Best architecture for this set of hardware incl VPN & LAG?

TLDR: Here's my gear; how should I set it up for best VPN throughput?

TPLink C2600 with OpenWRT 19.07
D-Link 868L with DD-WRT something-something
Dell PowerConnect 6248 + 4x SFP+ [uses 80W at idle]
Mikrotik CRS-326 (2x SFP+) - RouterOS
Watchguard XTM330
ISP Modem - connection 500/40

Long version:

Am trying to architect my home in the best way with max speed through subscription VPN.

|| The gear:

  • TPLink C2600 with OpenWRT 19.07
  • D-Link 868L with DD-WRT
  • Dell PowerConnect 6248 + 4x SFP+ [uses 80W at idle]
  • Mikrotik CRS-326 (2x SFP+) - RouterOS
  • Watchguard XTM330
  • ISP Modem - connection 500/40
  • Sonos One with Alexa (reason for mentioning later)
  • Video Editing rig & QNAP using 10Gbe SFP+
  • Windows, Linux, Android & IoT clients
  • Enterprise networking knowledge but 0 coding/compiling skills.

|| The goals:

  • Run my VPN subscription over a single device at max speed to protect "all" internal objects
  • Separate IoT net from user devices if possible
  • Ideally, retire the PC6248 as it uses a ton of power

|| The issues:

  • I have a bunch (like 20+) of smart bulbs that are managed via cloud app but also via the local Alexa device on the Sonos ("Alexa-enabled").
  • Sonos app doesn't like being routed so Wifi client to control Sonos needs to be on same subnet (unless workaround?)
  • VPN throughput
  • ISP modem won't let me configure specific internal IP ranges.

|| Plan so far:

  • Use C2600 w/ OpenWRT as internal router/FW and VPN endpoint
  • Routing table to pass certain source addresses to ISP router instead of over VPN
  • Trunk multiple VLANs [pref. using redundant link LAG] from C2600 to Mikrotik; passing specific SSIDs over specific VLANs
  • Separate IoT VLAN from 'user' VLAN
  • Manually switch control device (cellphone) to IoT VLAN when needed to direct Sonos (not common but Alexa doesn't recognise certain station names).
  • Maintain the ISP modem in full mode in order to publish guest Wifi and 'failsafe' wifi for times I mess up the VPN/router config internally :))
  • Keep a third non-VPN-passing internal VLAN for switching wired devices for certain uses when necessary (with unique SSID and managed via switchport config); (hence intended routing table config).

|| Questions:

  • Is OpenWRT capable of trunked VLANs over LAG (2-interface is sufficient) at Gbps without significant difficulty and/or in-depth Linux acquisition for me?
  • How to assign specific SSID to specific VLAN in OpenWRT?
  • What maximum speed can I expect from the C2600 using 256bit AES VPN?
  • Anyone see a better architecture here? I realise by far the best option is to use the Watchguard as the front-end but it is not silent.. and I definitely want to avoid using the PC6248 as it is -very- not silent and also the power draw mentioned above.
  • Am I being excessively hopeful asking this much of the C2600?
  • What do to with the DDWRT 868L? :))

Sorry for the long detail but I like to be thorough. :)) And thanks in advance for your thoughts.

I'm not fully familiar with the abilities of RouterOS yet but I suppose I could do the WAN routing & VPN on the RouterOS and just leave the C2600 as a (very smart) AP? Or would the Mikrotik itself benefit from OpenWRT also (and is that somewhat-easy?) ?

P.S. one drawback of the Watchguard, its client VPN support is dependant on buying licenses, which I don't want to do..

Too bad nobody got back to you on this... maybe it was all the "thoroughness"? :wink: I understand, I get pretty thorough at times myself...

I'm not an expert in much, around here, especially with some of the things you're looking to do, but there are many who are and talk about it here.

Of what I could mention as ideas for you, is yes, get out of that power hungry desktop system and replace it with something like a tiny x86 box such as a Zotac CI329. Or, even a Raspberry Pi 4.

And for an increase in VPN speed, I hear that there are a growing number of VPN providers that now use Wireguard, which for both their end and yours, speeds things up drastically.

For the other goals, hope you already searched around and found some threads...