14 ms·

My network home setup – v4.0

drio 4y ago
Thank you for posting, very informative. Some random comments: I use a Mikrotik router and I have a dedicated network for devices I don’t want to access my main network. They can only access my MQTT server. RouterOS (mikrotik OS) is a bit terse and comes with its own cli interface. I managed to modify the default setup relatively easily via the UI to create the two networks I needed. In the future I may install openWRT but at the moment the current setup works well. Another think that I did recently that was quite impactful (performance wise) was to add a Omaha controller to make my two access poins work together to expose one single wifi network. Before I had them working on their own. The performance of the network has increased substantially. I’d prefer not having to buy a piece of hardware to do that but I am glad I did. I recently bought a ds720 from Synology. I upgraded the RAM to 6gb. So far I use it to dump my personal backup (restic). Also my Reolink cameras dump video via FTP. Because the ds720 runs linux and docker I am planning on consolidating a few services in the ds720 (home assistant, grafana and Pinole). Oh, I also got a UPS system for the main components that provide Internet access. I can be without power and have Internet for 2 hours a half. One thing I want to do is to get an alert when the power goes down. The UPS exposes that via USB.
justusthane 4y ago
Very neat - thank you for documenting this, especially the piece about using Avahi to place the HomePods on a different VLAN. This is something I'm planning to do but hadn't looked into yet, so this will save me a lot of effort. Just out of curiosity, that's the black box in your cabinet balancing on the metal cones?
- gertrunde 4y ago
  Going from the earlier instalments (v1/2/3) - I suspect it's the ISP modem. (And I'm guessing the metal cones are there to lift it off the flat surface for more airflow).
  - giuliomagnifico 4y ago
    Exactly, the metal cones are 3 unused audiophile spikes. Perfect fit inside the holes of the bottom of the modem.
  - blitzar 4y ago
    V1/2/3 are pretty handy for figuring out the other stuff too.
- blitzar 4y ago
  ISP Modem?
- giuliomagnifico 4y ago
  Thanks! >Very neat - thank you for documenting this, especially the piece about using Avahi to place the HomePods on a different VLAN. This is something I'm planning to do but hadn't looked into yet, so this will save me a lot of effort. Yes, it's very easy if you use Avahi, but it's important that you're using VLANs and not subnets, because I had lots of troubles using a separate subnets for iot devices and the HomePod in the main subnet. You have to add a route on the router and tweaks the firewall. Using vlans instead is easier and faster. >Just out of curiosity, that's the black box in your cabinet balancing on the metal cones? Italian ISP modem "unfortunately". If you see the network scheme you can understand better: https://giuliomagnifico.blog/_images/2023/home-network_v4/Rete%20casa.png https://giuliomagnifico.blog/_images/2023/home-network_v4/Re...
- syntaxing 4y ago
  Wait, does this work with HomePod minis? My current mDNS works with my network, my issue is the HomePod mini automatically jumps back to the same wifi as my phone.
  - giuliomagnifico 4y ago
    Yes absolutely, but your iPhone and the HomePod should be on the same/main vlan, not the HomePod on the IoT vlan.
twawaaay 4y ago
I don't have pictures but I can describe it. * Broadband 600/60Mb/s with seamless failover to 5G (varying speeds) * Netgate 6100 router with VPN client, VPN server, site to site VPN configured, traffic shaping to reduce bufferbloat, uplink failover, etc. * 4 Cisco SG 250-8 switches sprinkled throughout the flat. One acting as my core switch. * QNap with 2 4TB drives in mirror for backups * A HDD USB station with a stack of 4TB HDDs for backups. Backups are delivered to qnap at various times and then from time to time I make a complete copy to a drive which is put in a rotation. I keep three full copies of the data at any time and at least one of them is off-site with my family. When I visit my family I take the latest backup and replace the drive that is in their custody. * a small, passively cooled server with 2TB fast SSD, 128GB ECC RAM, Ryzen 5 CPU, Asrock PRO X570D4U-2L2T. Hosts proxmox where I keep about a dozen VMs for various things, Ubiquiti management panel, NVR, dns filter, development tools, minecraft servers, jump box, etc.... * a 10 year old Thinkpad T440s running always on serving as my emergency server and a development environment. * 4 Ubiquiti WiFi 6 access points -- before you jump in saying this is overkill, I live in a large flat in a dense urban area with about half a thousand 2.4GHz APs and 50 5GHz ones interfering with my WiFi setup. Most people and even network providers are clueless and set up their devices to max power as if it was going to help them -- it only makes things worse. I have 4 APs with reduced power so that anywhere you are at my flat you are always close to one of APs and you roam between them seamlessly as you move. * Multiple VLANS and WiFi networks * a VLAN + WLAN for my family for their regular devices to access the Internet and some defined services within network but otherwise disallowed to contact anything else * a VLAN + WLAN for IOT, legacy devices, devices I don't trust or devices that only support old protocols and would deteriorate WLAN performance (printers, a chinese projector, etc.) This VLAN does not have Internet access (so that devices can't phone home), don't have access to any other device in the network, don't have access to other networks and can only be reached with defined firewall rules. * a VLAN + WLAN for my work -- this is dedicated for my work laptop, my phone, my electronics lab (oscilloscope, multimeter, programmable PSU/load, etc.) * a VLAN + WLAN for guests * a management VLAN -- any network devices, servers, QNAP etc. are only available through this separated VLAN which has very strict access through a jump box. Also does not have direct internet access so the devices can't phone somewhere else (but I have a proxy for software updates, etc.) * a service VLAN -- where my services are available internally (for example QNAP interface, apps running in VMs, etc.) Some of them have rules to be accessed from other networks * a DMZ VLAN -- I expose some services to the world, DMZ serves to provide one more hurdle for any attacker
cabirum 4y ago
My unnecessarily convoluted home setup that takes too much space - ftfy.
- bluedino 4y ago
  Agreed, but it's neat. Every time I try setting my home network up like that (smart firewall, traffic graphs, etc), I just end up going back to a $30 router/AP.
  - fishtacos 4y ago
    Had a similarly convoluted network for some years... over time you realize it's just pointless to waste time maintaining and troubleshooting said setup. Today it's ISP router + separate AP (better coverage). Chinese hackers aren't attacking my network, and if they did, cool, have at it. Basic firewall + NAT + AV covers 99% of use cases, even in a business, with the right configuration. Turns out I don't miss pfSense either. Makes sense for keeping skills up to date, though, and as a hobby, I can see how one can get into it. Reddit's r/homelab has some crazy builds to check out.
    - deleted 4y ago
      [deleted]
    - bityard 4y ago
      I essentially have a foot in both camps... I like having the control and autonomy of open-source networking hardware but I don't have enough spare time to make it a full-on hobby. Right now my "happy spot" is: 1. An OPNSense firewall between my cable modem and the rest of the network running on a low-power PC Engines APU2. The web-based UI is funky but workable, full SSH access to the box for digging into the internals when needed, online upgrades are a cinch. 2. An 8-port gigabit unmanaged switch that everything hangs off of. 3. A Netgear WAX218 business-grade access point for wifi, running the stock firmware. Web UI is decent and doesn't require any cloud-based management bullshit. For around $100, it works much better than it has any right to, given the prices of mid-range APs and wifi routers these days. 4. A small fleet of Raspberry Pis for miscellaneous tasks. If I get more into IoT, it shouldn't be much of a hassle to add VLANs and maybe another switch.
aliljet 4y ago
Very curious, what if you had a 10gbe symmetric connection from your ISP? How would you modify your deployment?
- giuliomagnifico 4y ago
  ...well I think it takes a long time before we will have 10Gbe in Italy (we still don't have 5Gbe), anyway I'll use only another router and switch, with 10gb ports, but the issue in this case will always be the wifi antenna of the (i)Devices that are still below 1Gbps, so the AP will not need a swap at the moment.
  - afmotta 4y ago
    There is at least one provider offering 10Gbe in Italy (in download - 2.5 in up): https://www.dimensione.com/portale/fibra-internet-10-giga.php https://www.dimensione.com/portale/fibra-internet-10-giga.ph.... There may be more that I don't know of.
    - giuliomagnifico 4y ago
      Yes but there’s no real coverage, just few houses in the center of Milano or Torino. Where I live isn’t available.
      - afmotta 4y ago
        Yes, even if I live in Milan, my house is not covered. Though it's nice to see things are starting to move in the right direction.
xattt 4y ago
Are there any server rack mounted patch panels that let you choose to use a certain network drop for POTS or for Ethernet? I’ve seen similar patch panels for structured wiring, but not for server racks.
- giuliomagnifico 4y ago
  With the 19" front rack mount I have never seen one.
- zrail 4y ago
  Get a 19" keystone panel and then you can do whatever you want. There are keystones available for Ethernet, coax, rj11 POTS, hdmi, fiber, basically anything.
fy20 4y ago
Can someone recommend a budget WiFi access point with long range? I only have LTE as the backhaul, so the fastest speeds are not a requirement. I bought a EAP610 which I saw recommended on Reddit, but the range seems worse than the ISP modem's (something Huawei) built in WiFi.
- neurostimulant 4y ago
  Buy two Asus RT-AX56U, install Merlin on it, then join them using the built-in wired (or wireless) mesh feature to cover large area on the cheap.
- KaiserPro 4y ago
  for a normal AP, then I'd get a second hand ubiquity LR off ebay.
- thakoppno 4y ago
  My advice is tangential but run an ethernet cable. Access points aren’t great at long distance. Setup an AP in the far away room on the other side of the house. It will be far less frustrating.
- bityard 4y ago
  I bought a Netgear WAX218 a few months back for around $100... but a quick look around shows that either the price has gone up significantly or they're not making them anymore? Well, if you manage to find one for a decent price, I highly recommend it.
