Comment on Should I or should I not use a VLAN? I have trouble understanding the benefits for home use
AA5B@lemmy.world 6 months ago
Yes, you should not be thinking about security in terms of an outside intruder here. Think about untrustworthy or potentially compromised devices.
WiFi smart devices are notorious for calling home, possibly collecting data, even if you’re trying to use them locally. There have been botnets from unsecured video cameras, and even some compromised from before import. TVs report back what you’re using them for and when, even playing through hdmi, and some have been caught listening in to your private conversations. How do you prevent these from happening? One way is to put them on a separate vlan without internet access (your HA or other hub can listen on multiple VLANs and be the gatekeeper).
That being said, for similar requirements, I found managing the more complex network to be too much hassle, and went back to a simple flat network
JustEnoughDucks@feddit.nl 6 months ago
Yeah, for that threat model, a VLAN is not needed in my opinion:
esphome devices are for sure not data collecting and pihole will block most of the phone homes with a good block list, where possible (like simple smart devices) they are flashed with a local open source version. Still the vast majority are KNX and Zwave which are local only
video cameras are local-only always and have completely blocked internet access via the router
This is probably the biggest threat unpreventable in other ways. Though definitely citation needed for them actually being caught recording conversations lol. People think phones do that too, but it is simply a lot easier (and more importantly, cheaper with a much higher ROI) to make a complete data picture through search/watch history + proximity to other devices.
AA5B@lemmy.world 6 months ago
theguardian.com/…/information-commissioner-invest…
cnet.com/…/samsungs-warning-our-smart-tvs-record-…
theguardian.com/…/what-your-smart-tv-knows-about-…
ohhello@feddit.nl 6 months ago
Pihole by itself can’t really block all the traffic as some device may be set to use different DNS server from factory. And with DNS over HTTPS, to block phoning home, you’d most probably have to completely block internet access for that device.
I’m looking at VLANs as groups of devices which shares the same access policies. So e.g. you create VLAN for cameras, create rules for accessing the NAS, HA, etc. and then just assign each camera to that VLAN. You don’t need to recreate same rules for every new camera.