3 ms·
I'd suggest an isolated LAN (network switch and all) for the interior stuff, with your system hooked to that LAN as well as your normal, internet connected one.
by h2odragon 4y ago
I'd suggest an isolated LAN (network switch and all) for the interior stuff, with your system hooked to that LAN as well as your normal, internet connected one.
The isolated network should have its own root DNS server that returns "no" for all queries outside that LAN: that'll save a lot of time and misery with DNS timeouts.
- dusted 4y agoThis. A dedicated offline switch is so much simpler than VLANs, both to configure, use and understand. I'd use the same software stack on either a linux machine that's on that LAN, or just use a raspberry pi. I'd basically run the entire network part with dnsmasq.. You don't need anything else for DHCP and DNS. You don't even need to mess with iptables since you don't want packets leaving that LAN.
- icedchai 4y agoIf you use VLANs in the simplest form, it shouldn't be too hard to configure. Basically, this means: 1) each port is only on a single VLAN 2) no tagging, all ports are in access mode 3) no trunking 4) no layer 3 / routing between VLANs on the switch
- h2odragon 4y agoIf someone else is runnignthe physical wires and plugging them in, then VLANs and managed switches are a godsend; I'm sure. If you're running the wires (and how many wires are we talking here? 24 or less i bet) ... then the simplicity is worth much more IMO.