- duxup 4y ago
  I am a big fan of Netgear’s Orbi line. Really I think distance is more of a relative/ location issue and a mesh system that allows you to move the satellite endpoints around to suit your needs is very useful to figure out the optimal situation for a given environment. https://www.netgear.com/home/wifi/mesh/orbi/ https://www.netgear.com/home/wifi/mesh/orbi/
KaiserPro 4y ago
My setup is pretty similar in schematic, but not finess of design. I have a 24 port netgear fanless smart switch as the backbone. I did have a POE version but the fans were too loud. I have a PoE injector now which allows me to power the APs and the phones for the house intercom. I use pfsense for routing and firewall. Ubuquity for APs. I have four, one for upstairs, one for down, one in the garden and one in the shed. three are second hand. I have a VLAN for work, (I can ssh in from the normal vlans, but I can't get out from the work VLAN) A have a VLAN for CCTV, normal use, servers/services, and one for IoT. Seems to work ok for my needs, but most people don't need what I want on a network.
Thaxll 4y ago
Is it working fine to have IOT on a different vlan, lot of IOT use weird protocol ( mdns, multicast etc ... ) that are not friendly with vlan? I know that some people have issues for example with the Chromecast being seperated since it needs internet but also be able to communicate with your phone on a different vlan.
- chomp 4y ago
  Yeah, avahi will help you out quite a bit there, but I personally pick my IOT devices to where they will not have requirements like that. I'm pretty #nocloud with anything I put in my home, so the majority of IOT devices I have go on the null routed VLAN and are perfectly happy.
- syntaxing 4y ago
  My IoT VLAN is one way only (main VLAN can talk to it, and it can talk back BUT it cannot talk to any other VLAN on its own accord). No issues with mDNS or multicast. I redirect all DNS request as well to nextDNS with masquerading. I have probably 30 devices on it? Zero issues with home assistant and HomeKit
- rbranson 4y ago
  IoT VLAN indeed can be annoying. It's getting better as a lot of the more "prosumer" grade routers are supporting it. I use Sonos at home too, which means I had to deploy this into a VM to bridge the VLANs: https://github.com/alsmith/multicast-relay https://github.com/alsmith/multicast-relay. There are some funny (?) things that turn up too, like learning the Roku remote iOS app "discovers" devices by opening a TCP connection to every address in parallel on its local /24 (!!!). It sends out and receives mDNS packets that would tell it exactly where they are, but they are ignored by the app.
- candiddevmike 4y ago
  Assuming you have a linux machine connected to both networks, Avahi can reflect/forward mDNS multicast traffic, so you can have your chromecasts on a separate network and be discoverable by devices on a different one.
- 4y ago
dgroshev 4y ago
Some things I realised after going through my OpenWRT and later OPNsense phases: - complexity is fun to play with during the initial setup, but it sucks long term - VLANs and inter-VLAN firewalling is needlessly complex, brings endless frustration*, and you shouldn't trust the network to do your auth anyway - letting a vendor to do something is Actually Good - dashboards are useless, I can't recall ever using them for anything So I sold most of my networking gear and replaced it with - Aruba Instant On fanless PoE switch and a bunch of their APs - a £100 Topton fanless PC box with VyOS on it, powered with a PoE splitter - a UPS No VLANs, simple flat network. Everything internal is either on Tailscale or behind auth. Everything is PoE, things that don't are on PoE splitters, so no power bricks and everything is UPSed. Arubas require zero configuration and are managed through a cloud portal. The router needed to be configured once and required zero intervention for close to two years. It's ridiculously performant, perfectly balances load, and just works. *: I really have better things to do on a party than debugging firewalling an obscure protocol Airplay uses when my guest can't Airplay from their phone
- Wintereise 4y ago
  Amen to this. I've followed pretty much the exact same path as you (pfSense instead of OPN though) and reached the exact same conclusion. I have a sizeable networking background, but still absolutely hated having to keep up with this many moving parts. I very much didn't enjoy troubleshooting this setup. Dumb is good.
- zrail 4y ago
  That sounds like a really nice, simple setup. I have an unfortunate mix of gear from different vendors, but my setup is broadly similar. VyOS on an old SFF box, PoE whenever possible, etc. My physical topology means I need more layers of switches, though, and I do have a single vlan for my work machine. There's no inter-vlan routing there, just internet.
- ahepp 4y ago
  Is there something that puts VyOS in a separate class than openwrt/*sense? I really liked VyOS when I tried it out, but OpenWRT seems like _mostly_ the same thing. A bit less polished, but more likely to run on different vendor's hardware and let me unify the software without shelling out for a bunch of brand name gear. I tend to agree on the VLAN stuff. I don't feel like I've found a good reason to do that on my home network (yet, at least). Fanless gear is also great.
ralphael 4y ago
Anyone who uses Grafana to monitor their home setup, thats +1 from me. Appreciate the commitment and dedication to detail.
- bombcar 4y ago
  You'll love https://mods.factorio.com/mod/graftorio2 https://mods.factorio.com/mod/graftorio2
gbrindisi 4y ago
Loved this! I have just now started rebuilding the home network, this is great inspiration
Aloha 4y ago
This looks really super interesting! I'm gonna check out grafana, it looks significantly slicker than Cacti. I ended up with a significantly more complex home network than I ever expected - 2 48 Port HPE 1820's 1 24 Port PoE HPE 1820's All of these are linked with 2 1 GBE links in Port Channel TP-Link Managed Wifi AP's with controller (I wanted roaming support, and PoE support) Mikrotik HEx Router also linked in Port Channel to one of the core switches (I'd like to get multiple bonds set up, thats the intent, but I've had trouble making it play nice with rSTP - I think its an issue with my MikroTik Config, but its so poorly documented, its hard to say) For places where I have lots of port needs where I was unable to pull a ton of cable - 3 24 Port HPE 1810's (2 of these connect back to the Core Switches with port-channels) 1 8 Port HPE 1810 (PoE powered) The 1810/1820's are great, because they do not have cloud management, are fanless (PoE notwithstanding), and are easy to configure (no weird specific CLI to learn/no poorly implemented copy of Cisco IOS UI) via a web interface. Their lack of 10g support is annoying, but also worth the price savings. From a VLAN perspective, I have six - one for my external netblock (which is just a pass thru from the cable gateway), and another for my internal LAN, plus two additional VLAN's for my home work lab, and another two for 'utility' which is to say, I built them in, but have not found a use for them yet ;-) There is also a cacti server in a VM, I need to rebuilt it eventually so I have better instrumentation.
jaclaz 4y ago
>Wiring A word of warning, it must be said that you shouldn't have a "normal" data cable in the same conduit as mains. With CAT 6 cable you won't have transmission/interference problems, but still it is not allowed by code, unless the network cable is of the type insulated up to 400V, marked with "CEI-UNEL 36762 C-4 (U0=400V)", see (italian): https://fibra.click/cavi/#coesistenza-con-cavi-in-tensione https://fibra.click/cavi/#coesistenza-con-cavi-in-tensione https://www.cavel.it/it/supporto-tecnico/certificazioni/coesistenza-tra-cavi-per-telecomunicazioni-e-cavi-energia https://www.cavel.it/it/supporto-tecnico/certificazioni/coes...
- giuliomagnifico 4y ago
  Yes, I know and you're right but it's only a short path (about 2 meters), and it's the only way I found to get through the cable from a room to another. Anyway I haven't terminated the cable with the wall jack, the cable is going out of the wall "intact", this should be a bit safer.
  - NegativeLatency 4y ago
    Sounds like a good excuse to run a bit of fiber
  - jaclaz 4y ago
    Sure, and as said you won't likely have any issue, and maybe - without knowing - you actually used a U0=400V cable, the norm is 2010 or so if I recall correctly, so I believe that most Cat 6 cables in commerce are nowadays certified for that use.
    - giuliomagnifico 4y ago
      Just checked, and I see only EIA/TIA 568B.2 ISO/IEC 11801 EN501
  - kjs3 4y ago
    You might want to check if that out of code solution could invalidate your homeowners insurance policy. It sure can in the US.
skrtskrt 4y ago
how does someone learn the basics of "home lab" or small-scale server setup, particularly networking? I'm pretty familiar with managing compute & storage, but the networking is largely a mystery to me. I've read a bunch of CompTIA study materials but it was all very abstract
- ye-olde-sysrq 4y ago
  Tbh a lot of it can be as simple as: - get computers. laptops, desktops, raspberry pis, custom-built ("whitebox") servers, old dell poweredges you got off ebay, etc etc. Install linux on them. - plug servers into switches, switches into switches, and eventually into your router. Don't create cycles in your tree (unless you know your router/switches support it (STP), and unless you paid $1k for your switch, it doesn't support it) - Figure out your router config to assign them static/reserved DHCP IP addresses so they always get the same IP. - put those IPs in your hosts file. (optionally, set up a DNS server.) - ssh-copy-id your ssh key to all servers Now you have a bunch of machines you can ssh to. Which imo is the most basic definition of a homelab. Lots of people get super creative and use fancy routers and switches and enterprise gear and do complicated networking and etc etc etc but all that stuff is just good fun and not necessary.
- giuliomagnifico 4y ago
  Best thing I think is "do it", because when you need to fix an issue you learn new stuff, I have never done dedicated studies, also because each system has its own particularities, so you can learn the basic but then the names and operations may change a bit from one to another brand.
- ovi256 4y ago
  I think you would benefit from an "Introduction to Computer Networks" type class It will teach you what a switch and a router do, the difference between LANs and WANs, what DHCP and DNS do. The different ISO/OSI layers involve, TCP vs UDP. Then you'll be able to setup a home network without issues, because you'll know the different moving pieces and how they fit together. This is a textbook that's used in such classes https://intronetworks.cs.luc.edu/current2/html/ https://intronetworks.cs.luc.edu/current2/html/ From the syllabus, this Coursera class looks OK: https://www.coursera.org/learn/computer-networking https://www.coursera.org/learn/computer-networking
hesdeadjim 4y ago
I’d highly recommend a Ubiquity Dream Machine Pro if you have any advanced use cases. I’ve got mine VPN bridged to my office router and it’s been convenient to be able to force some devices at home to have all traffic routed over that link. PlayStation dev kits annoyingly require usage on a whitelisted static IP to activate (every 2 days) and access dev PSN environments. It would have been a huge PITA doing it any other way.
pantalaimon 4y ago
No IPv6?
zeagle 4y ago
I always enjoy reading about these but man that is a lot of work to set up even if maintenance is simple. Ubiquiti has lost trust but to their credit even a simple UDM base (that is not connected to the cloud) can do VLANs with another device running pihole/wireguard works great. You even could run the pihole on device with podman and use their baked in VPN.
- rrosen326 4y ago
  I'd like to plug Ubiquiti also. I'm not a networking guy and I just want my network to work. I don't want to worry about it or try to guess am I having problems due to Comcast or my home network setup. Switching to Ubiquiti, from high-end Asus gear, has been awesome. Everything just works. Networking is now a non-issue, and when my wife tells me the "internet isn't working", I can respond, "it's not my fault!" That's worth the cost to me.
  - neoromantique 4y ago
    +1 I heard some horror stories with new ubiquiti gear, but my ERPoE router has been serving me gbit and PoE for AP since 2016 and 0 issues, it even handles WireGuard using some hoops.
  - qu4z-2 4y ago
    While I will say that our Ubiquiti AP seems to work, configuring it was hell. It involved the management app installing its own nginx instance on my laptop, and then it makes a weird differentiation where if something's a guest network it asks what URL you want to redirect them to when they connect, but if it's not a guest network it doesn't have client isolation. (I eventually found the tickbox to enable it on a non-guest network, it had some weird Ubiquiti-specific name). It was just an ongoing series of problems. I've been meaning to give out different DNS servers via DHCP on the guest network vs the internal but I just can't face trying to configure that thing again. I'm glad you're happy with yours but replacing mine with Mikrotik kit is super high on my home-network todo list.
    - teslabox 4y ago
rejectfinite 4y ago
One thing to takeaway is that wired is so much better than wifi. At home I am just using the ISP router but I have my work laptop,desktop, consoles and TV wired with ethernet and it is amazing compared to wifi. No more dropouts, random ping spikes/lag etc. Just ISP router with 4 gigabit ports + one Netgear GS108 dumb gigabit switch.
ezfe 4y ago
Why is the 100 Mbps port an issue on a device that can never do more than a single video stream. Why should the TV manufacturer spend more money on that part?
- giuliomagnifico 4y ago
  First because a TV can last 10 years and have a 1000mbps port will be the minimum. Second because when you send “something” to the TV like 60mpx photos, using a 100mbps port is slower. Now a TV is also a home hub, not only a Television. And in the next years the 100mbps will be obsolete very fast.
  - bombcar 4y ago
    But if the internal storage of the TV (or the processor) can't handle above 100Mb/s it'll never practically matter. I've seen more devices that have a GB port and can't do anything useful with it than (I suspect) the other way around. That said, I've never even checked to see what speed my TV connects at.
    - wolrah 4y ago
      > But if the internal storage of the TV (or the processor) can't handle above 100Mb/s it'll never practically matter. UHD Blu-Rays already exceed 100mbit/sec. That is current commercially distributed consumer content that requires gigabit to stream properly over a network. Any 4K capable smart TV or streaming device should have a gigabit ethernet interface, no questions asked. 1080p devices, sure, they can get away with 100mbit just fine, but 4K devices have no excuse. The fact that LG still to this day ships OLED TVs with potentially five digit price tags and 100mbit ethernet ports is a level of cheapness that I can not fathom. And they handle gigabit just fine, you can plug a USB gigabit adapter in to the TV and it works entirely as expected.
    - qup 4y ago
      Also, there's like 12 people that care. It's an upgrade that will not move the revenue needle literally at all.
thrwawy74 4y ago
2 things come to mind here: 1) I don't trust devices to respect VLANs. I trust the switches to respect VLANs, but not devices. When the VLAN-tagged traffic hits WiFi the VLAN is lost. When it's received at the AP the AP can choose to tag it again before entering the switch. I think I'd still do multiple SSID's + VLAN's so wifi clients intended for different VLANs are not communicating on the same "virtual AP"? I worry my Google IOT devices could be in promiscuous mode looking at everything. Multiple SSID's would separate them from other devices by encryption. 2) I've read a couple articles saying rate-limiting IOT and Guest networks results in more service interruption than one would expect. Simply prioritizing the main network traffic over Guest & IOT is a better setup. How do we do this in OpenWRT?
- candiddevmike 4y ago
  RE: 1, you can push wifi clients to separate VLANs either by host or per SSID depending on the gear. It's enforced on the AP, clients can't breakout.
  - andix 4y ago
    By host is rather useless, because you can spoof hostnames and MAC addresses.
- giuliomagnifico 4y ago
  1) is safe to trust VLANs, especially for this home stuff… otherwise you will need separated LANs and cables! Overkilled. 2) I’m not rate limiting the IoT devices, I’m monitoring them and they make really few traffic, you can limit a device by MAC address in OpenWrt anyway: https://forum.openwrt.org/t/bandwidth-limit-per-ip-mac/35943 https://forum.openwrt.org/t/bandwidth-limit-per-ip-mac/35943
- justsomehnguy 4y ago
  > 1) This is not Area 51 and a client which doesn't respect VLAN tagging should somehow send packets to a different gateway IP. I don't see a way for a device to know where to send packets if it did break out from VLAN
shanebellone 4y ago
I love that you modified a piece of furniture. I plan to do something similar with a rolltop desk.
justinlloyd 4y ago
Not the way I went on my home network, but still a good write-up. Always like reading and seeing how people solve problems that go beyond "I bought a 42U rack and installed it in my basement." I'm going to steal the idea of the Raspberry Pi on the phone stand idea, especially when just hacking around with an SBC at my desk. I would recommend replacing all those USB power adapters with just one or two dedicated USB power adapters. Can recommend the six-port 60W model by Anker that will happily run all those devices you have, and then some.
- HeYmaney 4y ago
  > I'm going to steal the idea of the Raspberry Pi on the phone stand idea, especially when just hacking around with an SBC at my desk. Yeah me too! What model of stand is it tho? and how would you keep them attached? Looking at the pictures it seems different from one pi to another.
  - justinlloyd 4y ago
    Not sure, but my wife bought a number of stands that look very similar, made of 2mm metal with some rubber pads to protect the desk and the phone. Will probably put some heat shrink around the metal arms so that they don't inadvertently come in contact with the back side of an exposed SBC.
- giobox 4y ago
  You can add PoE (Power over Ethernet) to the Pi 4 or Pi 3B+ pretty cheaply (10-15 dollar hat), and avoid the USB power supply altogether. Not strictly necessary, but makes the wiring so much simpler/cleaner as just one single ethernet cable doing power and data, and you can expand into other neat PoE solutions. My Pi cluster is powered by my ethernet switch alone. It makes wiring a UPS into the system really easy too - just have backup power on the ethernet switch, the downstream Pis are taken care of. I'd love if the Pi 5 just has PoE out of the box personally, I run all my Pi projects this way now.
  - justinlloyd 4y ago
balls187 4y ago
What I find interesting and impressive 1) your photography 2) your HN account is ~3 years old, with 33k karma.
- giuliomagnifico 4y ago
  Ahah thanks…but I spent lots of time in writing this article =)
Topgamer7 4y ago
The link for a grafana chart full image doesn't work: https://giuliomagnifico.blog/_images/2023/home-network_v4/Screenshot%25202023-02-07%2520at%252011.03.51.jpg https://giuliomagnifico.blog/_images/2023/home-network_v4/Sc... vs https://giuliomagnifico.blog/_images/2023/home-network_v4/Screenshot%202023-02-07%20at%2011.03.51.jpg https://giuliomagnifico.blog/_images/2023/home-network_v4/Sc...
- giuliomagnifico 4y ago
  Fixed, thanks!
hnburnsy 4y ago
I use a separate router and old phone without a sim card to manage my IOT devices, got sick of Amazon continually scanning my network and adding my printers without asking. I know it happens but I hate that these devices probe my networks and report on what they find. Is there anyway to stop this discovery?
- artificialLimbs 4y ago
  Hardcode IPs and disable broadcast traffic. But really VLANs is the answer.
  - hnburnsy 4y ago
    Thank you, I wonder how many IOT devices support entering an IP address directly.
- discardedrefuse 4y ago
  > Is there anyway to stop this discovery? The correct way is to create VLANs. Then use the router's firewall to prevent devices in the IOT network from reaching into your other networks. Not all consumer network hardware supports VLANs though.
  - hnburnsy 4y ago
    Thanks I meant the discovery on the IOT LAN or VLAN.I don't need Amazon knowing that I have a Tesla charger
    - discardedrefuse 4y ago
      Gotcha. You can never tell how an IOT devices is scanning your network. It could be passively listening for broadcast messages, or it could be actively scanning all the private subnets. So, you probably need an access point that can do "client isolation" or "layer 2 isolation". This would prevent clients on the same wireless SSID from talking to each other. For example, looks like the Ubiquiti access points can do it. https://evanmccann.net/blog/2021/11/unifi-advanced-wi-fi-settings#fnr4 https://evanmccann.net/blog/2021/11/unifi-advanced-wi-fi-set...
m463 4y ago
