How I Engineered a Zero-Trust Corporate Network & Off-Site Security Architecture Using TP-Link…

A hands-on deep dive into building branded guest portals, locking down staff Wi-Fi, linking remote branch CCTV across Lagos, and writing custom Python scripts for real-time intrusion prevention.

When setting up corporate network infrastructure for a growing fintech/digital business, standard out-of-the-box configurations rarely cut it.

Recently, I was tasked with designing, securing, and deploying a multi-location network infrastructure for A Solar Financing Company in Lagos. The brief was simple on paper, but complex in practice:

1. Create a secure, branded guest Wi-Fi portal (OBSF_Guest) for visitors.
2. Completely eradicate staff password-sharing on the main employee Wi-Fi (OBSF).
3. Securely stream physical surveillance footage from a remote branch office in (OBSF) back to a central NVR recorder at our headquarters.
4. Automate network access controls and build an intrusion prevention system using Python.

Here is the story of how I built this enterprise setup, the real-world obstacles I faced along the way, and how I solved them using hardware controls, network engineering, and custom code.

Note on Confidentiality & Obfuscation:

To protect corporate security, privacy, and sensitive infrastructure details, certain operational parameters including specific branch locations, IP addresses, network subnets, SSIDs, and organization-specific naming conventions have been obfuscated or replaced with functional placeholders. All technical topologies, code logic, and architectural principles remain 100% accurate to the actual deployment.

Part 1: The Architecture & Guest Portal Setup

We built the core infrastructure on the TP-Link Omada SDN (Software-Defined Networking) ecosystem, managed locally via the Omada Network Application controller.

The Guest Network (OBSF_Guest)

For guests, we needed a friction-free login that still looked professional and prevented network abuse. I deployed a Hotspot Voucher System with strict constraints:

• Expiration: Vouchers auto-expire after 24 hours.
• Device Limit: Max Binding Devices: 1 per token to prevent a single guest voucher from spreading across multiple unauthorized devices.

The Challenge: Vendor Branding Limitations

The default Omada portal preview looked like a generic router interface. To make it match OBSF's enterprise aesthetic, I inspected the DOM and injected custom CSS overrides directly into the portal frame:

This gave us a clean, fully branded mobile splash screen that looked built-in rather than slapped together.

Part 2: Stopping the "Wi-Fi Password Leakage" Problem

Shortly after launch, we hit a human problem: staff members were sharing the WPA2 password for the primary OBSF corporate network. Laptops, personal iPhones, and visitors' devices were cluttering the switch tables and eating bandwidth.

Why IP Whitelisting Failed

Initially, the team asked to "whitelist IP addresses." However, in networking, a device doesn't have an IP address until AFTER it connects and completes a DHCP lease. An attacker or rogue phone typing the correct password would still get an IP address automatically.

The Solution: Layer 2 MAC Filtering & Static DHCP

We shifted to a hardware-gated Zero-Trust Access Model:

1. Hardware Whitelisting: We enabled MAC Filtering (Allow List mode) on the OBSF SSID. Unless a physical MAC address is explicitly registered in our database, the Access Point drops the connection before an IP is even offered.
2. Defeating MAC Randomization: Modern mobile OSs (iOS/Android) use "Private Wi-Fi Addresses" (randomizing MACs per session). We audited corporate endpoints and enforced "Use Device MAC" settings across all company devices.
3. Fixed IP-to-MAC Reservations: We bound each approved MAC address to a specific static IP pool, backed by a Switch ACL (Access Control List) rule that denies internet access to any dynamic IP outside the approved range.

Part 3: Solving the Remote Branch CCTV Problem (Branches ➔ HQ)

We opened a small branch office in OBSF and installed 3 Hikvision 4MP IP cameras. However, we had a major security concern: If a break-in occurred at one of the branches, thieves could easily destroy or steal the local NVR recorder.

We wanted all video recorded off-site at our OBSF headquarters — utilizing an existing 12-channel NVR that only had 2 active channels in use.

The Solution: Site-to-Site Encrypted VPN Tunnel

1. Hardware at Abule Egba: Installed a 4-Port PoE Switch (to deliver power and data over a single CAT6 cable per camera) and a TP-Link ER605 Gigabit VPN Router.
2. Site-to-Site IPSec VPN: Instead of exposing camera ports to the open internet (a massive security risk), we established an encrypted IPSec VPN tunnel between the ER605 in OBSF Branch and our main router in OBSF HQ.
3. Remote NVR Mapping: On the OBSF NVR, we added 3 new IP channels targeting the local VPN subnets of the remote cameras (OBSF.OBSF.20.X).
4. Fail-Safe Edge Backup: We inserted 128GB High-Endurance MicroSD cards into each camera. If the internet drops between Ikeja, Abule Egba and Oniru, the cameras record locally to their SD cards, then auto-sync back to the OBSF NVR via ANR (Automatic Network Replenishment) once the VPN link heals.

Part 4: Writing Custom Python Scripts for IDP & Whitelist Enforcement

Hardware UI settings are great, but automation makes them scale. I wrote custom Python scripts leveraging the Omada REST API to handle network enforcement automatically.

Script 1: Real-Time Whitelist Enforcer (enforce_whitelist.py)

This script pulls connected clients from the controller, cross-references them against an authorized CSV file, and kicks off any unauthorized devices currently sitting on the network:

Script 2: Building an Intrusion Detection System (IDS)

To stop internal port-scanning attempts before they escalate into network reconnaissance, I wrote a lightweight IDS in Python using scapy. It sniffs local traffic and triggers an API kick if an endpoint attempts to scan more than 20 unique ports within 10 seconds:

Lessons Learned & Key Takeaways

1. Layer 2 Beats Layer 3 for Wireless Access Control: Don't rely on IP filtering to secure a Wi-Fi network. Control access at the hardware MAC level before an IP address is ever leased.
2. VPNs are Non-Negotiable for Remote Hardware: Never expose IP cameras or local NVRs directly to public ports. Site-to-Site VPNs cost almost nothing extra to deploy and keep video streams 100% private.
3. API-Driven Infrastructure is the Future: Combining off-the-shelf networking hardware (like Omada) with custom Python scripts unlocks enterprise-grade features (like dynamic auto-blocking) at a fraction of the cost of high-end proprietary appliances.

Did you find this architecture breakdown helpful? Feel free to drop your thoughts or questions in the comments below, or connect with me on [LinkedIn] to chat about AppSec, DevSecOps, and Infrastructure Engineering!