Source
r/homelab•
O2_AC

Networking, VLANs, is this all necessary?

Help

I'm reading a lot here about people organizing there home network with different VLANs for additional security, but is all of that really necessary or even applicable in my situation?

As far as I have understood it, in my setup (see below) there is really no point in using different VLANs for different services or device groups.

Let's go to my setup:

- One ubuntu server running: Plex, a VPN, Samba Shares, Borg server, a couple of websites for personal use which are accessible via WAN but behind a nginx basic auth, HomeAssistant. (Specs of the physical machine: J1900, 8GB RAM, 1 Gigabit Ethernet Port, SSD for the system, HDDs for storage)

- A raspberry pi running pihole

- Two Echos, Netatmo Thermostat, Philips Hue

- Laptop, iPhone, Tablet

- SmartTV and XBOX

- Network: Currently on Edgerouter-X + manageable switch + Unifi AP Lite

Possible thoughts:

- A IoT VLAN for security, BUT the echos need internet access to work and I want the Netatmo Thermostat to be available via my iPhone, because thats the whole point of it. Also HomeAssistant needs to be on the same VLAN, but it is running on a machine with a lot of other services on it.

- A VLAN for the Webserver, seems somewhat reasonable, BUT it runs on the same machine as a lot of other stuff so how would I even go about assigning nginx to a VLAN, and on top of that, if there would be an exploit, the intruder would have access to the server which runs a lot of other services and stores somewhat important data. A VLAN would not protect against that, right?

Maybe some could shed some light on the situation or point me to helpful resources.

Posted Mar 5, 2020, 10:16 AM UTC

122
carrot_gg•

Based on what you wrote it seems like you have no idea what VLANs are or how they work. I suggest you read more about it.

Just FYI, different devices on different VLANs can still talk to each other. It is the firewall rules that will dictate the segregation between your VLAN networks. Also, you can you can allow your Echos to talk to the the internet but not your main network/vlan. You can also allow your iphone to talk to devices in different VLANs but restrict those same IoT devices to initiate connections to your iphone or other devices in different VLAN networks.

Also, your Ubuntu server setup is absolutely terrible in terms of security. Virtualize everything, that way you can isolate each of your services (Plex, SMB shares, publicly accessible web servers, etc.) and even assign different NIC interfaces with appropriate vlans. Take a look at Proxmox, etc. I personally use VMWare ESXi.

11
O2_ACOP•

Do you think the J1900 processor and just 8 GB of RAM will be sufficient to virtualize everything? Wouldn't I be running several independent virtual OS's then, which would each require CPU and RAM resources?

2
renehoj•

The overhead on using virtualization is not that great, unless your current setup is running at close to 100% load it shouldn't be a problem.

3
RememberTheTitanLoss•

Aside from best practices why should anyone care about security on a homelab? You are not going to get hax0red

0
nicox11•

You can, and already seen here.

1
RememberTheTitanLoss•

You can but you are no more likely than anyone else it's literally less then 0.01% chance hackers target things of value joe schmoes home lab generally isn't a thing of value

1
nicox11•

Hard to know before-hand, and servers online connected are always thing of value

1
arturasb•

VLANs help to make virtual "regions" inside your network and set rules what traffic goes where and most importantly - which traffic mustn't go somewhere. So it's up to you to decide how many isolated "regions" you really need and what "traffic rules" are required to secure your network properly.

1
renehoj•

I don't really think you gain anything from using VLANs, unless the IoT devices can be accessed directly from the internet they are not really a security issue.

You should look into running virtualization on your server an split it into two virtual servers, if you have one virtual server for the webserver and one for everything else you could deny the webserver access to your local network in case it gets hacked.

1
jgiacobbe•

I disagree. The IOT device risk isn't because they are or are not publicly exposed, it is because we usually have little visibility or control of what they actually do. They typically have BT or zigbee or other protocols enabled, may or may not get security updates and often Hoover up data and send off to foreign servers in exchange for whatever service you get. They offer both a vector for attack by having possibly unsecured or vulnerable rf based connections and provide a gateway for other entities imto your network. General security best practice is to firewall them from the other hosts on your network and only allow required access to limit their splash radius of o e is compromised or exploited. Just because they are only initiating outbound connections doesn't mean it should be trusted. An echo dot is indeed a system you don't control that sends data off network to hosts you don't control.

2
renehoj•

often Hoover up data and send off to foreign servers in exchange for whatever service you get

okay...

-3
old_leech•

Bad Analogy Thursday...

I like my cats. They provide a modicum of happiness and an overall increase to my quality of life, but I wish I could keep them off my bed. It weirds me out that I'll hear them shuffling a round in the litterbox in the other room and the beeline for the bed with their stanky little paws outstretched for my beard.

It's my house, and they come when I call them, let me wrestle them and generally amuse me, they also require me to provide food and water and care... but they equally act independently of my preferred intent because they're their own creatures.

My IoT devices are like cats. I brought them in, I give them power, have to provide internet access and derive some pleasure from their company... but the luxury I have with them is that they all reside on a separate vlan, on their own IP range and I have firewall rules that keep their grubby, litter encrusted claws far away from my trusted devices.

They can't peek in or sniff around the network and have no idea of what is going on outside of their sandboxed zone.

As u/jgiacobbe mentioned, they're closed boxes that someone else ultimately controls (or abandons...). A little in the way of preventive measures allows me to indulge my technolust for cheap, questionable gear and not scratch my head over their intent.

2
jgiacobbe•

Thank you for bad analogy Thursday.

1
renehoj•

The switch you use to create the VLAN for the IoT devices is a closed box you have no control over.

You are willing to accept the Chinese government, or whoever it is controlling all the IoT devices, are trying to hack you but you draw the line with zyxel, cisco, etc. because it would be crazy to believe that they are trying to hack you?

1
-Jehos-•

There's nothing stopping you from building your own router if you really want to ensure it's secure.

https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/

1
renehoj•

But Intel CPUs come with intel management engine, AMD CPUs with platform security processor god knows what possible could be hiding in ARM CPUs.

You clearly need to design the hardware yourself if you want to be safe, but then you need to worry about supply chain attacks.

If you want to make anything from scratch you need to start with the universe, but that seems like an awful lot of work, easier just not to be paranoid.

1
lunchboxg4•

IoT devices being able to phone home is equally concerning as if they can be reached from outside. Aside from whatever normal data collection those devices may do on a network, you can’t necessarily trust that their normal update process is secure and they won’t unintentionally pull in compromised software and start phoning who knows what out to who knows where. It may be paranoia, but not a risk worth taking. I don’t trust IoT devices to look around my LAN - my things can talk to them, and they can talk out, but that’s it.

1
garbled_net•

I feel that there are at least a few valid reasons for using VLANS...

  1. You really want to learn networking. You can setup VLAN's for your OOB management stuff, your IOT, your wireless, write gobs and gobs of firewall rules, learn tons of stuff as problems crop up. It's a real thing. You will learn so much.

  2. You own IOT devices. Like others have said, do you trust them? I wouldn't.

  3. You want to separate certain types of traffic. I VLAN off my ceph and corosync rings. Maybe you have a backup ring?

  4. Security is a real thing. Maybe you keep your finances on a computer, maybe that should be on a different network than the machine that runs your webserver.

  5. Some devices are LOUD. I have a camera controller that spams so much data onto the network it's disgusting. I keep it isolated to just the machines that need to chat with it.

1