My home network has a few differences that might be interesting: I run openwrt on some mikrotik switches. I started with a mikrotik rb750 switch, then switched to rb2011 switches (5x 10/100/1000 + 5x 10/100 ports), and now two rb3011uias-rm 10-port gbit switches. the openwrt rb3011 build comes from https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 I also run openwrt on a turris omnia and a linksys wrt1900acs. I use raspberry pis for a few things, notably standalone ntp time via a few cheap usb gps dongles. One pi does time exclusively and runs openwrt with a gps hat with pps + a pi ups hat. I like the flirc pi cases - they are cheap, beefy and have great thermals.
- imiric 4y ago
  Why do you prefer OpenWrt over RouterOS on the Mikrotik switches? I recently upgraded to a CRS326-24S+2Q+RM, and the experience with RouterOS feels much better compared to OpenWrt. Winbox is super polished, everything is well laid out, and it makes even advanced configuration very easy. I do run OpenWrt on a few APs, and it works fine for that simple use case, but for anything more advanced, I prefer RouterOS. Sure, it's not open source, and not as extensible to allow you to run a bunch of services on it, but those can run on any other server just as well.
  - simplyaccont 4y ago
    last time i checked, CRS3xx not really supported by openwrt.
    - imiric 4y ago
      My point is that the experience of RouterOS is much better than OpenWrt, so I'm curious why someone would choose to run OpenWrt on Mikrotik switches.
      - simplyaccont 4y ago
        on switches - no point. extra no points because openwrt won't support configuring HW features. On the other side I wanted to run OpenWrt on Mikrotik AP, because my other APs at home run it. ALso there is a much bigger selection of 3rd party packages for OpenWrt than for Mikrotik. I guess it will be main point for many people
kccqzy 4y ago
I'll just say one thing regarding my own home network setup: go IPv6 only. Ditch IPv4, except for the necessary evil that is NAT64/DNS64. I refuse to network any device that does not support IPv6, and I refuse to use any app that chooses not to use the IPv6 addresses present.
- npteljes 4y ago
  Why do you do this? Principle, or does it have an actual advantage?
  - kccqzy 4y ago
    Mostly principle. The internet is designed for end-to-end connectivity; let's strive for a more decentralized internet by giving big cloud and residential users equal access by removing NAT. As for actual advantage, I can think of reduced configuration burden since you don't have to maintain two sets of firewall configs for dual-stack hosts. It's a small advantage only. On the other hand, I'll be honest with you, there are disadvantages. As recently as 2021, people are still discovering problems on IPv6-only networks that necessitate writing new RFCs to mandate new behavior. Yes I'm talking about https://www.rfc-editor.org/rfc/rfc9131.html https://www.rfc-editor.org/rfc/rfc9131.html It's because of the low prevalence of IPv6-only networks that changes as fundamental as Neighbor Discovery have to be proposed in this decade.
    - npteljes 4y ago
      I think that's a nice framing for the issue! IPv6 adoption is really slow, considering that I've been hearing about the necessity for what seems like two decades now.
- manv1 4y ago
  Yes, because I want my internal home devices publicly accessible by default. Seriously, the global addressability of ipv6 is something that people used to using ipv4/NAT tend to forget. I know a bunch of people (well, two) that make a living scanning for IPv6 addresses inside networks that the admins didn't realize were open to the world.
renox 4y ago
I wonder why noone is talking about the 'bufferbloat' issue, is-it a solved issue now? Can I pick any router to plug into my ISP router?
- richbhanover 4y ago
  The name "bufferbloat" is falling out of favor. First off, it has a horrible sound... And it doesn't really give an intuitive sense of what's wrong. Referring to "latency" or (my favorite) "responsiveness" is better. And I was encouraged to see this recent ZDNet article that mentioned the "ping rates" of 600-1000 msec, and notes that these would cause videoconferencing or gaming to be unusable. https://www.zdnet.com/home-and-office/networking/i-tried-deltas-new-free-inflight-wi-fi-heres-how-fast-it-was/ https://www.zdnet.com/home-and-office/networking/i-tried-del... And as @giuliomagnifico points out, you can fix it yourself if you get the right router.
- giuliomagnifico 4y ago
  It’s a solved issue if you’re using the right hardware for your isp connection.
  - culopatin 4y ago
    What does this mean? How can I check if I have the right hardware?
    - giuliomagnifico 4y ago
      Depending on the speed of your ISP connection, the faster is the connection, the powerful should be the router
blep_ 4y ago
I've been waiting for a good time to ask this oddly specific question: why does everyone number VLANs 10, 20, 30, etc. instead of 1, 2, 3?
- icelancer 4y ago
  At least in our case, this allows this space: 172.16.0.1 to 172.16.9.255 To be available for non-VLAN DHCP, static leases, and internal devices. Not sure if that's why others do it this way, but it made sense for us.
- blowski 4y ago
  Originally, so you could group related VLANs together. e.g. VLAN30 is Marketing, then later you need a second marketing team so they have VLAN31. If you’d had VLAN1, 2, 3, etc, you couldn’t do this. That everyone does it - even on small home networks - is just convention.
- viraptor 4y ago
  Same reason as assigning larger networks than you need or leaving free spaces between them. You may want to put some things close to each other because they logically go together. But some things that go together don't exist yet, so let's reserve the space. (Can't speak for everyone of course, but that's why I'd use 10.0.10.0/24, then 10.0.20.0/24, etc. Now "same kind of thing next to it" can have 10.0.11.0/24)
- giuliomagnifico 4y ago
  Because VLAN 1 is the default used by lots of vendors, and sometimes also 2, so using 10 and 20 is easy to remember that is a VLAN and you can leave some static IP free also. Also because is not like DHCP addresses that are 1-255 but VLANs are 1-4096 so you can use some easy numbers to remember. For example I’m using VLAN 50 for IoT because the Homebridge server has 192.168.1.5 IP, so IoT is VLAN 50 with 192.168.50.0/24. Some can argue that using VLAN 1 is also a bit less safe because it’s the default VLAN and attackers usually scan for it like 192.168.1.1 IP for modem/WAN.
- briHass 4y ago
  On some devices (e.g. CISCO), ID 1 is reserved, so starting at powers of 10 keeps it nice and even and allows for insertions (same logic as line-numbering in BASIC.) I assume 10 seems better than 100 (or even 1000); those just seem crazy high.
andix 4y ago
Is there a good reason to use VLANs? I’ve never really seen the need for it. It’s good practice to secure all your services even in a home network. And in the end you have access to all the services anyway at some point. Also why 3 raspberrys, instead of one with a few containers on them? Especially the 4s draw quite some power, just from a power saving perspective I would only run one.
- gerdesj 4y ago
  Yes there is (VLANs) and that's why they've been a thing for quite a while. Securing stuff might mean things like firewalls. When you are defining firewall rules you need to define where FROM where TO and WHAT and ACTION. This is what out of the box TCP/IP gives us. It can be rather more complicated but we are discussing VLANs. You might have PCs, servers, TVs, printers, cameras and more on your network. You might want some of thos to access the internet and some not. Some from the internet and some not. Anyway - policy - what should be able to get from A -> B. VLANs allow you more flexibility. You can now have lots of different TOs and FROMs. So you can put your security cameras on a VLAN with no access to the internet. You can still access them but they cannot splurge to the wider world. Three RPis? Perhaps. Depends on the job. I'd probably throw another VM on the fire. (EDIT - grammar)
  - andix 4y ago
    I get that. I know what you can do with VLANs. But why do you need it in your home? Do you really cut off your printer in a VLAN and do some specific routing/filtering? I know how to do that, but I just don't see the benefit. If you want to cut off one device from the internet, my solution would be to set a specific DHCP rule to not deliver a gateway/dns. Easy and good enough to cut off a printer from the internet. My home does not need the same network security as a nuclear power plant...
  - herpderperator 4y ago
    Your point is more about subnets and less about VLANs. You can have firewall rules that restrict entire subnets from access the Internet; you don't have to define a rule for each device. VLANs just give you assurance that a device can't just change its subnet to your main one and gain access that way. Realistically, there wouldn't be any IoT device that would do this. But I agree if you can do VLANs, you should do them over basic subnets.
ahepp 4y ago
Wow! I'm excited to hear someone has the WAX206 running openWRT. I've been trying to get more of my networking gear running that, but since the WAX206 isn't officially supported I hadn't looked into things further. How much of a pain was it to compile? The post doesn't seem to describe any changes made (understandable, most people probably don't care) but there must be some changes if you had to compile it yourself, right?
- giuliomagnifico 4y ago
  It’s easy, you just have to clone the fork with the support and then select the packages and compile it. The fork is this: https://github.com/boretom/openwrt-fork/tree/wax206/flashable-1Gbit https://github.com/boretom/openwrt-fork/tree/wax206/flashabl... If you want I can send you my image.
  - ahepp 4y ago
    I will try building it, since I also want to get some experience for making it run on my Mikrotik RB5009. But if I run into issues I may take you up on that offer! :) Thanks!
    - giuliomagnifico 4y ago
      Yeah correct, try before is the right way!
tw1984 4y ago
nice setup! I spent weeks searching for a 10G switch that can support the IEEE 1588v2 PTP Transparent Clock (TC) mode but couldn't find anyone that can fit into my budget ($1-2k USD new or <$1k for used). Anyone has such switch to recommend?
jbverschoor 4y ago
What about the tv? It’s on your main net, but guests sometimes would like to connect for for example some streaming. Also, Plex should be on the tv network, but accessible (Uni directional) from the main net
- giuliomagnifico 4y ago
  At the moment I don’t want the guests be able to stream on my tv, I don’t use Plex. I use AirPlay to send video to my tv.
besnn00 4y ago
I love that it looks so rustic.
nly 4y ago
I'm looking for the fastest possible switch for 6-8 cat6 lines. Anyone know of any affordable options (preferably in the UK)?

drio 4y ago

Thank you for posting, very informative. Some random comments: I use a Mikrotik router and I have a dedicated network for devices I don’t want to access my main network. They can only access my MQTT server. RouterOS (mikrotik OS) is a bit terse and comes with its own cli interface. I managed to modify the default setup relatively easily via the UI to create the two networks I needed. In the future I may install openWRT but at the moment the current setup works well. Another think that I did recently that was quite impactful (performance wise) was to add a Omaha controller to make my two access poins work together to expose one single wifi network. Before I had them working on their own. The performance of the network has increased substantially. I’d prefer not having to buy a piece of hardware to do that but I am glad I did. I recently bought a ds720 from Synology. I upgraded the RAM to 6gb. So far I use it to dump my personal backup (restic). Also my Reolink cameras dump video via FTP. Because the ds720 runs linux and docker I am planning on consolidating a few services in the ds720 (home assistant, grafana and Pinole). Oh, I also got a UPS system for the main components that provide Internet access. I can be without power and have Internet for 2 hours a half. One thing I want to do is to get an alert when the power goes down. The UPS exposes that via USB.

justusthane 4y ago

Very neat - thank you for documenting this, especially the piece about using Avahi to place the HomePods on a different VLAN. This is something I'm planning to do but hadn't looked into yet, so this will save me a lot of effort. Just out of curiosity, that's the black box in your cabinet balancing on the metal cones?

gertrunde 4y ago
Going from the earlier instalments (v1/2/3) - I suspect it's the ISP modem. (And I'm guessing the metal cones are there to lift it off the flat surface for more airflow).
- giuliomagnifico 4y ago
  Exactly, the metal cones are 3 unused audiophile spikes. Perfect fit inside the holes of the bottom of the modem.
- blitzar 4y ago
  V1/2/3 are pretty handy for figuring out the other stuff too.
blitzar 4y ago
ISP Modem?
giuliomagnifico 4y ago
Thanks! >Very neat - thank you for documenting this, especially the piece about using Avahi to place the HomePods on a different VLAN. This is something I'm planning to do but hadn't looked into yet, so this will save me a lot of effort. Yes, it's very easy if you use Avahi, but it's important that you're using VLANs and not subnets, because I had lots of troubles using a separate subnets for iot devices and the HomePod in the main subnet. You have to add a route on the router and tweaks the firewall. Using vlans instead is easier and faster. >Just out of curiosity, that's the black box in your cabinet balancing on the metal cones? Italian ISP modem "unfortunately". If you see the network scheme you can understand better: https://giuliomagnifico.blog/_images/2023/home-network_v4/Rete%20casa.png https://giuliomagnifico.blog/_images/2023/home-network_v4/Re...
syntaxing 4y ago
Wait, does this work with HomePod minis? My current mDNS works with my network, my issue is the HomePod mini automatically jumps back to the same wifi as my phone.
- giuliomagnifico 4y ago
  Yes absolutely, but your iPhone and the HomePod should be on the same/main vlan, not the HomePod on the IoT vlan.

twawaaay 4y ago

I don't have pictures but I can describe it. * Broadband 600/60Mb/s with seamless failover to 5G (varying speeds) * Netgate 6100 router with VPN client, VPN server, site to site VPN configured, traffic shaping to reduce bufferbloat, uplink failover, etc. * 4 Cisco SG 250-8 switches sprinkled throughout the flat. One acting as my core switch. * QNap with 2 4TB drives in mirror for backups * A HDD USB station with a stack of 4TB HDDs for backups. Backups are delivered to qnap at various times and then from time to time I make a complete copy to a drive which is put in a rotation. I keep three full copies of the data at any time and at least one of them is off-site with my family. When I visit my family I take the latest backup and replace the drive that is in their custody. * a small, passively cooled server with 2TB fast SSD, 128GB ECC RAM, Ryzen 5 CPU, Asrock PRO X570D4U-2L2T. Hosts proxmox where I keep about a dozen VMs for various things, Ubiquiti management panel, NVR, dns filter, development tools, minecraft servers, jump box, etc.... * a 10 year old Thinkpad T440s running always on serving as my emergency server and a development environment. * 4 Ubiquiti WiFi 6 access points -- before you jump in saying this is overkill, I live in a large flat in a dense urban area with about half a thousand 2.4GHz APs and 50 5GHz ones interfering with my WiFi setup. Most people and even network providers are clueless and set up their devices to max power as if it was going to help them -- it only makes things worse. I have 4 APs with reduced power so that anywhere you are at my flat you are always close to one of APs and you roam between them seamlessly as you move. * Multiple VLANS and WiFi networks * a VLAN + WLAN for my family for their regular devices to access the Internet and some defined services within network but otherwise disallowed to contact anything else * a VLAN + WLAN for IOT, legacy devices, devices I don't trust or devices that only support old protocols and would deteriorate WLAN performance (printers, a chinese projector, etc.) This VLAN does not have Internet access (so that devices can't phone home), don't have access to any other device in the network, don't have access to other networks and can only be reached with defined firewall rules. * a VLAN + WLAN for my work -- this is dedicated for my work laptop, my phone, my electronics lab (oscilloscope, multimeter, programmable PSU/load, etc.) * a VLAN + WLAN for guests * a management VLAN -- any network devices, servers, QNAP etc. are only available through this separated VLAN which has very strict access through a jump box. Also does not have direct internet access so the devices can't phone somewhere else (but I have a proxy for software updates, etc.) * a service VLAN -- where my services are available internally (for example QNAP interface, apps running in VMs, etc.) Some of them have rules to be accessed from other networks * a DMZ VLAN -- I expose some services to the world, DMZ serves to provide one more hurdle for any attacker

cabirum 4y ago

My unnecessarily convoluted home setup that takes too much space - ftfy.

bluedino 4y ago
Agreed, but it's neat. Every time I try setting my home network up like that (smart firewall, traffic graphs, etc), I just end up going back to a $30 router/AP.
- fishtacos 4y ago
  Had a similarly convoluted network for some years... over time you realize it's just pointless to waste time maintaining and troubleshooting said setup. Today it's ISP router + separate AP (better coverage). Chinese hackers aren't attacking my network, and if they did, cool, have at it. Basic firewall + NAT + AV covers 99% of use cases, even in a business, with the right configuration. Turns out I don't miss pfSense either. Makes sense for keeping skills up to date, though, and as a hobby, I can see how one can get into it. Reddit's r/homelab has some crazy builds to check out.
  - deleted 4y ago
    [deleted]
  - bityard 4y ago
    I essentially have a foot in both camps... I like having the control and autonomy of open-source networking hardware but I don't have enough spare time to make it a full-on hobby. Right now my "happy spot" is: 1. An OPNSense firewall between my cable modem and the rest of the network running on a low-power PC Engines APU2. The web-based UI is funky but workable, full SSH access to the box for digging into the internals when needed, online upgrades are a cinch. 2. An 8-port gigabit unmanaged switch that everything hangs off of. 3. A Netgear WAX218 business-grade access point for wifi, running the stock firmware. Web UI is decent and doesn't require any cloud-based management bullshit. For around $100, it works much better than it has any right to, given the prices of mid-range APs and wifi routers these days. 4. A small fleet of Raspberry Pis for miscellaneous tasks. If I get more into IoT, it shouldn't be much of a hassle to add VLANs and maybe another switch.

aliljet 4y ago

Very curious, what if you had a 10gbe symmetric connection from your ISP? How would you modify your deployment?

giuliomagnifico 4y ago
...well I think it takes a long time before we will have 10Gbe in Italy (we still don't have 5Gbe), anyway I'll use only another router and switch, with 10gb ports, but the issue in this case will always be the wifi antenna of the (i)Devices that are still below 1Gbps, so the AP will not need a swap at the moment.
- afmotta 4y ago
  There is at least one provider offering 10Gbe in Italy (in download - 2.5 in up): https://www.dimensione.com/portale/fibra-internet-10-giga.php https://www.dimensione.com/portale/fibra-internet-10-giga.ph.... There may be more that I don't know of.
  - giuliomagnifico 4y ago
    Yes but there’s no real coverage, just few houses in the center of Milano or Torino. Where I live isn’t available.
    - afmotta 4y ago
      Yes, even if I live in Milan, my house is not covered. Though it's nice to see things are starting to move in the right direction.

xattt 4y ago

Are there any server rack mounted patch panels that let you choose to use a certain network drop for POTS or for Ethernet? I’ve seen similar patch panels for structured wiring, but not for server racks.

giuliomagnifico 4y ago
With the 19" front rack mount I have never seen one.
zrail 4y ago
Get a 19" keystone panel and then you can do whatever you want. There are keystones available for Ethernet, coax, rj11 POTS, hdmi, fiber, basically anything.

fy20 4y ago

Can someone recommend a budget WiFi access point with long range? I only have LTE as the backhaul, so the fastest speeds are not a requirement. I bought a EAP610 which I saw recommended on Reddit, but the range seems worse than the ISP modem's (something Huawei) built in WiFi.

neurostimulant 4y ago
Buy two Asus RT-AX56U, install Merlin on it, then join them using the built-in wired (or wireless) mesh feature to cover large area on the cheap.
KaiserPro 4y ago
for a normal AP, then I'd get a second hand ubiquity LR off ebay.
thakoppno 4y ago
My advice is tangential but run an ethernet cable. Access points aren’t great at long distance. Setup an AP in the far away room on the other side of the house. It will be far less frustrating.
bityard 4y ago
I bought a Netgear WAX218 a few months back for around $100... but a quick look around shows that either the price has gone up significantly or they're not making them anymore? Well, if you manage to find one for a decent price, I highly recommend it.
duxup 4y ago
I am a big fan of Netgear’s Orbi line. Really I think distance is more of a relative/ location issue and a mesh system that allows you to move the satellite endpoints around to suit your needs is very useful to figure out the optimal situation for a given environment. https://www.netgear.com/home/wifi/mesh/orbi/ https://www.netgear.com/home/wifi/mesh/orbi/

KaiserPro 4y ago

My setup is pretty similar in schematic, but not finess of design. I have a 24 port netgear fanless smart switch as the backbone. I did have a POE version but the fans were too loud. I have a PoE injector now which allows me to power the APs and the phones for the house intercom. I use pfsense for routing and firewall. Ubuquity for APs. I have four, one for upstairs, one for down, one in the garden and one in the shed. three are second hand. I have a VLAN for work, (I can ssh in from the normal vlans, but I can't get out from the work VLAN) A have a VLAN for CCTV, normal use, servers/services, and one for IoT. Seems to work ok for my needs, but most people don't need what I want on a network.

