this post was submitted on 24 Apr 2024
70 points (100.0% liked)

Selfhosted

40347 readers
328 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
70
Should I or should I not use a VLAN? I have trouble understanding the benefits for home use (feddit.nl)
submitted 7 months ago by JustEnoughDucks@feddit.nl to c/selfhosted@lemmy.world
27 comments fedilink hide all child comments
 

Hey everyone,

I am completely stripping my house and am currently thinking about how to set up the home network.

This is my usecase:

  • home server that can access the internet + homeassistant that can access IoT devices

  • KNX that I want to have access to home assistant and vice versa

  • IoT devices over WiFi (maybe thread in the future) that are the vast majority homemade via ESPHome. I want them to be able to access the server and the other way around. (Sending data updates and in the future, sending voice commands)

  • 3 PoE cameras through a PoE 4 port switch

  • a Chromecast & nintendo switch that need internet access

Every router worth anything already has a guest network, so I don't see much value in separating out a VLAN in a home use case.

My IoT devices work locally, not through the cloud. I want them to work functionally flawless with Home assistant, especially anything on battery so it doesn't kill its battery retrying until home assistant polls.

The PoE cameras can easily have their internet access blocked on most routers via parental controls or similar and I want them to be able to send data to the on-server NVR

I already have PiHole blocking most phone homes from the chromecast or guest devices.

So far it seems like a VLAN is not too useful for me because I would want bidirectional access to the server which in turn should have access from the LAN and WiFi. And vice versa.

Maybe I am not thinking of the access control capability of VLANs correctly (I am thinking in terms of port based iptables: port X has only incoming+established and no outgoing for example).

I figure if my network is already penetrated, it would most likely be via the WiFi or internet so the attack vector seems to not protect from much in my specific use case.

Am I completely wrong on this?

you are viewing a single comment's thread
view the rest of the comments
[–] acockworkorange@mander.xyz 4 points 7 months ago (1 children)

It looks like you’re not understanding what a VLAN is. It is a virtual LAN, it’s near physical separation of traffic.

In your example, your IoT devices and HA would sit in their network. Your PCs and phones on another, reaching outside through PiHole. Your *arr suite in a third, only routed outside through a VPN. You get the gist. And then you set rules on how these subnets talk to each other in a router, like you would do if they were physically separate.

[–] JustEnoughDucks@feddit.nl 3 points 7 months ago (2 children)

Yes, that is why I gave an example of how i thought it worked, but i have a single physical server with *arr suite, HA, reverse proxy, and all of my other services.

If it is a near physical separation of traffic, how can 1 device with 1 MAC and 1 IP be isolated on multiple parts of the VLAN?

[–] Dran_Arcana@lemmy.world 2 points 7 months ago* (last edited 7 months ago)

You would expose a single port to multiple vlans, and then bind multiple addresses to that single physical connected interface. Each service would then bind itself to the appropriate address, rather than "*"

[–] acockworkorange@mander.xyz 1 points 7 months ago* (last edited 7 months ago) (1 children)

~~Oh, it can’t. You’d need more ETH ports.~~ One for each VLAN a device is connected to. You can find multiport low speed expansion cards for cheap, even more so used. Many people think it’s a worthy investment. You learn a valuable skill and have a more resilient, secure network.

Of course that assumes you have spare expansion connectors on your server. I might be wrong, but I’m pretty sure you can find ETH boards for that “Wi-Fi” M.2 connector, so that’s an option if you don’t have PCI. That way you can at least segregate Internet and local traffic.

Edit: apparently you can. Time for me to update my knowledge.

[–] FalseMyrmidon@kbin.run 2 points 7 months ago (1 children)

Yes, you create virtual nics tied to the physical one.

[–] acockworkorange@mander.xyz 1 points 7 months ago

Thanks, I’ll look into it!