term plans to upgrade the Internet link beyond 1G.
(I'd actually recommend a
hAP ax² instead of a hEX S these days if you can talk yourself out of a fiber link between the core switch and the Internet router. That's because there are two major features that rely on ARM hardware, containers and ZeroTier, and I'd hate to leave them out, since there are things best done at the border gateway. The CPU in the hAP ax² is also faster, giving it more overhead for a 1G link, which is borderline on the hEX S. You can turn off the radios in the ax² if you like and use it as an upgraded hEX.)
Alternately, maybe you want to move all of the "public" services you presumably have running under Proxmox to one server connected to the RB5009, then configure it as a "DMZ," with partial Internet access for those services provided by the 5009. That would be a much better use of these ports than IP cameras, which IMHO should be shielded deeply inside the private network, not out on the border like that. If you want a way to watch the cameras from outside the LAN, there are better ways to do it than by putting them right on the border.
What would help is if we knew how much of the wiring was fixed-in-place and which could be moved or replaced. I'd also like to know if that gray box is a single room, as it seems to be. "Mixed VLAN zone" doesn't give me the physical layout, which is important in planning a network redesign.
I ask because without that, I go off into green-field dreaming and come up with this design:
- The light gray box looks like a home office/lab, in a single room. I'd put the CRS328 here as the LAN's core switch, using its four SFP+ ports for the main PC, the NAS, the bigger of the two Proxmox servers, and an uplink to the main router. I realize that you say your office and gaming PCs are both 1G, but I'd upgrade one to 10G as part of this, if only for faster access to the NAS.
- I'd run the "Office" and "Living Room" links (blue and green boxes) to the core switch, not to the main router. The core switch is doing the primary VLAN processing in this design, so it is best if those links go through it, not hairpin through the border router. This keeps VLAN load off the main router, allowing it to focus on its one job: routing packets to and from the Internet once the core switch decides who goes through and who stops right there.
- The rest of the equipment scattered around the house can go back to the CRS328 for PoE or out to one of the few ports on the main router. If you still want to put an auxiliary switch in here, that's fine, but I'd move as much to the core switch as possible.
but if that's what you need and/or want, go for it.