Thaxll 4y ago

Is it working fine to have IOT on a different vlan, lot of IOT use weird protocol ( mdns, multicast etc ... ) that are not friendly with vlan? I know that some people have issues for example with the Chromecast being seperated since it needs internet but also be able to communicate with your phone on a different vlan.

chomp 4y ago
Yeah, avahi will help you out quite a bit there, but I personally pick my IOT devices to where they will not have requirements like that. I'm pretty #nocloud with anything I put in my home, so the majority of IOT devices I have go on the null routed VLAN and are perfectly happy.
syntaxing 4y ago
My IoT VLAN is one way only (main VLAN can talk to it, and it can talk back BUT it cannot talk to any other VLAN on its own accord). No issues with mDNS or multicast. I redirect all DNS request as well to nextDNS with masquerading. I have probably 30 devices on it? Zero issues with home assistant and HomeKit
rbranson 4y ago
IoT VLAN indeed can be annoying. It's getting better as a lot of the more "prosumer" grade routers are supporting it. I use Sonos at home too, which means I had to deploy this into a VM to bridge the VLANs: https://github.com/alsmith/multicast-relay https://github.com/alsmith/multicast-relay. There are some funny (?) things that turn up too, like learning the Roku remote iOS app "discovers" devices by opening a TCP connection to every address in parallel on its local /24 (!!!). It sends out and receives mDNS packets that would tell it exactly where they are, but they are ignored by the app.
candiddevmike 4y ago
Assuming you have a linux machine connected to both networks, Avahi can reflect/forward mDNS multicast traffic, so you can have your chromecasts on a separate network and be discoverable by devices on a different one.
4y ago

dgroshev 4y ago

Some things I realised after going through my OpenWRT and later OPNsense phases: - complexity is fun to play with during the initial setup, but it sucks long term - VLANs and inter-VLAN firewalling is needlessly complex, brings endless frustration*, and you shouldn't trust the network to do your auth anyway - letting a vendor to do something is Actually Good - dashboards are useless, I can't recall ever using them for anything So I sold most of my networking gear and replaced it with - Aruba Instant On fanless PoE switch and a bunch of their APs - a £100 Topton fanless PC box with VyOS on it, powered with a PoE splitter - a UPS No VLANs, simple flat network. Everything internal is either on Tailscale or behind auth. Everything is PoE, things that don't are on PoE splitters, so no power bricks and everything is UPSed. Arubas require zero configuration and are managed through a cloud portal. The router needed to be configured once and required zero intervention for close to two years. It's ridiculously performant, perfectly balances load, and just works. *: I really have better things to do on a party than debugging firewalling an obscure protocol Airplay uses when my guest can't Airplay from their phone

Wintereise 4y ago
Amen to this. I've followed pretty much the exact same path as you (pfSense instead of OPN though) and reached the exact same conclusion. I have a sizeable networking background, but still absolutely hated having to keep up with this many moving parts. I very much didn't enjoy troubleshooting this setup. Dumb is good.
zrail 4y ago
That sounds like a really nice, simple setup. I have an unfortunate mix of gear from different vendors, but my setup is broadly similar. VyOS on an old SFF box, PoE whenever possible, etc. My physical topology means I need more layers of switches, though, and I do have a single vlan for my work machine. There's no inter-vlan routing there, just internet.
ahepp 4y ago
Is there something that puts VyOS in a separate class than openwrt/*sense? I really liked VyOS when I tried it out, but OpenWRT seems like _mostly_ the same thing. A bit less polished, but more likely to run on different vendor's hardware and let me unify the software without shelling out for a bunch of brand name gear. I tend to agree on the VLAN stuff. I don't feel like I've found a good reason to do that on my home network (yet, at least). Fanless gear is also great.

ralphael 4y ago

Anyone who uses Grafana to monitor their home setup, thats +1 from me. Appreciate the commitment and dedication to detail.

bombcar 4y ago
You'll love https://mods.factorio.com/mod/graftorio2 https://mods.factorio.com/mod/graftorio2

gbrindisi 4y ago

Loved this! I have just now started rebuilding the home network, this is great inspiration

Aloha 4y ago

This looks really super interesting! I'm gonna check out grafana, it looks significantly slicker than Cacti. I ended up with a significantly more complex home network than I ever expected - 2 48 Port HPE 1820's 1 24 Port PoE HPE 1820's All of these are linked with 2 1 GBE links in Port Channel TP-Link Managed Wifi AP's with controller (I wanted roaming support, and PoE support) Mikrotik HEx Router also linked in Port Channel to one of the core switches (I'd like to get multiple bonds set up, thats the intent, but I've had trouble making it play nice with rSTP - I think its an issue with my MikroTik Config, but its so poorly documented, its hard to say) For places where I have lots of port needs where I was unable to pull a ton of cable - 3 24 Port HPE 1810's (2 of these connect back to the Core Switches with port-channels) 1 8 Port HPE 1810 (PoE powered) The 1810/1820's are great, because they do not have cloud management, are fanless (PoE notwithstanding), and are easy to configure (no weird specific CLI to learn/no poorly implemented copy of Cisco IOS UI) via a web interface. Their lack of 10g support is annoying, but also worth the price savings. From a VLAN perspective, I have six - one for my external netblock (which is just a pass thru from the cable gateway), and another for my internal LAN, plus two additional VLAN's for my home work lab, and another two for 'utility' which is to say, I built them in, but have not found a use for them yet ;-) There is also a cacti server in a VM, I need to rebuilt it eventually so I have better instrumentation.

jaclaz 4y ago

>Wiring A word of warning, it must be said that you shouldn't have a "normal" data cable in the same conduit as mains. With CAT 6 cable you won't have transmission/interference problems, but still it is not allowed by code, unless the network cable is of the type insulated up to 400V, marked with "CEI-UNEL 36762 C-4 (U0=400V)", see (italian): https://fibra.click/cavi/#coesistenza-con-cavi-in-tensione https://fibra.click/cavi/#coesistenza-con-cavi-in-tensione https://www.cavel.it/it/supporto-tecnico/certificazioni/coesistenza-tra-cavi-per-telecomunicazioni-e-cavi-energia https://www.cavel.it/it/supporto-tecnico/certificazioni/coes...

giuliomagnifico 4y ago
Yes, I know and you're right but it's only a short path (about 2 meters), and it's the only way I found to get through the cable from a room to another. Anyway I haven't terminated the cable with the wall jack, the cable is going out of the wall "intact", this should be a bit safer.
- NegativeLatency 4y ago
  Sounds like a good excuse to run a bit of fiber
- jaclaz 4y ago
  Sure, and as said you won't likely have any issue, and maybe - without knowing - you actually used a U0=400V cable, the norm is 2010 or so if I recall correctly, so I believe that most Cat 6 cables in commerce are nowadays certified for that use.
  - giuliomagnifico 4y ago
    Just checked, and I see only EIA/TIA 568B.2 ISO/IEC 11801 EN501
- kjs3 4y ago
  You might want to check if that out of code solution could invalidate your homeowners insurance policy. It sure can in the US.

skrtskrt 4y ago

how does someone learn the basics of "home lab" or small-scale server setup, particularly networking? I'm pretty familiar with managing compute & storage, but the networking is largely a mystery to me. I've read a bunch of CompTIA study materials but it was all very abstract

ye-olde-sysrq 4y ago
Tbh a lot of it can be as simple as: - get computers. laptops, desktops, raspberry pis, custom-built ("whitebox") servers, old dell poweredges you got off ebay, etc etc. Install linux on them. - plug servers into switches, switches into switches, and eventually into your router. Don't create cycles in your tree (unless you know your router/switches support it (STP), and unless you paid $1k for your switch, it doesn't support it) - Figure out your router config to assign them static/reserved DHCP IP addresses so they always get the same IP. - put those IPs in your hosts file. (optionally, set up a DNS server.) - ssh-copy-id your ssh key to all servers Now you have a bunch of machines you can ssh to. Which imo is the most basic definition of a homelab. Lots of people get super creative and use fancy routers and switches and enterprise gear and do complicated networking and etc etc etc but all that stuff is just good fun and not necessary.
giuliomagnifico 4y ago
Best thing I think is "do it", because when you need to fix an issue you learn new stuff, I have never done dedicated studies, also because each system has its own particularities, so you can learn the basic but then the names and operations may change a bit from one to another brand.
ovi256 4y ago
I think you would benefit from an "Introduction to Computer Networks" type class It will teach you what a switch and a router do, the difference between LANs and WANs, what DHCP and DNS do. The different ISO/OSI layers involve, TCP vs UDP. Then you'll be able to setup a home network without issues, because you'll know the different moving pieces and how they fit together. This is a textbook that's used in such classes https://intronetworks.cs.luc.edu/current2/html/ https://intronetworks.cs.luc.edu/current2/html/ From the syllabus, this Coursera class looks OK: https://www.coursera.org/learn/computer-networking https://www.coursera.org/learn/computer-networking

hesdeadjim 4y ago

I’d highly recommend a Ubiquity Dream Machine Pro if you have any advanced use cases. I’ve got mine VPN bridged to my office router and it’s been convenient to be able to force some devices at home to have all traffic routed over that link. PlayStation dev kits annoyingly require usage on a whitelisted static IP to activate (every 2 days) and access dev PSN environments. It would have been a huge PITA doing it any other way.

