Separation between IoT and home network

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions
Author Message
makejoint
DD-WRT Novice


Joined: 06 Sep 2015
Posts: 1

PostPosted: Sun Apr 01, 2018 16:51    Post subject: Separation between IoT and home network Reply with quote
Dear all,

my first post here. Please find attached my actual network setup: https://www.dropbox.com/s/8fkumgv0fl1h05p/home_network.pptx.pdf?dl=0

I’m concerned about the growing number of IoT devices, so I ask you gurus if you advise me to separate the network in different domains (and how), in order to avoid low performance on the crappy router provided by my ISP, meaning wifi drop, low speed while streaming, and so on.

A bit of description of my setup in the following:

    my entire home automation is based on a RPi2 with MQTT, InfluxDB, Grafana running on a OpenHABian SD.

    All my IoTs are wifi Sonoff devices (with Tasmota), MAX! for heating with cabled MAX! cube and a USB CUL for the Intertechno-like power switches.

    Manual control of OpenHAB is gained via Android app (BasicUI) or HabPanel, depending on the device I’m on.

    In my network, I serve a NAS with different services. Among others, rsync is what I run via cron on the RPi, in order to save the SD content on the NAS.



Since I still have a ddwrt router around, since I plan to add 10 more Sonoff-Tasmota, and since I’m concerned of ‘friends/ISP colleagues’ playing around, would it make sense to separate the IoT domain (Sonoff, MAX! and RPi) from the Home domain (streaming, www,…)?

If yes,

    how can I still control OpenHAB manually via the Android app/HABPanel (remember Grafana plots)?

    how can I still rsync on my NAS via RPi?


I hope my question is clear. Of course, I’m confused, I know :slight_smile:
Sponsor
MrPete
DD-WRT User


Joined: 09 Jul 2013
Posts: 74

PostPosted: Thu Apr 05, 2018 15:13    Post subject: Reply with quote
My situation is similar but not identical. Here's what I did:
1) Split the network into multiple subnets, with virtual wifi instances for each as needed. In my case I have:
- Internal "secure" high speed, trusted
- Internal, untrusted - for IoT etc
- Guest, lowest priority access

I use QoS to adjust packet priorities.

I set the Guest network to be fully isolated; it can't see anything but the Internet. That's what guests are told about.

You can create firewall holes that allow access as needed between the subnets. Not as easy as I might like but that's the price of separating things out. (In practice, so far I have only created a few such holes.)

Hope that helps a little.
nebulousman
DD-WRT Novice


Joined: 28 Jan 2019
Posts: 3

PostPosted: Mon Jan 28, 2019 16:27    Post subject: how to set up internal, untrusted wireless network for IoT Reply with quote
I’m trying to set my system up with an Internal, untrusted - for IoT etc.

Currently I have a couple of wifi switches on my guest network and Hass.io on Rpi is wired to my primary network. I was thinking if I could gain local access to the switches I could accomplish the goal – i.e. accessing wireless switch with static IP 192.168.2.xx from specific device with static IP 192.168.1.xx.

I don’t know if this is the best way to do it. I’ve seen people talk about setting up a vlan for IoT and I guess I could do that if it were vlan with enabled wireless as my switches are wifi. Not sure if that would make any difference.

Assuming I’m on the right track I can’t fire out how to access my wireless switch which has static IP 192.168.2.xx from specific device (also with static IP) at 192.168.1.xx.

Buffalo WZR-1750DHP
Firmware: DD-WRT v3.0-r37985M kongac (12/16/1Cool
Primary network:
Physical Interface wl1
IP addresses: 192.168.1.xx

Guest network:
Virtual Interfaces wl1.1
Unbridged
IP addresses: 192.168.2.xx
Multicast forwarding - Disabled
Masquerade / NAT - Enabled
Net Isolation – Enabled

Guest network set up following the beginner tutorial (https://wiki.dd-wrt.com/wiki/index.php/Guest_WiFi_%2B_abuse_control_for_beginners) (I skipped the QoS part). I’m new to networking and dd-wrt and trying to learn. Any guidance would be appreciated.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3775
Location: Netherlands

PostPosted: Mon Jan 28, 2019 17:32    Post subject: Reply with quote
Your guest network should already be isolated.

You can connect to the wifi switches when you connect to the guest network yourself.
alternatively use this rule:
Code:
iptables -I FORWARD -i br0 -o wl1.1 -m state --state NEW -j ACCEPT

Supposing your guest network is on wl1.1 if you have setup with a bridge (br1) then use that.

If you want to also separate wired then you have to use vlan's.
Then you have to create a bridge (br1) and set the vlan and wifi on that br1

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
nebulousman
DD-WRT Novice


Joined: 28 Jan 2019
Posts: 3

PostPosted: Tue Jan 29, 2019 14:25    Post subject: Reply with quote
Thanks egc

I definitely can connect to the wifi switches when connected to the guest network but I’d like to connect to them when I’m on the primary network (not the guest network) so I don’t have to switch networks to do it. Also my Rpi is wired and on the primary LAN and it will run automations which could include the switches and I want to be sure those will work (I'm not sure if the Rpi already has this ability to access devices on the guest network as switches carry IPs 192.168.2.xx and the LAN or Rpi IPs are 192.168.1.xx)

On the rule you shared

1) do I paste it into Commands and Save Firewall then reboot router to implement it?

2) I have not set up a bridge and my guest network is on wl1.1 so is the rule allowing any device on my primary network full access to the guest network? If so I’m assuming this would be 1-way (ie guest network users are still prevented from accessing the LAN).

Thanks again
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3775
Location: Netherlands

PostPosted: Tue Jan 29, 2019 14:31    Post subject: Reply with quote
Yep, the rule is supposed to be one way (state new)

First test a rule from the Command line and if it works then via Administration/Commands and Save firewall

If the rule is not working and perhaps borks the router a simple restart will cure it, but if saved the only way is to hit the reset button.
Therefore my advice to always test via the command line (especally things I recommend Smile )

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum