4 ms·

Probably an unpopular opinion, but if you don't already know about VLANs, then probably shouldn't be connecting devices "straight to the internet" or configurin

Probably an unpopular opinion, but if you don't already know about VLANs, then probably shouldn't be connecting devices "straight to the internet" or configuring a firewall

louwrentius 5y ago
Frankly, this sounds like gate keeping, not a fan. I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs.
- mrmattyboy 5y ago
  I could see that, but when first learning about firewalls and such, start in an isolated environment.. test with VMs, old machines, whatever. Putting machines on the internet misconfigured can both put you at risk, but can also mean another device ends up in the hands of a botnet - thinking the internet outside of a firewall is any friendlier than the "real world" in the matrix is just fantasy. If someone is interested in weapons or guns, you wouldn't want them to try out their skills by putting them straight into a war zone. If someone put a tutorial on a forum for gas-engineers, about how great and easy redoing the pipes in their house because they bought a blow torch, they'd be concerns for the safety of them and the people/houses around them, surely. > I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs. Even the all-in-one appliances/disros provide a lot of documentation on the topic
jeroenhd 5y ago
I disagree. You can easily configure and manage your own failover-capable, multi-gateway home firewall without ever learning about VLANs if all you have is a cheap motherboard, a USB ethernet dongle and a cheap switch because your networking needs are quite complex before you ever even need VLANs. Maybe a home network admin might need to enter a "VLAN number" to get their traffic routed to their ISP, but that's it, and that's usually just a number you copy from some guide online. Gatekeeping people because they never learned about or worked with the VLANs found in more expensive hardware is stupid. If you know you way around VLANs but don't know how to properly configure a firewall, you're much more of a danger to the outside world than the other way around. I agree that there is some minimum skill level people should have before they hook stuff up to the public web (how to prevent being part of a botnet/DDoS amplification, how to block insecure/IoT management interfaces from the outside world, that stuff), but VLANs are an arbitrary and irrelevant thing to require people to know about.
- mrmattyboy 5y ago
  > I disagree. Fair enough > Gatekeeping people because they never learned about or worked with the VLANs found in more expensive hardware is stupid. I'm not sure I agree with VLANs being limited to more expensive hardware. Like in comments, there are some very cheap switches (£40 netgear) that support it and tonnes of older managed switches on ebay for £10. I don't necessary think that a price-point is the gateway and didn't really mean to 'gatekeep' people. > I agree that there is some minimum skill level people should have... This was the point I was meaning, though maybe VLAN is not a globally perceived this way, I had thought it was a fairly core concept that I'd considered would be part of this, but maybe it's due to personal experience.. I'm absolutely sure there's tonnes of protocols that I don't know that other's would feel the same way the other way around. But hey, without the comment and this discussion being had, I wouldn't know if others felt the same way :) And I appreciate you writing the final paragraph, even if you overall disagree :)

Probably an unpopular opinion, but if you don't already know about VLANs, then probably shouldn't be connecting devices "straight to the internet" or configuring a firewall

louwrentius 5y ago

Frankly, this sounds like gate keeping, not a fan. I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs.

mrmattyboy 5y ago
I could see that, but when first learning about firewalls and such, start in an isolated environment.. test with VMs, old machines, whatever. Putting machines on the internet misconfigured can both put you at risk, but can also mean another device ends up in the hands of a botnet - thinking the internet outside of a firewall is any friendlier than the "real world" in the matrix is just fantasy. If someone is interested in weapons or guns, you wouldn't want them to try out their skills by putting them straight into a war zone. If someone put a tutorial on a forum for gas-engineers, about how great and easy redoing the pipes in their house because they bought a blow torch, they'd be concerns for the safety of them and the people/houses around them, surely. > I think that even people who do have some interest in running their own firewall, may not be familiar with VLANs. Even the all-in-one appliances/disros provide a lot of documentation on the topic

jeroenhd 5y ago

I disagree. You can easily configure and manage your own failover-capable, multi-gateway home firewall without ever learning about VLANs if all you have is a cheap motherboard, a USB ethernet dongle and a cheap switch because your networking needs are quite complex before you ever even need VLANs. Maybe a home network admin might need to enter a "VLAN number" to get their traffic routed to their ISP, but that's it, and that's usually just a number you copy from some guide online. Gatekeeping people because they never learned about or worked with the VLANs found in more expensive hardware is stupid. If you know you way around VLANs but don't know how to properly configure a firewall, you're much more of a danger to the outside world than the other way around. I agree that there is some minimum skill level people should have before they hook stuff up to the public web (how to prevent being part of a botnet/DDoS amplification, how to block insecure/IoT management interfaces from the outside world, that stuff), but VLANs are an arbitrary and irrelevant thing to require people to know about.

mrmattyboy 5y ago
> I disagree. Fair enough > Gatekeeping people because they never learned about or worked with the VLANs found in more expensive hardware is stupid. I'm not sure I agree with VLANs being limited to more expensive hardware. Like in comments, there are some very cheap switches (£40 netgear) that support it and tonnes of older managed switches on ebay for £10. I don't necessary think that a price-point is the gateway and didn't really mean to 'gatekeep' people. > I agree that there is some minimum skill level people should have... This was the point I was meaning, though maybe VLAN is not a globally perceived this way, I had thought it was a fairly core concept that I'd considered would be part of this, but maybe it's due to personal experience.. I'm absolutely sure there's tonnes of protocols that I don't know that other's would feel the same way the other way around. But hey, without the comment and this discussion being had, I wouldn't know if others felt the same way :) And I appreciate you writing the final paragraph, even if you overall disagree :)