pantalaimon 4y ago

No IPv6?

zeagle 4y ago

I always enjoy reading about these but man that is a lot of work to set up even if maintenance is simple. Ubiquiti has lost trust but to their credit even a simple UDM base (that is not connected to the cloud) can do VLANs with another device running pihole/wireguard works great. You even could run the pihole on device with podman and use their baked in VPN.

rrosen326 4y ago
I'd like to plug Ubiquiti also. I'm not a networking guy and I just want my network to work. I don't want to worry about it or try to guess am I having problems due to Comcast or my home network setup. Switching to Ubiquiti, from high-end Asus gear, has been awesome. Everything just works. Networking is now a non-issue, and when my wife tells me the "internet isn't working", I can respond, "it's not my fault!" That's worth the cost to me.
- neoromantique 4y ago
  +1 I heard some horror stories with new ubiquiti gear, but my ERPoE router has been serving me gbit and PoE for AP since 2016 and 0 issues, it even handles WireGuard using some hoops.
- qu4z-2 4y ago
  While I will say that our Ubiquiti AP seems to work, configuring it was hell. It involved the management app installing its own nginx instance on my laptop, and then it makes a weird differentiation where if something's a guest network it asks what URL you want to redirect them to when they connect, but if it's not a guest network it doesn't have client isolation. (I eventually found the tickbox to enable it on a non-guest network, it had some weird Ubiquiti-specific name). It was just an ongoing series of problems. I've been meaning to give out different DNS servers via DHCP on the guest network vs the internal but I just can't face trying to configure that thing again. I'm glad you're happy with yours but replacing mine with Mikrotik kit is super high on my home-network todo list.
  - teslabox 4y ago

rejectfinite 4y ago

One thing to takeaway is that wired is so much better than wifi. At home I am just using the ISP router but I have my work laptop,desktop, consoles and TV wired with ethernet and it is amazing compared to wifi. No more dropouts, random ping spikes/lag etc. Just ISP router with 4 gigabit ports + one Netgear GS108 dumb gigabit switch.

ezfe 4y ago

Why is the 100 Mbps port an issue on a device that can never do more than a single video stream. Why should the TV manufacturer spend more money on that part?

giuliomagnifico 4y ago
First because a TV can last 10 years and have a 1000mbps port will be the minimum. Second because when you send “something” to the TV like 60mpx photos, using a 100mbps port is slower. Now a TV is also a home hub, not only a Television. And in the next years the 100mbps will be obsolete very fast.
- bombcar 4y ago
  But if the internal storage of the TV (or the processor) can't handle above 100Mb/s it'll never practically matter. I've seen more devices that have a GB port and can't do anything useful with it than (I suspect) the other way around. That said, I've never even checked to see what speed my TV connects at.
  - wolrah 4y ago
    > But if the internal storage of the TV (or the processor) can't handle above 100Mb/s it'll never practically matter. UHD Blu-Rays already exceed 100mbit/sec. That is current commercially distributed consumer content that requires gigabit to stream properly over a network. Any 4K capable smart TV or streaming device should have a gigabit ethernet interface, no questions asked. 1080p devices, sure, they can get away with 100mbit just fine, but 4K devices have no excuse. The fact that LG still to this day ships OLED TVs with potentially five digit price tags and 100mbit ethernet ports is a level of cheapness that I can not fathom. And they handle gigabit just fine, you can plug a USB gigabit adapter in to the TV and it works entirely as expected.
  - qup 4y ago
    Also, there's like 12 people that care. It's an upgrade that will not move the revenue needle literally at all.

thrwawy74 4y ago

2 things come to mind here: 1) I don't trust devices to respect VLANs. I trust the switches to respect VLANs, but not devices. When the VLAN-tagged traffic hits WiFi the VLAN is lost. When it's received at the AP the AP can choose to tag it again before entering the switch. I think I'd still do multiple SSID's + VLAN's so wifi clients intended for different VLANs are not communicating on the same "virtual AP"? I worry my Google IOT devices could be in promiscuous mode looking at everything. Multiple SSID's would separate them from other devices by encryption. 2) I've read a couple articles saying rate-limiting IOT and Guest networks results in more service interruption than one would expect. Simply prioritizing the main network traffic over Guest & IOT is a better setup. How do we do this in OpenWRT?

candiddevmike 4y ago
RE: 1, you can push wifi clients to separate VLANs either by host or per SSID depending on the gear. It's enforced on the AP, clients can't breakout.
- andix 4y ago
  By host is rather useless, because you can spoof hostnames and MAC addresses.
giuliomagnifico 4y ago
1) is safe to trust VLANs, especially for this home stuff… otherwise you will need separated LANs and cables! Overkilled. 2) I’m not rate limiting the IoT devices, I’m monitoring them and they make really few traffic, you can limit a device by MAC address in OpenWrt anyway: https://forum.openwrt.org/t/bandwidth-limit-per-ip-mac/35943 https://forum.openwrt.org/t/bandwidth-limit-per-ip-mac/35943
justsomehnguy 4y ago
> 1) This is not Area 51 and a client which doesn't respect VLAN tagging should somehow send packets to a different gateway IP. I don't see a way for a device to know where to send packets if it did break out from VLAN

shanebellone 4y ago

I love that you modified a piece of furniture. I plan to do something similar with a rolltop desk.

justinlloyd 4y ago

Not the way I went on my home network, but still a good write-up. Always like reading and seeing how people solve problems that go beyond "I bought a 42U rack and installed it in my basement." I'm going to steal the idea of the Raspberry Pi on the phone stand idea, especially when just hacking around with an SBC at my desk. I would recommend replacing all those USB power adapters with just one or two dedicated USB power adapters. Can recommend the six-port 60W model by Anker that will happily run all those devices you have, and then some.

HeYmaney 4y ago
> I'm going to steal the idea of the Raspberry Pi on the phone stand idea, especially when just hacking around with an SBC at my desk. Yeah me too! What model of stand is it tho? and how would you keep them attached? Looking at the pictures it seems different from one pi to another.
- justinlloyd 4y ago
  Not sure, but my wife bought a number of stands that look very similar, made of 2mm metal with some rubber pads to protect the desk and the phone. Will probably put some heat shrink around the metal arms so that they don't inadvertently come in contact with the back side of an exposed SBC.
giobox 4y ago
You can add PoE (Power over Ethernet) to the Pi 4 or Pi 3B+ pretty cheaply (10-15 dollar hat), and avoid the USB power supply altogether. Not strictly necessary, but makes the wiring so much simpler/cleaner as just one single ethernet cable doing power and data, and you can expand into other neat PoE solutions. My Pi cluster is powered by my ethernet switch alone. It makes wiring a UPS into the system really easy too - just have backup power on the ethernet switch, the downstream Pis are taken care of. I'd love if the Pi 5 just has PoE out of the box personally, I run all my Pi projects this way now.
- justinlloyd 4y ago

balls187 4y ago

What I find interesting and impressive 1) your photography 2) your HN account is ~3 years old, with 33k karma.

giuliomagnifico 4y ago
Ahah thanks…but I spent lots of time in writing this article =)

Topgamer7 4y ago

The link for a grafana chart full image doesn't work: https://giuliomagnifico.blog/_images/2023/home-network_v4/Screenshot%25202023-02-07%2520at%252011.03.51.jpg https://giuliomagnifico.blog/_images/2023/home-network_v4/Sc... vs https://giuliomagnifico.blog/_images/2023/home-network_v4/Screenshot%202023-02-07%20at%2011.03.51.jpg https://giuliomagnifico.blog/_images/2023/home-network_v4/Sc...

giuliomagnifico 4y ago
Fixed, thanks!

hnburnsy 4y ago

I use a separate router and old phone without a sim card to manage my IOT devices, got sick of Amazon continually scanning my network and adding my printers without asking. I know it happens but I hate that these devices probe my networks and report on what they find. Is there anyway to stop this discovery?

artificialLimbs 4y ago
Hardcode IPs and disable broadcast traffic. But really VLANs is the answer.
- hnburnsy 4y ago
  Thank you, I wonder how many IOT devices support entering an IP address directly.
discardedrefuse 4y ago
> Is there anyway to stop this discovery? The correct way is to create VLANs. Then use the router's firewall to prevent devices in the IOT network from reaching into your other networks. Not all consumer network hardware supports VLANs though.
- hnburnsy 4y ago
  Thanks I meant the discovery on the IOT LAN or VLAN.I don't need Amazon knowing that I have a Tesla charger
  - discardedrefuse 4y ago
    Gotcha. You can never tell how an IOT devices is scanning your network. It could be passively listening for broadcast messages, or it could be actively scanning all the private subnets. So, you probably need an access point that can do "client isolation" or "layer 2 isolation". This would prevent clients on the same wireless SSID from talking to each other. For example, looks like the Ubiquiti access points can do it. https://evanmccann.net/blog/2021/11/unifi-advanced-wi-fi-settings#fnr4 https://evanmccann.net/blog/2021/11/unifi-advanced-wi-fi-set...

