Setup guide

Setup 2 — Large Property, Many Networks

Glen Eden is a 150-acre property run on several separate networks, so no single LAN reaches every screen. The fix: one signage server in the main network room, a subdomain of the property’s own domain pointing at it, and every player told to look for that one name. Wherever a player sits, it finds the server.

Worked example. The network names and addresses below are illustrative; swap in your own.

Every screen finds one name: signage.yourdomain.com Glen Eden example. In the main network room, an edge firewall forwards TCP 443 and 80 to the signage server at 10.10.50.10, and internal DNS points signage at that private address. The clubhouse (2 players) and the pool and grill (1 player) reach the server over the signage VLAN 50 on the property backbone, without touching the internet (Option A). An outlying building on its own ISP line (1 player) comes in over the internet to the public IP (Option C). The office LAN is where admin laptops may open /admin; guest Wi-Fi has no screens and is blocked from signage. Every screen finds one name: signage.yourdomain.com Glen Eden example · network names and addresses are illustrative Main network room HTTPS 443 VLAN 50 Internet signage.yourdomain.com → public IP A record at your DNS host Outlying building own ISP line 1 player · Option C Edge firewall Forwards TCP 443 + 80 to the server only Signage server 10.10.50.10 Players pull content over HTTPS Internal DNS Split DNS: signage → 10.10.50.10 Property backbone · fiber + wireless backhaul Clubhouse 2 players VLAN 50 · Option A Pool and grill 1 player VLAN 50 · Option A Office LAN Admin laptops /admin allowed here Guest Wi-Fi No screens blocked from signage Signage VLAN, never touches the internet (Option A) Over the internet to the public IP (Option C)
Glen Eden network · one server, two paths to it. Screens on the property's own backhaul reach the server over a private signage VLAN; the outlying building on its own ISP line comes in through the internet to the same name.

The problem in plain terms

A 150-acre property grows its network piece by piece: an office LAN, a clubhouse, guest Wi-Fi, maintenance buildings on wireless or fiber backhaul, maybe an outlying building on its own ISP line. Each is its own subnet, often behind its own router. A player in the clubhouse can’t see 192.168.1.10 in the office, because that address means nothing on the clubhouse network.

Players need one address that means the same thing from everywhere. That’s a DNS name: signage.yourdomain.com.

Three ways to connect the networks

Option How players reach the server Internet exposure Router work Best for
A. Signage VLAN All players on one dedicated VLAN carried across the backhaul to the network room None Tag a VLAN on every switch and backhaul link to each screen Properties you control end to end, e.g. your own fiber or wireless plant
B. Routed + firewall rule Core router routes between networks; one rule allows each screen network to reach the server on 443 only None One rule per network, plus internal DNS Networks that already share a core router
C. Public subdomain Server gets a public IP; signage.yourdomain.com points at it; players connect over the internet Port 443 (and 80 for certificates) Port forward or 1:1 NAT, DNS record, split DNS Screens on networks you can’t extend, e.g. a building on a separate ISP line

Recommended for Glen Eden: A where the plant reaches, C for everything else. A keeps most screens off the internet entirely. C catches the stragglers and makes remote admin easy. Both use the same name, so a player never needs to know which path it’s on. Option C has two no-public-IP alternatives (Cloudflare Tunnel, WireGuard) in 4 · Domain & Remote Access.

Building Option C step by step

This is the setup in the overview: a computer in the network room, an outside IP, a subdomain off the property’s domain, kept secure.

  1. Get a public IP for the server. Either:

    • Static IP block from the ISP (best): assign one of the usable addresses to the server via 1:1 NAT on the edge firewall, or
    • Port forward on the existing WAN IP: forward TCP 443 (and TCP 80, for certificate renewal) to the server’s private IP. The WAN IP must be static; if it isn’t, use dynamic DNS (guide 4).

  2. Create the DNS record. At whoever hosts the domain’s DNS (registrar, Cloudflare, the web host), add:

    Type Name Value TTL
    A signage the public IP 300

    Check it from any computer: nslookup signage.yourdomain.com must return the public IP. Allow up to an hour to propagate.

  3. Set up split DNS inside the property. On the router or DNS server the on-site networks use, add a host override: signage.yourdomain.com → the server’s private IP (e.g. 10.10.50.10). Players on site then go straight across the LAN instead of out to the internet and back. Without this, many routers fail the round trip (no “hairpin NAT”) and on-site screens can’t connect even though off-site ones can.

  4. Build the server per 5 · Build the Server. When the installer asks for a hostname, enter signage.yourdomain.com. It requests a free Let’s Encrypt certificate and renews it automatically (installer TBD).

  5. Lock the firewall down (rules below), then work through 7 · Security Checklist.

  6. Pair players to https://signage.yourdomain.com, starting with one on each network.

  7. Test from every network. On a laptop on each network, open https://signage.yourdomain.com/health. A green page with a padlock means players there will work. (Health URL: installer TBD.)

Firewall rules for Option C

# From To Port Action Why
1 Internet Server TCP 443 Allow Players and admins over HTTPS
2 Internet Server TCP 80 Allow Certificate renewal only; the server redirects everything else to 443
3 Internet Server Any other Deny Nothing else is exposed: no SSH, no database
4 Office LAN / VPN Server TCP 22 Allow Server maintenance from inside only
5 Server Internet TCP 443 Allow News, weather, license activation, OS updates
6 Server Any internal network Any Deny The server never initiates connections inward; players come to it

Rule 6 matters: if the signage server were ever compromised, it can’t be used to reach the office or guest networks.

Lock the admin page to staff

Players need the server from anywhere; the admin page doesn’t. In the server’s settings, restrict /admin to the office LAN and VPN address ranges (installer TBD). Off-site staff connect through the VPN first. A player can display content but holds only its own pairing token, which can’t open the admin page.

What happens when something breaks

  • Backhaul to a building drops: its screens keep playing their cached content and resync on reconnect.
  • Property internet drops: Option A and B screens carry on normally. Option C screens on other ISPs show cached content until it returns.
  • Server dies: every screen keeps playing what it has. Restore the nightly backup to any spare PC, give it the same IP, and screens reconnect on their own.