Comment

The risk is the ISP Wi-Fi. As long as you’re using WPA with a good long random passkey, the risk is minimal. However, anyone who had access to your Wi-Fi could initiate an ARP spoof (essentially be a man-in-the-middle)

source

Sort:hotnew top

tiller@programming.dev ⁨1⁩ ⁨year⁩ ago
Well, to be honest if someone has access to my Wi-Fi, I’d consider that I’ve already lost. As soon as you’re on my lan, you have access to a ton of things. With this setup I’m not trying to protect against local attacks, but from beaches coming from the internet

source
- transmatrix@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Doesn’t need to be the case if you segment your network to protect against ARP.
  
  source
foggenbooty@lemmy.world ⁨1⁩ ⁨year⁩ ago
How would you change his setup to prevent ARP attacks? More network segmentation (clients and servers on separate VLANs) or does OPNsense additional protections I should look into?

source
- transmatrix@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Don’t have the Wi-Fi network “upstream” of the LAN. You want the connection between the LAN and Wi-Fi to be through the WAN so you get NAT protection.
  
  source
  - Ac5000@lemm.ee ⁨1⁩ ⁨year⁩ ago
    Any way you could update/create your own drawing with what you mean? (Bad paint drawings are acceptable!)
    
    I ask because I am curious if I am subject to the same problem. I’m not the most networking savvy so I need the extra help/explanation and maybe the drawing will help others.
    
    source