IOT separation, special case?

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
ATHF
DD-WRT Guru


Joined: 14 Dec 2015
Posts: 715
Location: 127.0.0.1

PostPosted: Thu Mar 05, 2020 7:41    Post subject: IOT separation, special case? Reply with quote
First, my disability is starting to get a tad worse, and my mind is not working as well as it used to, which is really starting to piss me off. So, take it easy on me Very Happy (You know who you are lol). But I have helped on here, and gotten help, just haven't been on too much lately, pretty much due to the cluster mess of MVEBU, now some going to the new company, but a few updates still... Anyway...

I have spent two weeks, reading/watching articles/videos on separating/segregating IOT devices from your main network, reading relevant issues on the forum. And my brain is just at a road block.

Second, I have a WRT1900AC not doing anything, WRT1200AC is 5 GHZ only for an RE6500 to my garage security cam. A 3 node Velop WHW01 (bridged mode) (I am not fond of it either LOL). And an Linksys RE9000, which most of the IOT devices are happy with (not all, a couple have to hook to one of the Velops due to distance even on 2.4).

I honestly can't remember if these "smart" plus, RGB lights, heck even if Alexa, or my Google home mini have those ESP chips which I DO remember having issues with Marvell chips. Which, from I have read, still need either an open network, or WMM off?

What I am looking for is the easiest way to do this, I know VLANs can be a pain with the newer WRT series, and doing a VAP yet the IOT pieces are all over the place.

Now, I am going to post a very simplified network topology..
I think, let's see... -Edit worked, I am sure a few of you have questions, which is fine, those also help.

_________________
Tutorial for flashing WRT series
WRT Installation,Upgrade & Basic Setup–Cliff Notes
DD-WRT Firmware: r42054: WRT3200ACM, WRT1200ACv1 (Smart crap subnet), WRT1900ACv1
Velop:3 WHW0101, RE6500, RE9000
TWC/Spectrum - 300/25
SysLog Watcher 5, Security Onion on Virtual Box, Fingboxes, PiHoles
Sponsor
blkt
DD-WRT Guru


Joined: 20 Jan 2019
Posts: 1211

PostPosted: Thu Mar 05, 2020 21:29    Post subject: Reply with quote
For 1200/1900/3200 series WRTs if you have any devices stuck in an auth request deauth loop or key renewal failure:

Disable WMM on the 2.4 GHz interface under advanced settings, then it's a game of finding which wireless network mode after a save and reboot makes your clients happy. Examples: G-Only, BG-Mixed, NG-Mixed. Don't use TKIP under wireless security.

Or you can offload the problem devices to another router, which is better than a VAP for separation.
ATHF
DD-WRT Guru


Joined: 14 Dec 2015
Posts: 715
Location: 127.0.0.1

PostPosted: Fri Mar 06, 2020 2:26    Post subject: Reply with quote
Thanks blkt,

That was the way I was leaning towards, was getting a used router Braodcom/Atheros to just make it simple for me, just hoping that I could get it to where they all would be able to connect, like middle of the house towards the south wall. This is a twice rebuilt home, with additions, so that's why I have so much crap LOL.

Then my mind went into overdrive, which really aren't questions for here, like I'll need another switch off of the new/used router connected to another IDS box (unless I can change the scope of which networks it sniffs), another pc for logging, I have an extra FingBox so I could just hook that to the switch on the router....

Sorry, thinking out loud again.... Rolling Eyes

But thank you again, You've been a great help around here, minor scuffles but you still help! I do this just to try and keep my mind sharp.

_________________
Tutorial for flashing WRT series
WRT Installation,Upgrade & Basic Setup–Cliff Notes
DD-WRT Firmware: r42054: WRT3200ACM, WRT1200ACv1 (Smart crap subnet), WRT1900ACv1
Velop:3 WHW0101, RE6500, RE9000
TWC/Spectrum - 300/25
SysLog Watcher 5, Security Onion on Virtual Box, Fingboxes, PiHoles
ATHF
DD-WRT Guru


Joined: 14 Dec 2015
Posts: 715
Location: 127.0.0.1

PostPosted: Fri Mar 06, 2020 2:49    Post subject: Reply with quote
blkt,

In your opinion, what should I go with? Since, most I have dealt with DD-WRT is on the MVEBU's, it wouldn't have to be a powerhouse just doing those simple things.

Thanks, again.

