Network Overview UpdateThank you for the additional context—this helps clarify the setup significantly. The TP-Link Archer C9 is operating in access point (AP) mode, providing Wi-Fi connectivity with a distinct BSSID (likely tied to a legacy SSID or configuration algorithm), allowing older devices to connect without reconfiguration. Even though its WAN is unplugged (as shown in the screenshot), it's still active for local wireless clients, explaining the detected 12 wired and 1 wireless device. This avoids disrupting legacy hardware that hasn't adapted to newer BSSIDs from the FRITZ!Box or ASUS.The FRITZ!Box 7560 at 192.168.1.249 is indeed the primary gateway, with its non-standard IP (typically .1) resulting from your historical practice of assigning high IPs to routers (starting from .254 and decrementing over time). This makes sense for continuity, especially as older gateways phase out. The pfSense instance at .252 seems to be handling specific services like DHCP and DNS (based on its active leases and Unbound resolver), while the FRITZ!Box manages internet access (via LAN1 as WAN to 2degrees fiber or similar, with DSL disabled) and telephony/NAS. No double-NAT or conflicts are apparent, but the lack of redundancy is a vulnerability, particularly with 2degrees' reported inconsistencies (e.g., outages or speed variability, as you've noted).The ASUS ZenWiFi acts as a mesh extender, and Pi-hole provides ad-blocking. Overall, the LAN remains on 192.168.1.0/24, with ~50-60 devices cataloged (including transients). If the Starlink terminal is powered up, it could serve as a strong failover option—Starlink provides high-speed satellite internet (typically 50-200 Mbps down in NZ), independent of terrestrial lines.