I am setting up my new B One router and will have several VLANs. One VLAN will be IOT devices only, and they will be blocked from seeing each other. However, my Home Assistant server will need to be on that VLAN also and able to see the other devices; how do I configure that?
Then how do I make the Home Assistant server accessible from another VLAN that my home computing devices (iPhone, desktop computers, NAS, etc) are all on? I presume this requires some sort of bridging. I will be able to have static IP addresses wherever necessary.
I am very new at this… appreciate any help or guidance. Thanks
I am not an expert in this, but I suspect you’ll need to do something similar to what I have done. I will caveat I have not messed with Home Assistant, and am unfamiliar with how it finds and manages devices. I will assume with this discussion you are using the B-Ones native access point (or networked Peplink access points). If you have a separate access point that is non-Peplink, that my change things depending on how they handle network isolation and VLANs.
My network toplogy goes (roughly) like this, and may be similar to what you need.
- IOT devices on their own VLAN with layer 2 isolation ON (cannot see each other over WiFi). Inter-VLAN routing OFF
- Apple TV and some other devices that need to see each other on their own VLAN without layer 2 isolation. Intern-VLAN ON, but internal firewall blocking other access to other VLANs
- Personal devices (phone, laptop etc) on their own VLAN, with inter-VLAN on. Allowed to reach into Apple TV VLAN for airplay, etc.
Mine is obviously a little different, since I do not care to talk directly to the IOT VLAN. To address your HA sever getting to the IOT devices, I can think of 2 options:
- Put the HA sever on the same VLAN without layer 2 isolation, turn on inter-VLAN routing. Assign a static IP to the HA sever. Set 2 internal firewall rules (in order): ALLOW inter-VLAN traffic on the HA IP and BLOCK all internal traffic for all IPs. The first rule should allow the HA sever to reach into other VLANs (if needed, see next section), then the other IOT devices should trigger the next rule. Obviously this is less secure than Keeping the IOTs from seeing each other. I believe you HAVE to have layer 2 isolation off in this case, unless your server is on ethernet. Layer 2 isolation ONLY applies to communcation over WiFi on that VLAN. More specifically, layer 2 isolation applies to the SSID. Anything on that SSID cannot see or talk each other. That does not hold true for devices connected via ethernet to the same VLAN, as that is outside the SSIDs layer 2 isolation. My only caveat here is I do not know how peplink layer 2 isolation handles wired devices talking to things on the same VLAN that are connected to an SSID associated with the VLAN. My assumption is that IOT could see ONLY the HA sever, and HA could see everything on the VLAN.
- Second option is to keep IOT VLAN, keep layer 2 isolation, turn ON inter-vlan routing, but set a firewall rule to block interal traffic OUT of this VLAN. Then put the HA Sever in its own VLAN and allow it to reach into the IOT VLAN. I believe (but am not 100% sure) that the layer 2 isolation only applies to the devices in the IOT VLAN, and that the HA sever should be able to see all devices in the IOT VLAN coming in from a different VLAN. Not 100% confident, there might need to be some specific rules/routes set up here I am unaware of. Some examples include setting up UPD forwarding rules to allow SSDP, I believe there are some examples of that on this forum. Peplink also has rules allowing Bonjour forwarding between VLANs. Bonjour is an Apple specific implemention of zero configuration networking using mDNS, unclear of that rule set allows other zero config mDNS implementations.
The 2nd part to your question is more straight forward. Making the HA device accessible to other devices is fairly simple. Whatever VLAN it ends up, make sure inter-VLAN routing is on. If you want the HA sever to be able to reach out inside your network, set a rule allowing it to access your main VLAN. If not, you can block it. Then on your main VLAN, enable inter-VLAN and set a rule allowing it access the VLAN the HA sever is on. You can even specifiy that your main VLAN ONLY access the IP for your HA sever. I have this set up in part of my topology for specific IPs to reach a different IP on a separate VLAN.
Hopefully that helps get you started.
(edit: added some clarification about option one for the HA to IOT communications)
This conversation caught my attention given I have a fairly large number of smart home devices. Having spent a lot of time thinking about how to securely set things up, there is probably no perfect solution, just options with trade offs. Beagle’s setup has some interesting features worth considering.
My setup has an IOT VLAN where all the gadgets reside, plus I use HomeBridge and recently added a Home Assistant instance as part of an intended migration - both of these support my use of non-compliant Apple Homekit devices, as that is my primary smart home platform. My IOT VLAN has inter-VLAN routing off, layer 2 isolation off - so yes, all the gadgets can see each other. Most are from major manufacturers - for what that’s worth. However for some I have added firewall rules which block them from the internet, since those devices don’t need, nor do I want them phoning home for any reason.
I have one iPad on the iOT VLAN and it is my smart home hub; through that I can get to everything. All other computers and “important” devices are on another privileged VLAN. So the smart home devices are in their own sand box. The Apple Home app runs fine on them, with its access to smart home gadgets through the internet.
Steve5, I probably would not want to put Home Assistant on the VLAN with all of your “home computing devices”, just my opinion on that. I know you want to get to it if it’s your smart home platform, but I understand there is a way to make Home Assistant available on the internet, but I’ve not done that, nor do I plan to, but that is another option for getting to it from those devices.
Lastly, from time to time I collect data on my IOT devices and do some analysis to see who’s doing what. Seems like a sensible thing to do. Security cameras seem the most active, the rest much quieter, and anything that looks funny that doesn’t need internet access gets neutered. One more thing, all of my IOT devices are routed through a Proton OpenVPN connection on my B One, routed to that connection with an outbound policy.
As mentioned, lots of choices and stuff to consider, with no perfect solution.
Many things to learn, i think. Some examples might be useful.
Inter-VLAN routing, layer isolation, outbound firewall policy… How they interact and dependencies between them.
I want full HA access from my phone when at home when internet is down…