_________________
Tutorial for flashing WRT series
WRT Installation,Upgrade & Basic Setup–Cliff Notes
DD-WRT Firmware: r42054: WRT3200ACM, WRT1200ACv1 (Smart crap subnet), WRT1900ACv1
Velop:3 WHW0101, RE6500, RE9000
TWC/Spectrum - 300/25
SysLog Watcher 5, Security Onion on Virtual Box, Fingboxes, PiHoles
blkt
DD-WRT Guru


Joined: 20 Jan 2019
Posts: 1211

PostPosted: Fri Mar 06, 2020 3:15    Post subject: Reply with quote
I think the best bang for the buck is a used EA8500 (qca9980). If you are in the US these can be found for $20-50 on ebay, craigslist, offerup etc depending on condition and general timing or luck. It retains the dual partition setup like the WRTs, so that's convenient.

Opening it is a pain in the ass, because after removing the four screws under the feet the shell is clipped shut in many spots like an LCD bezel. I had to use two guitar picks and a flathead made for eyeglasses to pry it open because I don't have any real pry tools.

After that the initial serial flash was extremely simple (Adafruit 954 or DTECH FTDI 3.3V).

A step up from that would be R7800 with faster CPU, dedicated Gbit links each for Ethernet LAN and WAN, better driver and firmware support with a newer chipset (qca9984). More expensive, but no serial cable required and TFTP recovery if needed.


Last edited by blkt on Fri Mar 06, 2020 3:32; edited 1 time in total
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6534
Location: Texas, USA

PostPosted: Fri Mar 06, 2020 3:32    Post subject: Reply with quote
@ATHF: It's nice to see someone still using that Cisco hardware.
_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3655
Location: UK, London, just across the river..

PostPosted: Fri Mar 06, 2020 15:34    Post subject: Reply with quote
this might help you with VLAN's on WRT series

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=317199

as far as isolating IoT...get a managed switch with VLAN support, segment all ports to own Vlan's and connect it to a VLAN (physical) port on your router...
so all IoT devices will not communicate with each other on the switch and they will have a clear WAN access on the Vlan router side, you can add more switches or routers on those segmented ports on the switch side or create another Vlan/port on the router side...
as it has 4 ports...

look for those cheap managed Netgear GS105Ev2 switches, 5 port switch is about 20-30 pounds/ euro

p.s. kernel-panic69 could you retrain from unnecessary acerb comments....

1. its very unclear what the chap wants to achieve and how, as well on this diagram, i do not see any IoT he was talking about...do you see any???
2. i decided to share my solution to the ATHF problem...so let's give ATHF chance to decide what is useful or not... am I clear ??

_________________
Atheros
TP-Link WR740Nv1 ------DD-WRT 43718 BS AP,NAT
TP-Link WR740Nv4 ------DD-WRT 43028 BS WAP/Switch
TP-Link WR1043NDv2 ----DD-WRT 43516 BS AP,NAT,AD Block,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----DD-WRT 43718 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN
TP-Link WR1043NDv2 ----Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -------DD-WRT 43718 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -------DD-WRT 43718 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913


Last edited by Alozaros on Fri Mar 06, 2020 21:44; edited 4 times in total
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6534
Location: Texas, USA

PostPosted: Fri Mar 06, 2020 15:47    Post subject: Reply with quote
Alozaros wrote:
this might help you with VLAN's on WRT series

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=317199

as far as isolating IoT...get a managed switch with VLAN support, segment all ports to own Vlan's and connect it to a VLAN (physical) port on your router...
so all IoT devices will not communicate with each other on the switch and they will have a clear WAN access on the Vlan router side, you can add more switches or routers on those segmented ports on the switch side or create another Vlan/port on the router side...
as it has 4 ports...

look for those cheap managed Netgear GS105Ev2 switches, 5 port switch is about 20-30 pounds/ euro


Apparently, looking at his network diagram image is optional. Can you not read? All his switches are managed switches Rolling Eyes Laughing Wink

_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
ATHF
DD-WRT Guru


Joined: 14 Dec 2015
Posts: 715
Location: 127.0.0.1

PostPosted: Sat Mar 07, 2020 7:22    Post subject: Reply with quote
blkt wrote:
I think the best bang for the buck is a used EA8500 (qca9980). If you are in the US these can be found for $20-50 on ebay, craigslist, offerup etc depending on condition and general timing or luck. It retains the dual partition setup like the WRTs, so that's convenient.

