I have recently swapped out my final unmanaged switch with a Ubiquity Unifi Switch completing a fully managed wired network at home. With the networking limitation removed it was time to start separating the network.
The goal of segregating the network is so that:
Other sites and a quick google will describe what a VLAN is and worth reading up before going further.
I’m not a network admin so any suggestions to improve my setup would be really appreciated using the comments below.
I have created the following VLANs I’m additional the default:
Each network serves a purposes with different levels of access. Using a combination of firewall rules to control network and web access and Radius for authentication and identity management allows different policies on each network.
The guest network is designed to isolate each client and not allow access to the other networks. The guest network is the most locked down network. On top of this, a default DNS with filtering enabled is supplied to devices on the network. Firewall rules prevent users choosing a different DNS provider to get around the web filtering. VPN is also forbidden to prevent tunnels punching a hole through the filtering.
Similar to guest, with the addition of age related content filtering added.
All Internet connected devices apart from personal devices such as laptops and phones. Connections can only be initiated from other networks to the IOT. Once established, data can go both ways. IOT devices could see eachother.
Example smart home devices like bulbs, switches, etc.
All other devices that do not fit in any of the categories above with minimal restrictions.
I have seen problems with updating firmware on devices if the device like you mobile phone is on a different VLAN. To get around this, I have allowed some devices to connect to different networks to workaround the issue.
Separating the network virtually allows a lot of flexibility and ways to control devices using the same cables. I will write up a future post on how to implement the above.