3 ms·

Yeah, I'm seeing more and more people pick up products like UniFi, and putting IoT stuff over on a Private VLAN so that they only get to talk to the gateway and

Yeah, I'm seeing more and more people pick up products like UniFi, and putting IoT stuff over on a Private VLAN so that they only get to talk to the gateway and not be able to pivot to anywhere else on the network.

digitalsushi 8y ago
I put some thought into this last month. There are not a lot of consumer grade routers out there that support multiple LANs. Once you get into the business edge router type gear, it starts to become pretty easy. There's a few brands that will do it, and certainly a pfsense appliance on an x86 system with a few network adapters will do it. Running a router on an old computer is getting a bit out of style though... My solution is really quite shoddy but it satisfies me. I took an old router and set it up with its WAN as a LAN client, and its LAN as an IoT network. The router does not have NAT translation on the LAN interface. It does however perform NAT on the openvpn interface. My new IoT network, which is on its own vlan/ssid/however I split layer 2, runs the packets through the vpn and out onto the Internet in some other network, and in theory never shall the two LANs touch. If the vpn goes down, there is no NAT to leak them out my home ISP directly. Sure, I'm doing double nat, but for my IoT stuff, who cares. It's just dye going in the river, just make it go away from me. I adopted a recurring cost of 3 bucks for a vpn. But I didn't have to get shiny new gear or run an entire computer. My little way for the sake of sharing. Love to hear any criticism of it since I am still thinking about it quite a bit.
- zyzyl 8y ago
  An obstacle here is that most of these business routers don't support UPnP. I don't want to argue the merits or pitfalls of UPnP, what's relevant is that lack of it becomes an obstacle to online play for modern video game systems such as Xbox. Add to that scenarios where router type is mandated by a particular ISP (Verizon in the US is applicable here) and there's quite a few scenarios where people may have the ability t manage such a protection scheme but other factors get in the way.
- vvanders 8y ago
  Yeah, kudos on you for thinking this through. I really like Private VLANs over vanilla separate LANs(Physical or via VLAN) because it prevents each client from talking to each other even when they're on the same LAN. From the IoT device's perspective all they can reach is your gateway(192.168.1.1 or whatever) and no other device. So their ability to pivot/snoop on other devices in the network is curtailed. Sadly it requires hardware support to do right since it's essentially disabling all the switching that exists at the ARP/Switching layer and forcing the device to route through the gateway. On the UniFi gear this is literally just a checkbox when you're setting up the LAN(guest network vs LAN/corp network) and they handle the rest.
addflip 8y ago
This is exactly what I did. I have an IoT VLAN and I also limit the ports accessible to those devices. I just wish this setup was available to the average consumer that doesn't know how to do this.

digitalsushi 8y ago

I put some thought into this last month. There are not a lot of consumer grade routers out there that support multiple LANs. Once you get into the business edge router type gear, it starts to become pretty easy. There's a few brands that will do it, and certainly a pfsense appliance on an x86 system with a few network adapters will do it. Running a router on an old computer is getting a bit out of style though... My solution is really quite shoddy but it satisfies me. I took an old router and set it up with its WAN as a LAN client, and its LAN as an IoT network. The router does not have NAT translation on the LAN interface. It does however perform NAT on the openvpn interface. My new IoT network, which is on its own vlan/ssid/however I split layer 2, runs the packets through the vpn and out onto the Internet in some other network, and in theory never shall the two LANs touch. If the vpn goes down, there is no NAT to leak them out my home ISP directly. Sure, I'm doing double nat, but for my IoT stuff, who cares. It's just dye going in the river, just make it go away from me. I adopted a recurring cost of 3 bucks for a vpn. But I didn't have to get shiny new gear or run an entire computer. My little way for the sake of sharing. Love to hear any criticism of it since I am still thinking about it quite a bit.

zyzyl 8y ago
An obstacle here is that most of these business routers don't support UPnP. I don't want to argue the merits or pitfalls of UPnP, what's relevant is that lack of it becomes an obstacle to online play for modern video game systems such as Xbox. Add to that scenarios where router type is mandated by a particular ISP (Verizon in the US is applicable here) and there's quite a few scenarios where people may have the ability t manage such a protection scheme but other factors get in the way.
vvanders 8y ago
Yeah, kudos on you for thinking this through. I really like Private VLANs over vanilla separate LANs(Physical or via VLAN) because it prevents each client from talking to each other even when they're on the same LAN. From the IoT device's perspective all they can reach is your gateway(192.168.1.1 or whatever) and no other device. So their ability to pivot/snoop on other devices in the network is curtailed. Sadly it requires hardware support to do right since it's essentially disabling all the switching that exists at the ARP/Switching layer and forcing the device to route through the gateway. On the UniFi gear this is literally just a checkbox when you're setting up the LAN(guest network vs LAN/corp network) and they handle the rest.

addflip 8y ago

This is exactly what I did. I have an IoT VLAN and I also limit the ports accessible to those devices. I just wish this setup was available to the average consumer that doesn't know how to do this.