m463 4y ago

My home network has a few differences that might be interesting: I run openwrt on some mikrotik switches. I started with a mikrotik rb750 switch, then switched to rb2011 switches (5x 10/100/1000 + 5x 10/100 ports), and now two rb3011uias-rm 10-port gbit switches. the openwrt rb3011 build comes from https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 I also run openwrt on a turris omnia and a linksys wrt1900acs. I use raspberry pis for a few things, notably standalone ntp time via a few cheap usb gps dongles. One pi does time exclusively and runs openwrt with a gps hat with pps + a pi ups hat. I like the flirc pi cases - they are cheap, beefy and have great thermals.

imiric 4y ago
Why do you prefer OpenWrt over RouterOS on the Mikrotik switches? I recently upgraded to a CRS326-24S+2Q+RM, and the experience with RouterOS feels much better compared to OpenWrt. Winbox is super polished, everything is well laid out, and it makes even advanced configuration very easy. I do run OpenWrt on a few APs, and it works fine for that simple use case, but for anything more advanced, I prefer RouterOS. Sure, it's not open source, and not as extensible to allow you to run a bunch of services on it, but those can run on any other server just as well.
- simplyaccont 4y ago
  last time i checked, CRS3xx not really supported by openwrt.
  - imiric 4y ago
    My point is that the experience of RouterOS is much better than OpenWrt, so I'm curious why someone would choose to run OpenWrt on Mikrotik switches.
    - simplyaccont 4y ago
      on switches - no point. extra no points because openwrt won't support configuring HW features. On the other side I wanted to run OpenWrt on Mikrotik AP, because my other APs at home run it. ALso there is a much bigger selection of 3rd party packages for OpenWrt than for Mikrotik. I guess it will be main point for many people

kccqzy 4y ago

I'll just say one thing regarding my own home network setup: go IPv6 only. Ditch IPv4, except for the necessary evil that is NAT64/DNS64. I refuse to network any device that does not support IPv6, and I refuse to use any app that chooses not to use the IPv6 addresses present.

npteljes 4y ago
Why do you do this? Principle, or does it have an actual advantage?
- kccqzy 4y ago
  Mostly principle. The internet is designed for end-to-end connectivity; let's strive for a more decentralized internet by giving big cloud and residential users equal access by removing NAT. As for actual advantage, I can think of reduced configuration burden since you don't have to maintain two sets of firewall configs for dual-stack hosts. It's a small advantage only. On the other hand, I'll be honest with you, there are disadvantages. As recently as 2021, people are still discovering problems on IPv6-only networks that necessitate writing new RFCs to mandate new behavior. Yes I'm talking about https://www.rfc-editor.org/rfc/rfc9131.html https://www.rfc-editor.org/rfc/rfc9131.html It's because of the low prevalence of IPv6-only networks that changes as fundamental as Neighbor Discovery have to be proposed in this decade.
  - npteljes 4y ago
    I think that's a nice framing for the issue! IPv6 adoption is really slow, considering that I've been hearing about the necessity for what seems like two decades now.
manv1 4y ago
Yes, because I want my internal home devices publicly accessible by default. Seriously, the global addressability of ipv6 is something that people used to using ipv4/NAT tend to forget. I know a bunch of people (well, two) that make a living scanning for IPv6 addresses inside networks that the admins didn't realize were open to the world.

renox 4y ago

I wonder why noone is talking about the 'bufferbloat' issue, is-it a solved issue now? Can I pick any router to plug into my ISP router?

richbhanover 4y ago
The name "bufferbloat" is falling out of favor. First off, it has a horrible sound... And it doesn't really give an intuitive sense of what's wrong. Referring to "latency" or (my favorite) "responsiveness" is better. And I was encouraged to see this recent ZDNet article that mentioned the "ping rates" of 600-1000 msec, and notes that these would cause videoconferencing or gaming to be unusable. https://www.zdnet.com/home-and-office/networking/i-tried-deltas-new-free-inflight-wi-fi-heres-how-fast-it-was/ https://www.zdnet.com/home-and-office/networking/i-tried-del... And as @giuliomagnifico points out, you can fix it yourself if you get the right router.
giuliomagnifico 4y ago
It’s a solved issue if you’re using the right hardware for your isp connection.
- culopatin 4y ago
  What does this mean? How can I check if I have the right hardware?
  - giuliomagnifico 4y ago
    Depending on the speed of your ISP connection, the faster is the connection, the powerful should be the router

blep_ 4y ago

I've been waiting for a good time to ask this oddly specific question: why does everyone number VLANs 10, 20, 30, etc. instead of 1, 2, 3?

icelancer 4y ago
At least in our case, this allows this space: 172.16.0.1 to 172.16.9.255 To be available for non-VLAN DHCP, static leases, and internal devices. Not sure if that's why others do it this way, but it made sense for us.
blowski 4y ago
Originally, so you could group related VLANs together. e.g. VLAN30 is Marketing, then later you need a second marketing team so they have VLAN31. If you’d had VLAN1, 2, 3, etc, you couldn’t do this. That everyone does it - even on small home networks - is just convention.
viraptor 4y ago
Same reason as assigning larger networks than you need or leaving free spaces between them. You may want to put some things close to each other because they logically go together. But some things that go together don't exist yet, so let's reserve the space. (Can't speak for everyone of course, but that's why I'd use 10.0.10.0/24, then 10.0.20.0/24, etc. Now "same kind of thing next to it" can have 10.0.11.0/24)
giuliomagnifico 4y ago
Because VLAN 1 is the default used by lots of vendors, and sometimes also 2, so using 10 and 20 is easy to remember that is a VLAN and you can leave some static IP free also. Also because is not like DHCP addresses that are 1-255 but VLANs are 1-4096 so you can use some easy numbers to remember. For example I’m using VLAN 50 for IoT because the Homebridge server has 192.168.1.5 IP, so IoT is VLAN 50 with 192.168.50.0/24. Some can argue that using VLAN 1 is also a bit less safe because it’s the default VLAN and attackers usually scan for it like 192.168.1.1 IP for modem/WAN.
briHass 4y ago
On some devices (e.g. CISCO), ID 1 is reserved, so starting at powers of 10 keeps it nice and even and allows for insertions (same logic as line-numbering in BASIC.) I assume 10 seems better than 100 (or even 1000); those just seem crazy high.

andix 4y ago

Is there a good reason to use VLANs? I’ve never really seen the need for it. It’s good practice to secure all your services even in a home network. And in the end you have access to all the services anyway at some point. Also why 3 raspberrys, instead of one with a few containers on them? Especially the 4s draw quite some power, just from a power saving perspective I would only run one.

gerdesj 4y ago
Yes there is (VLANs) and that's why they've been a thing for quite a while. Securing stuff might mean things like firewalls. When you are defining firewall rules you need to define where FROM where TO and WHAT and ACTION. This is what out of the box TCP/IP gives us. It can be rather more complicated but we are discussing VLANs. You might have PCs, servers, TVs, printers, cameras and more on your network. You might want some of thos to access the internet and some not. Some from the internet and some not. Anyway - policy - what should be able to get from A -> B. VLANs allow you more flexibility. You can now have lots of different TOs and FROMs. So you can put your security cameras on a VLAN with no access to the internet. You can still access them but they cannot splurge to the wider world. Three RPis? Perhaps. Depends on the job. I'd probably throw another VM on the fire. (EDIT - grammar)
- andix 4y ago
  I get that. I know what you can do with VLANs. But why do you need it in your home? Do you really cut off your printer in a VLAN and do some specific routing/filtering? I know how to do that, but I just don't see the benefit. If you want to cut off one device from the internet, my solution would be to set a specific DHCP rule to not deliver a gateway/dns. Easy and good enough to cut off a printer from the internet. My home does not need the same network security as a nuclear power plant...
- herpderperator 4y ago
  Your point is more about subnets and less about VLANs. You can have firewall rules that restrict entire subnets from access the Internet; you don't have to define a rule for each device. VLANs just give you assurance that a device can't just change its subnet to your main one and gain access that way. Realistically, there wouldn't be any IoT device that would do this. But I agree if you can do VLANs, you should do them over basic subnets.

ahepp 4y ago

Wow! I'm excited to hear someone has the WAX206 running openWRT. I've been trying to get more of my networking gear running that, but since the WAX206 isn't officially supported I hadn't looked into things further. How much of a pain was it to compile? The post doesn't seem to describe any changes made (understandable, most people probably don't care) but there must be some changes if you had to compile it yourself, right?

giuliomagnifico 4y ago
It’s easy, you just have to clone the fork with the support and then select the packages and compile it. The fork is this: https://github.com/boretom/openwrt-fork/tree/wax206/flashable-1Gbit https://github.com/boretom/openwrt-fork/tree/wax206/flashabl... If you want I can send you my image.
- ahepp 4y ago
  I will try building it, since I also want to get some experience for making it run on my Mikrotik RB5009. But if I run into issues I may take you up on that offer! :) Thanks!
  - giuliomagnifico 4y ago
    Yeah correct, try before is the right way!

tw1984 4y ago

nice setup! I spent weeks searching for a 10G switch that can support the IEEE 1588v2 PTP Transparent Clock (TC) mode but couldn't find anyone that can fit into my budget ($1-2k USD new or <$1k for used). Anyone has such switch to recommend?

jbverschoor 4y ago

What about the tv? It’s on your main net, but guests sometimes would like to connect for for example some streaming. Also, Plex should be on the tv network, but accessible (Uni directional) from the main net

giuliomagnifico 4y ago
At the moment I don’t want the guests be able to stream on my tv, I don’t use Plex. I use AirPlay to send video to my tv.

besnn00 4y ago

I love that it looks so rustic.

nly 4y ago

I'm looking for the fastest possible switch for 6-8 cat6 lines. Anyone know of any affordable options (preferably in the UK)?