ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Redoing Home Network

    IT Discussion
    11
    118
    3.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • scottalanmillerS
      scottalanmiller @brandon220
      last edited by

      @brandon220 said in Redoing Home Network:

      @scottalanmiller said in Redoing Home Network:

      @jmoore said in Redoing Home Network:

      @jt1001001 said in Redoing Home Network:

      Question: does it make sense to segment certain traffic because of security concerns? I'm thinking of the blanket statements (never backed up with fact, by the way) I've seen to segment "IoT" devices in the home because of lack of security (E.G they get hacked and said hacker now has access to your entire network).

      Well in my readings, they say either method will increase security, as traffic is not supposed to travel between vlans for example. However, as I've learned today, not everything you read in cert books is accurate. So definitely get a few opinions with details.

      They don't, unless those VLANs go into a ROUTER! LOL

      What about routing VLAN traffic on an L3 switch? Does that then classify as a "router"?

      It absolutely is a router, anything that routes at L3 is a router. That's why L3 switches are technically "multi-port routers". However, in the real world, all L3 "switches" use specialty hardware to make it able to do the routing extremely fast. Never as fast as an L2 true switch with similar hardware, but fast enough to hit line speed.

      1 Reply Last reply Reply Quote 0
      • scottalanmillerS
        scottalanmiller @jt1001001
        last edited by

        @jt1001001 said in Redoing Home Network:

        @scottalanmiller wouldn't use use firewall rules to separate the traffic? (either separate firewall or rues in router if we're using a router/firewall combo,and yes I know today firewall/router are essentially the same thing)

        No, the traffic is still mixed in the router. "Separating traffic" is never a thing. What is a thing is "ability to attack each other". You already do that, right? You have firewalls on each device to already limit what device can talk to each other.

        The VLAN + Firewall combination is only ever a secondary security tool to do a very rudimentary duplication of what should already exist on a per machine basis. That doesn't make it bad, we just have to be realistic. It's not about separating traffic (that's done in the switch on every network anywhere), nor about providing a block to attacks, it's about attempting to block an attack on another layer of attack blocking.

        1 Reply Last reply Reply Quote 0
        • jmooreJ
          jmoore @scottalanmiller
          last edited by

          @scottalanmiller Ok appreciate the video. That was enlightening. Half of what I studied is probably wrong lol. I didn't realize that cert was so bad, or I would have just skipped it entirely. Their blanket statements about things definitely caused me to make some bad decisions. However, I should have dug deeper into the material. I just figured I would encounter deeper info in later certs. So, thanks for the explanation!

          jmooreJ scottalanmillerS 2 Replies Last reply Reply Quote 0
          • jmooreJ
            jmoore @jmoore
            last edited by

            @jmoore said in Redoing Home Network:

            @scottalanmiller Ok appreciate the video. That was enlightening. Half of what I studied is probably wrong lol. I didn't realize that cert was so bad, or I would have just skipped it entirely. Their blanket statements about things definitely caused me to make some bad decisions. However, I should have dug deeper into the material. I just figured I would encounter deeper info in later certs. So, thanks for the explanation!

            So in what situation do vlans make the most sense and what is their purpose there? Just security to keep machines from talking to each other?

            scottalanmillerS 1 Reply Last reply Reply Quote 0
            • scottalanmillerS
              scottalanmiller @jmoore
              last edited by

              @jmoore said in Redoing Home Network:

              @scottalanmiller Ok appreciate the video. That was enlightening. Half of what I studied is probably wrong lol. I didn't realize that cert was so bad, or I would have just skipped it entirely. Their blanket statements about things definitely caused me to make some bad decisions. However, I should have dug deeper into the material. I just figured I would encounter deeper info in later certs. So, thanks for the explanation!

              CompTIA doesn't do later certs, as those would require, you know, hiring IT people that actually know material lol

              1 Reply Last reply Reply Quote 0
              • scottalanmillerS
                scottalanmiller @jmoore
                last edited by

                @jmoore said in Redoing Home Network:

                So in what situation do vlans make the most sense and what is their purpose there? Just security to keep machines from talking to each other?

                Correct, that is essentially their only function. In some extreme cases, they can be used to isolate broadcast traffic, or to do "LAN level" performance tweaking, but most of that is just ridiculous in practice. Nearly the only legitimate role of VLANs is to provide isolation containers for networks.

                That means.... provide the isolation one gets from isolated, dedicated hardware, but without the physical performance benefits of having isolated hardware (or the cost.)

                1 Reply Last reply Reply Quote 0
                • JaredBuschJ
                  JaredBusch
                  last edited by JaredBusch

                  @jmoore said in Redoing Home Network:

                  @jmoore said in Redoing Home Network:

                  @scottalanmiller Ok appreciate the video. That was enlightening. Half of what I studied is probably wrong lol. I didn't realize that cert was so bad, or I would have just skipped it entirely. Their blanket statements about things definitely caused me to make some bad decisions. However, I should have dug deeper into the material. I just figured I would encounter deeper info in later certs. So, thanks for the explanation!

                  So in what situation do vlans make the most sense and what is their purpose there? Just security to keep machines from talking to each other?

                  Correct. Here is an ER-4 at a client.

