So, I have been experimenting with Hermes inside my home lab and I decided to build out a dedicated AI agent network that allows easily controlling the traffic that is allowed out of that network and to other parts of my home lab.

I created a dedicated VLAN (999) for my agent. I am currently using a Palo Alto PA-440 that handles my routing and firewall policies. Unifi is carrying my Layer 2 traffic. Then, I created the new network as a new Proxmox SDN VNET.

The interesting part is the traffic controls. Currently I have it setup where my management workstation can connect TO the AI agent box, but not the other way around. Eventually I want to give Hermes limited access to services like Netbox, Proxmox, Kubernetes, etc.

Curious how many of you are isolating self-hosted AI agents and controlling how traffic is sent out into the rest of your home lab.