3 ms·
I was tempted to do this but am concerned that VLANs are not a security boundary, this might expose the switch’s control plane to WAN, and the Pi has a failure
by supertrope 5y ago
I was tempted to do this but am concerned that VLANs are not a security boundary, this might expose the switch’s control plane to WAN, and the Pi has a failure prone micro SD card. The Pi 4 CPU is faster than most consumer routers and can shape a gigabit!
https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-co...
- louwrentius 5y agoAuthor here, I think the security of using VLANs isn't much of an issue in this context. The old layer-2 attacks you linked to are absolute risks, but not in this setting, I believe.
- supertrope 5y agoGood to know!
- zokier 5y agoVLANs absolutely can be considered security boundary. Sure, you can misconfigure switch and expose something unintentionally. But as a technology VLANs are pretty battle-hardened. Random reddit discussion on the topic https://www.reddit.com/r/networking/comments/opmjol/vlan_segmentation_as_security_do_you_trust_it/ https://www.reddit.com/r/networking/comments/opmjol/vlan_seg... That BH presentation is 20 years old now, and almost completely Cisco specific. I would not make security decisions on such data alone.
- supertrope 5y agoThanks
- CodeGlitch 5y ago> the Pi has a failure prone micro SD card This depends on the type and quality of the SD card does it not? Also you can setup the PI's OS to be read-only, so no writes to the SD card. This should extend the life of the SD card by quite a lot.
- sliken 5y agoOr get a CM4 with daughter board that has a SSD/eMMC, which also allows for a pci-e slot for a networking card.