How to set up Apple HomeKit and Hue Bridge with various IOT devices on an isolated Guest VLAN / Guest WiFi
This is a companion post to HomeKit WeMo Hue VLAN AP One Mini AC Mystery Solved
Although Apple HomeKit has high standards for security, it’s still a good idea to keep your IOT (internet of things) devices isolated. This post gives step-by-step instrucitons for setting this up.
- Peplink Balance one (or similar)
- Apple Airport Extreme or Peplink AC One Mini AP (or similar) see https://www.peplink.com/products/enterprise-access-point/pepwave-ap-one/#acmini
- Apple TV (or other HomeKit Hub such as a HomePod) See https://support.apple.com/en-us/HT207057
High level overview:
The goal is to have two different LANs - one “private” LAN and one “guest” VLAN. All un-trusted devices go on the guest VLAN. The guest VLAN can not talk to the LAN, but the LAN can talk to the guest VLAN without restriction. Instead of using Layer 2 isolation or blocking inter-VLAN routing, we instead set up Firewall rules to manage this. We also enable Bonjour fowarding so devices can see each other across the VLANs.
Step by Step:
- Set up your VLAN. I like using 10.x.x.x networks simply because they are easier to type, but any https://en.wikipedia.org/wiki/Private_network private network will do. In my examples, I use 10.0.A.x and 10.0.B.x where A and B are different numbers.
- If you are using an Airport Extreme, use VLAN ID 1003 (see below).
- Make sure Inter-VLAN routing is enabled and you have set a DHCP server:
- Set up your Guest WiFi SSID.
- If you are using an Airport Extreme, configure the guest network as described here: Using Peplink Balance with Apple Airport Guest Network
- If using a Peplink product, click New SSID and set it up like this:
Create the Guest SSID
- Set the VLAN to your guest VLAN
- IMPORTANT Click the “?” icon and then show the advanced settings.
- Make sure Layer 2 isolation is OFF
- On the Network / LAN / Network Settings page, set up Bonjour Forwarding from the Guest LAN to the LAN:
- If you have any ethenet devices (such as a Philips Hue Bridge) that should be on the guest network, configure them by setting one of the Peplink ports to Access / GuestVLAN as shown here. Go to Network / LAN / Port Settings:
- (Optional) Assign DHCP reservations for your devices.
Personally, I like my IOT devices to have predictable IP addresses. An easy way to do this is to use DHCP reservations. Go to Peplink / System / Client List and for each device you want, click the Import button and set a reserved IP address. I like to use numbers such as .100, .101, .102 etc.
- These can be edited later from within Network / LAN / Network Settings / DHCP server.
- Add a firewall rule - this will block all traffic from the Guest VLAN to the LAN for security. Go to Network / Firewall / Access Rules and create a new Internal Firewall Rule:
- Apply changes, reboot everything, configure, and test.
At this point you should be good to go. You should probably power cycle all devices, and then do your normal HomeKit configuration.