                  • eth0 = WAN
                  • eth1 = Unused
                    • was LAN until I moved it to eth3 (SFP)
                  • eth2 = Credit card machine.
                    • Outbound NAT makes it X.X.X.138
                    • This could easily have been a VLAN if needed, but I had the extra port, meh.
                  • eth3 = LAN & WiFi
                    • Outbound NAT makes it X.X.X.138
                  • eth3.10 = Guest WiFi
                    • Outbound NAT makes it X.X.X.140
                  • eth3.20 = IoT shit
                    • Outbound NAT makes it X.X.X.140

                  5d337fdc-a6c4-4d80-8393-f8fc429cfbdf-image.png

                  None of the local subnets are allowed to talk to each other by firewall rules.
                  8de5fcff-7fc0-45b3-8827-3e9ac30cb5d2-image.png
                  aaef09bd-ddc7-4d3d-a4db-045f3505eeeb-image.png

                  jmooreJ EddieJenningsE 2 Replies Last reply Reply Quote 0
                  • JaredBuschJ
                    JaredBusch @Grey
                    last edited by

                    @Grey said in Redoing Home Network:

                    The Ubiquiti USG can handle 1gig connections without a problem.

                    The original USG most certainly cannot handle it if you have traffic shaping or QoS or a number of other things that kill offloading.

                    1 Reply Last reply Reply Quote 0
                    • JaredBuschJ
                      JaredBusch @Grey
                      last edited by

                      @Grey said in Redoing Home Network:

                      Either get an AP that matches the rest of the system, or get the rest of the Ubiquiti equipment.

                      FFS, are you on crack?

                      EdgeMax is Ubiquiti equipment.

                      The EdgeMax line has no wireless at all. So you have to provide a separate device for an access point.

                      GreyG 1 Reply Last reply Reply Quote 0
                      • jmooreJ
                        jmoore @JaredBusch
                        last edited by

                        @JaredBusch Ok thanks for the sample config. I see what your talking about with the rules.

                        1 Reply Last reply Reply Quote 0
                        • EddieJenningsE
                          EddieJennings @JaredBusch
                          last edited by

                          @JaredBusch said in Redoing Home Network:

                          None of the local subnets are allowed to talk to each other by firewall rules.

                          This is the scenario I think of when you want (need?) to isolate and segment LAN traffic, yet each segment needs Internet access and you have only one WAN connection.

                          1 Reply Last reply Reply Quote 0
                          • scottalanmillerS
                            scottalanmiller
                            last edited by

                            Youtube Video

                            1 Reply Last reply Reply Quote 0
                            • scottalanmillerS
                              scottalanmiller
                              last edited by

                              Youtube Video

                              1 Reply Last reply Reply Quote 0
                              • jmooreJ
                                jmoore
                                last edited by

                                Thanks Scott for all these videos. You cleared up a lot of actual and implied questions, along with correcting my erroneous thought process. Much appreciated. I'll be questioning things I read much more now.

                                1 Reply Last reply Reply Quote 2
                                • GreyG
                                  Grey @JaredBusch
                                  last edited by

                                  @JaredBusch said in Redoing Home Network:

                                  @Grey said in Redoing Home Network:

                                  Either get an AP that matches the rest of the system, or get the rest of the Ubiquiti equipment.

                                  FFS, are you on crack?

                                  EdgeMax is Ubiquiti equipment.

                                  The EdgeMax line has no wireless at all. So you have to provide a separate device for an access point.

                                  Ok, I should have been more clear in that. I wouldn't go to a product line that not designed for home use.

                                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                                  • scottalanmillerS
                                    scottalanmiller @Grey
                                    last edited by

                                    @Grey said in Redoing Home Network:

                                    @JaredBusch said in Redoing Home Network:

                                    @Grey said in Redoing Home Network:

                                    Either get an AP that matches the rest of the system, or get the rest of the Ubiquiti equipment.

                                    FFS, are you on crack?

                                    EdgeMax is Ubiquiti equipment.

                                    The EdgeMax line has no wireless at all. So you have to provide a separate device for an access point.

                                    Ok, I should have been more clear in that. I wouldn't go to a product line that not designed for home use.

                                    I'm the opposite. I won't use anything meant for "home" use. Home equipment is always low quality and marketed to consumers, nothing good is sold that way. Everything good in IT is targeted at discerning IT pros. That's where you'll find the best quality and best options, because it's the only market where people are actually evaluating both the price and the features/quality rather than just buying based on ads or sales.

                                    jmooreJ 1 Reply Last reply Reply Quote 1
                                    • jmooreJ
                                      jmoore @scottalanmiller
                                      last edited by

                                      @scottalanmiller I'm the same way, I get that habit from my Av days. I bought Allen & Heath mixing boards, QSC amps, and small Community speakers. This is all professional equipment and it had more options and lasted a lot longer. In fact all those pieces are still working today.

                                      scottalanmillerS 1 Reply Last reply Reply Quote 2
                                      • scottalanmillerS
                                        scottalanmiller @jmoore
                                        last edited by

                                        @jmoore said in Redoing Home Network:

                                        @scottalanmiller I'm the same way, I get that habit from my Av days. I bought Allen & Heath mixing boards, QSC amps, and small Community speakers. This is all professional equipment and it had more options and lasted a lot longer. In fact all those pieces are still working today.

                                        Yup, I can from the audiophile world, too. And it was often cheaper to get hifi gear than to get the crappy, sounds horrible consumer junk.

                                        1 Reply Last reply Reply Quote 0
                                        • 1
                                        • 2
                                        • 3
                                        • 4
                                        • 5
                                        • 6
                                        • 6 / 6
                                        • First post
                                          Last post