Tigris Mendez
Network Technician
Building, segmenting, and troubleshooting networks: VLANs, firewall policy, DNS, and Wi-Fi, in a homelab I run every day and at Amazon scale at work.
Austin, TX · Open to on-site, hybrid, or remote
Network Technician
Building, segmenting, and troubleshooting networks: VLANs, firewall policy, DNS, and Wi-Fi, in a homelab I run every day and at Amazon scale at work.
Austin, TX · Open to on-site, hybrid, or remote
At home I run a small rack with a pfSense firewall, a managed PoE switch, a multi-SSID access point and a Pi-hole DNS server. I've segmented it into Management, Trusted, IoT, Guest and Server VLANs, with firewall rules that say exactly who can talk to whom, and I tested them from the restricted side.
I hold CompTIA Security+, so I design with security in mind, and I'm studying for the CCNA. I document every fix the same way: what broke, how I found it, what I changed, and what I'd watch next time.
A networking path built on a security foundation.
The network I build, segment, and troubleshoot at home: VLANs, firewall policy, Wi-Fi, and DNS.
I segmented my home network into five VLANs on a pfSense firewall, a Netgear GS308EP managed switch and a TP-Link EAP610 access point: Management, Trusted, IoT, Guest and Servers, each on its own /24 (10.0.VLAN.0). The switch trunks tagged VLANs to pfSense and the AP, and each SSID maps to its own VLAN, so IoT gear and guests never share a broadcast domain with my own devices. Every VLAN gets least-privilege rules: Trusted and IoT must use Pi-hole for DNS, direct DNS to public resolvers is blocked, and the firewall, switch and AP admin pages are reachable only from a wired management port. I tested the rules from the restricted side (10 of 10 passed) and wrote up the design, the port map, and 13 problems I hit on the way.
A Raspberry Pi running Pi-hole as the DNS server for my home network, filtering ads and trackers for every device. When the Pi lost its static address after a reboot and DNS stopped resolving, I found it with an nmap ping sweep, pinned its address, and wrote up the fix. It now runs in the Servers VLAN and serves DNS to the Mgmt, Trusted and IoT networks, with firewall rules forcing Trusted and IoT through it. Guests use their own gateway.
Designing with security in mind, on a Security+ foundation.
Adding my own sensors and displays to hardware I'm bringing back to life.
Earlier work in scripting, web, and data, kept for context.