4 ms·
VLANs. One for you, one for the Chinese shit. Keep your [phone/PC/whatever] on one VLAN, with a NAT gateway, and they'll work just as they do now. Keep the I
by ssl-3 2y ago
VLANs. One for you, one for the Chinese shit.
Keep your [phone/PC/whatever] on one VLAN, with a NAT gateway, and they'll work just as they do now.
Keep the IoT Things inside of their own VLAN, without a gateway to the Internet.
And if a device like Home Assistant or whatever needs to exist on both VLANs in order to be useful, then: Make sure it isn't forwarding/routing/NATing packets.
---
The implementation details vary, but they needn't be particularly expensive.
What I do at home is run OpenWRT on a Pi 4 for my home routing purposes. It's fast enough for my needs and it's got simple GUI configuration options for VLAN. (Why OpenWRT? Because it's easy for me to puzzle out when I need to adjust something after a few months or a year -- I don't deal with routing every day, nor do I wish to. (Also SQM is a built-in, which always keeps WAN latency tolerable.))
From there, I've got cheap managed switches that enforce/insert VLAN tags where that is useful to me, so I can decide which physical ports are capable of talking to whichever VLANs.
And from there, I've got relatively inexpensive Mikrotik access points that are configured to provide different SSIDs for different VLANs.
It all works OK, though more enterprisey folks will almost certainly choose a very different path.
- stavros 2y ago> One for you, one for the Chinese shit. Can you give an example of tech devices that aren't manufactured in China?
- ssl-3 2y agoNo, not specifically. (To bring this to the logical conclusion: So much for Internet access.) ;)
- snakeyjake 2y agoThere are many tech devices not made in china. That all tech devices are made in china is a myth propagated by the ignorant (or malicious). From the raspberry pi (UK) to Samsung Galaxy (South Korea) it is trivial to find a product not made in China once you leave the low end of the market. And now even the low end has alternatives if you spend some time and effort. Name any category of product whatsoever and I will personally find you a non-Chinese alternative. Even many things “made” in China are only really assembled in China. A computer that’s “made” in China is often just slapped together like a lego kit from pieces made in Thailand, South Korea, Germany, the US, Singapore and Taiwan (which isn’t a part of China).
- freddie_mercury 2y agoI'm pretty sure any Samsung Galaxy in the US was made in Vietnam in the Thai Binh factory, which I used to live close to. The South Koreanan manufactured units are generally only sold in South Korea.
- swores 2y ago> "From the raspberry pi (UK)" Without having put any specific thought into it, I always assumed that while designed in the UK they would be manufacturing them in Asia, so it's a pleasant surprise to find out that you're mostly right - the majority have been made in Wales (part of the UK)! However some are made in Asia, including China. Quoting Wikipedia (plus the citation links): > "Most Raspberry Pis are made in a Sony factory in Pencoed, Wales,[19] while others are made in China and Japan.[20][21]" > [19] https://www.sonypencoed.co.uk/about/ https://www.sonypencoed.co.uk/about/ > [20] https://www.zdnet.com/article/14-million-raspberry-pis-sold-10-million-made-in-the-uk/ https://www.zdnet.com/article/14-million-raspberry-pis-sold-... The second link (20) is from 2017, with headline "Raspberry Pi: 14 million sold, 10 million made in the UK"
- ryao 2y agoI thought that the Raspberry Pi was considered the low end of the market. What is the low end if not the Raspberry Pi?
- 2y ago
- sangnoir 2y agoTbf, they meant stuff where the firmware updates and/or control-plane are controlled by Chinese servers. I'll go further: all Internet of shiT gadgets shouldn't be allowed to phone home: Chinese, Korean, American, doesn't matter. One day, the manufacturer/operator will use. That internet connection in ways contrary to customers best interests.
- stavros 2y agoI agree, I use Zigbee and anything that uses wifi is on its own VLAN (wherever it's made, it's not like I trust Meta more, for example).
- Loughla 2y agoOur setup looks exactly like yours I think. One connection for humans, one for machines. The two shall never meet. It takes a little bit of setup, and less than $200. Anyone techy should do this; it's essentially maintenance free once running.
- nickphx 2y agoYeah that works great until the partitioned device decides it requires Internet access and ceases operation. I recently had a Bose soundbar refuse to play sound until it was connected to the internet.. it promptly downloaded some massive 2gb update, then bricked itself while updating.
- ssl-3 2y agoIf it's a brick without Internet access, and it is also a brick with Internet access, then: It is simply a brick, and no amount of segregation can help.
- anonymousiam 2y agoVLANs are great. Unfortunately, I've got an unmanaged 12-port PoE+ switch that doesn't support them. My workaround is to put two subnets on the same physical LAN, and my DHCP server (pihole) has an IP address on each subnet. My (openWRT) router also has IPs on both subnets, and routes both LANs to the WAN. Restricting/throttling WAN bandwidth is easily managed in OpenWRT. Preventing WAN access is easily done by not providing a gateway in the DHCP assignment (pihole). Obviously the big difference between this and a VLAN is that an ill-behaved device could still access the other subnet, and could still discover the gateway and route to the WAN. So far, none of the IoT crap on my restricted subnet has misbehaved.
- technofiend 2y agoJust my opinion but don't you want to patch that hole with a better switch? Or put it downstream of a switch that does enforce vlans? Most likely your iot devices don't really need anything more than 10-100 megabit connections anyway?
- anonymousiam 2y agoThe switch I'm using is behind a panel in my garage, which is not climate controlled. Temperatures range from freezing to over 100F throughout the year. It's a fanless POE+ switch and it's doing a great job otherwise. I've replaced the switch with a different model a few times over the past five years, but this one has held up well for over three years. I'm open to suggestions for a reliable (managed or unmanaged) fanless POE+ switch that can handle this environment. Ideally, I'd like one than can do 10Gbps. The present switch is 1Gbps. Money is a secondary consideration.
- technofiend 2y agoI claim no expertise here, sorry. Best I can do is defer to Serve The Home; they have reviews of switches that include whether it's managed, actively cooled, throughput, etc.
- 2y ago