4 ms·

That reminds me, I need to configure VLANs in my router so that all my trusted computers are isolated from all the other garbage that makes it into the network.

ur-whale 3mo ago
Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security? I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is? Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? Just wondering.
- ahahs 3mo ago
  this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
  - matheusmoreira 3mo ago
    Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it. Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
    - TylerE 3mo ago
      Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.
- rcoder 3mo ago
  Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on. A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them. And an Ethernet “hub” does no filtering at all.
  - rcoder 3mo ago
    Also: if you need a streaming box to see your AirPlay or UPnP devices for “casting” it necessarily has to be on the same VLAN as the devices it’s connecting to. Sonos speakers have this problem when subject to client isolation setups based on VLANs or switch-level packet filters. And any kind of multicast (used for local service discovery and media streaming) has the same limitations.
- xorcist 3mo ago
  Network switches typically aren't known for their outstanding security record, but the vlan tags themselves are trivial and should be hard to mess up. Should someone hack your switch all bets are off, but as long as you don't have management accessible in-band you should be fine. Security problems are more likely to stem from bad configuration. > Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? That would be an exceptionally weird configuration. If a device "sits on VLAN1" that typically means that it's on an "untagged" port where only VLAN1 traffic is allowed. Ports that carry multiple VLANs are "tagged" ports and you normally wouldn't say they "sit" on any specific VLAN, precisely because that port carries tagged traffic for multiple VLANs. It's at best an irregular use of the terminology but likely a misunderstanding somewhere.
- inigyou 3mo ago
  A VLAN is a virtual LAN. having two VLANs is like having two LANs but without as much duplicated wiring. It's quite well-supported and reliable. You usually want to interconnect them at one central point, usually a router, and enforce a security policy there.
russdill 3mo ago
Seems like a motivation to switch to using a VPN for such untrusted devices that still require internet access.
__turbobrew__ 3mo ago
Doesn’t help when the garbage starts proxying illegal traffic through your home ISP.
- inigyou 3mo ago
  What happens then?
  - __turbobrew__ 3mo ago
    Feds come to your door asking why you downloaded/distributed CSAM
    - inigyou 3mo ago
      Is there any evidence this ever happened?
      - __turbobrew__ 3mo ago
        It has happened with tor exit nodes, so I imagine it is possible with shady unconsentual residential proxies.
- matheusmoreira 3mo ago
  Yeah but at least the garbage can't attempt to exploit my laptop.

ur-whale 3mo ago

Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security? I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is? Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? Just wondering.

ahahs 3mo ago
this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
- matheusmoreira 3mo ago
  Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it. Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
  - TylerE 3mo ago
    Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.
rcoder 3mo ago
Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on. A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them. And an Ethernet “hub” does no filtering at all.
- rcoder 3mo ago
  Also: if you need a streaming box to see your AirPlay or UPnP devices for “casting” it necessarily has to be on the same VLAN as the devices it’s connecting to. Sonos speakers have this problem when subject to client isolation setups based on VLANs or switch-level packet filters. And any kind of multicast (used for local service discovery and media streaming) has the same limitations.
xorcist 3mo ago
Network switches typically aren't known for their outstanding security record, but the vlan tags themselves are trivial and should be hard to mess up. Should someone hack your switch all bets are off, but as long as you don't have management accessible in-band you should be fine. Security problems are more likely to stem from bad configuration. > Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel? That would be an exceptionally weird configuration. If a device "sits on VLAN1" that typically means that it's on an "untagged" port where only VLAN1 traffic is allowed. Ports that carry multiple VLANs are "tagged" ports and you normally wouldn't say they "sit" on any specific VLAN, precisely because that port carries tagged traffic for multiple VLANs. It's at best an irregular use of the terminology but likely a misunderstanding somewhere.
inigyou 3mo ago
A VLAN is a virtual LAN. having two VLANs is like having two LANs but without as much duplicated wiring. It's quite well-supported and reliable. You usually want to interconnect them at one central point, usually a router, and enforce a security policy there.

russdill 3mo ago

Seems like a motivation to switch to using a VPN for such untrusted devices that still require internet access.

__turbobrew__ 3mo ago

Doesn’t help when the garbage starts proxying illegal traffic through your home ISP.

inigyou 3mo ago
What happens then?
- __turbobrew__ 3mo ago
  Feds come to your door asking why you downloaded/distributed CSAM
  - inigyou 3mo ago
    Is there any evidence this ever happened?
    - __turbobrew__ 3mo ago
      It has happened with tor exit nodes, so I imagine it is possible with shady unconsentual residential proxies.
matheusmoreira 3mo ago
Yeah but at least the garbage can't attempt to exploit my laptop.