and this is why I have a completely separate physical network for my IOT stuff.
Comment on My reason for wanting HomeAssistant and a locked down VLAN...
tjoa@feddit.org 1 week ago
FYI I learned About VLANs that it is in no way „locked down“. I can spoof the MAC address of a known device from a specific VLAN and I’m in that VLAN. Yes your devices can’t reach the internet/other devices by default but it won’t stop a bad actor.
GreenKnight23@lemmy.world 1 week ago
teslasaur@lemmy.world 1 week ago
Well. The segmentation is to avoid security holes from Rogue third party devices. If you can access my pc vlan that only exists on my pc, then you have indeed broken in to my domain. Letting the things that doesn’t give a shit about security have their own network is just sanity
sugar_in_your_tea@sh.itjust.works 1 week ago
Isn’t that what 802.1x is for? If you really want to lock down your network, there are options.
interdimensionalmeme@lemmy.ml 1 week ago
Yes, VLAN is an IT convenience feature, you don’t need it just because it is a feature of the more expensive hardware.
Instead just establish separate L2s and operate proper L3 firewalls between them. For IoT devices, any kind of reliable potato will do just fine.
Landless2029@lemmy.world 1 week ago
I’m aware you need a firewall (I used sonicwall professionally) vlans are for segmentation
flux@lemmy.ml 1 week ago
Depends on you hw. I believe my TP switch might handle that, because it rejects traffic to its management interface from mac X from vlan 20 because it sees the same mac in vlan 10… (only vlan 20 is allowed for management)
tjoa@feddit.org 1 week ago
That’s a very cool feature actually but how does it stop a hacker if he has obtained a trusted MAC address from another device and connect to vlan 20 directly while the real device is offline?
flux@lemmy.ml 1 week ago
You configure vlans per physical port, so in a properly implemented system your attack won’t be possible. When the packet comes to the switch the vlan tag is added to it according to the configuration for the port it was received from.
Or are you talking about mac-vlans?
tjoa@feddit.org 1 week ago
Ok maybe I don’t fully understand yet. Let’s say an access point has 3 SSIDs, lan, guest and iot each client on each SSID gets a vlan tag accordingly. So it’s only connected to a single physical port, i think that’s what confused me. But SSIDs are interfaces just like an physical port afaik so your analogy still stands. The security here is the WiFi password anything that connects to LAN gets a LAN vlan tag. but it’s not like anything that connects to any of the SSIDs can get the DHCP lease of some random device on any vlan cuz it got tagged before. Or am I missing something?