Comment on How to physically isolate a camera with OpenWRT, tagged VLANs and Docker
GreenKnight23@lemmy.world 1 day ago@> A. Do you absolutely NEED the VLAN for your NVR? Why not just isolate the devices on the network with a bogus DNS record or FW rule blocking via MAC or IP?
DNS doesn’t stop direct IP comms. I have seen a few devices that talked direct IP to bypass DNS blocks. as you said, a firewall rule is a far better solution.
However, I don’t trust my Chinese cameras enough to not rootkit their way across my network, so it has to be quarantined. a VLAN is one way to successfully do that.
personally I dislike the high maintenance costs of VLANs. That’s why I opted to run a completely different network for all my IOT devices including cameras. the DVR is on that network and proxied through a dual homed server that straddles the two networks. firewall rules in place that only allow specific ports through on specific devices to specific devices.
corsicanguppy@lemmy.ca 1 day ago
Said no one ever, until now.
GreenKnight23@lemmy.world 1 day ago
a VLAN is assigned to a specific port on the same subnet.
now I have to know which port is for that VLAN specifically.
now I have to segment my network to ensure I know which IPs are on that VLAN.
now I have to statically assign IPs.
now I need to replace my router and rebuild everything.
or I setup a separate network on a different subnet with firewall rules to ensure nothing can talk to anything outside of the private network and let dhcp do assignments.
hmmmm…which one is easier to maintain… I wonder…
VLANs literally exist because it would be too costly to run dedicated networking hardware in enterprise solutions. from a networking perspective in a selfhosting or small business environment VLANs are overkill and high maintenance.
unitedwithme@lemmy.today 1 day ago
On older hardware I would agree it can be cumbersome. At work, I’ve swapped everything to Ubiquiti and it’s a couple clicks and I’m there. I liked it so much I did it at home with some caveats. Local account only and blocking anything phoning home.
I’ve got Chinese cameras too, they’re on their own VLAN,ext traffic is blocked simply.