Opening it is a pain in the ass, because after removing the four screws under the feet the shell is clipped shut in many spots like an LCD bezel. I had to use two guitar picks and a flathead made for eyeglasses to pry it open because I don't have any real pry tools.

After that the initial serial flash was extremely simple (Adafruit 954 or DTECH FTDI 3.3V).


Thanks, is that where wikidevi ended up? I've got no problems cracking open an EA8500 (I have tools, the Adafruit cable, along with a pitch adapter, I may have gotten a real old Adafruit cable, like on the my 3200 they just slide off). I will keep an eye out for used/refurbed ones. I'll also look out for the 7800. Crazy how much they want for these new still.

kernel-panic69 wrote:

@ATHF: It's nice to see someone still using that Cisco hardware.


Why not right? Still selling it, no EOL on it yet, but from that group of switches it was the only one not to get a new update last year (Since the 8MB flash on it), so it's latest is from 2014... But they work great, with so many options, I had to do a lot of research on them when I got the first one. Now I have six, and one un-managed 16 port for my AV center. These things are wonderful, oh your niece is up way past her bedtime, lock the port down, they have no idea what happened, oh no your wireless is off too? Ooops.. GO TO BED! LOL

Alozaros wrote:
this might help you with VLAN's on WRT series

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=317199

p.s. kernel-panic69 could you retrain from unnecessary acerb comments....

1. its very unclear what the chap wants to achieve and how, as well on this diagram, i do not see any IoT he was talking about...do you see any???
2. i decided to share my solution to the ATHF problem...so let's give ATHF chance to decide what is useful or not... am I clear ??


Thank you Alozaros, I will look at the link later, but I may need another router for this to work, trying to do it easy as possible lol. Most of the IOT things are, plug switches, alexa, google minis, water leak alarms, smart bulbs.

My security cameras aren't allowed to communicate with the internet. If that helps lol...
If I made out an entire topology, it would take me weeks, and probably end up looking like a bunch of scribbles Laughing.

And I understand you are helping, you all are (which is the reason we are all here right?), and there have been so many posts in my life, where I go, what is person wanting? After getting lost in the comments, and having to scroll back to the top.

p.s. There shall be no fisticuffs here today!

_________________
Tutorial for flashing WRT series
WRT Installation,Upgrade & Basic Setup–Cliff Notes
DD-WRT Firmware: r42054: WRT3200ACM, WRT1200ACv1 (Smart crap subnet), WRT1900ACv1
Velop:3 WHW0101, RE6500, RE9000
TWC/Spectrum - 300/25
SysLog Watcher 5, Security Onion on Virtual Box, Fingboxes, PiHoles
blkt
DD-WRT Guru


Joined: 20 Jan 2019
Posts: 1211

PostPosted: Sat Mar 07, 2020 8:22    Post subject: Reply with quote
I forgot to mention the EA8500 newer board revision is missing the 5x1 serial header pins.

They are standard pitch (0.1" 2.54mm) so fairly easy to fix with soldering tools.

http://mrjcd.com/EA8500_DD-WRT/

https://www.s-config.com/linksys-e8500-dd-wrt-router/

If the retail box art is blue and white, it's an older model. If it's blue, white and green you have a newer one.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6534
Location: Texas, USA

PostPosted: Sat Mar 07, 2020 8:39    Post subject: Reply with quote
ATHF wrote:

kernel-panic69 wrote:

@ATHF: It's nice to see someone still using that Cisco hardware.


Why not right? Still selling it, no EOL on it yet, but from that group of switches it was the only one not to get a new update last year (Since the 8MB flash on it), so it's latest is from 2014... But they work great, with so many options, I had to do a lot of research on them when I got the first one. Now I have six, and one un-managed 16 port for my AV center. These things are wonderful, oh your niece is up way past her bedtime, lock the port down, they have no idea what happened, oh no your wireless is off too? Ooops.. GO TO BED! LOL


Getting the GPL from Cisco to do any patching for retired or active gear can be a PITA, but not impossible. They just kinda frown on you if you patch things and then release it to the public.

ATHF wrote:

p.s. There shall be no fisticuffs here today!


I took my response to PM. *giggle*

_________________
Official Forum Rules, Guidelines, and Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW - TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?

---------------------------------------------------------

Linux User #377467 counter.li.org / linuxcounter.net
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum