This question has been asked before, but I'm looking for fresh opinions and insights. I just created an IoT VLAN and am going to slowly start moving my smart home devices to it. But I can't decide if I want to keep HA on my trusted VLAN or move it to IoT. What do you do and why?
1 Like
Yes I have mine on the same vLAN and subnet also
I have an IoT VLAN specifically for IoT devices that I trust less than HA. HA is on a separate VLAN, however I've set up mDNS proxying between those VLAN's so that HA can see my IoT devices and adopt/control them.
VLAN separation serves a security isolation purpose, which boils down to trust. If you trust HA as much as your IoT devices, same VLAN is fine. If you trust one more than the other, separate VLANs with explicit access rules to allow what you trust through and block anything else.
Yes, but.
HA has two virtual NIC (HAOS on Proxmox). One is connected to each vlan. I'm sure I could put it fully in the IOT vlan, but I didn't. There are some services and devices that needed to not be on IOT vlan, so this makes it easier.
There were some funny things that happened with multiple vlans. Something to do with mDNS being that unifi reflects it across the vlans and the HA sees both sides of it, I think. It would run CPU up occasionally and crash the system. Had to change some settings. In HA cli, firewall, or both. Can't remember.
Other than the learning pains, it works good. Sonos however didn't like being on the vlan. Easier to give up and let it be on an unrestricted vlan. Most other devices play ok. Had to get Kasa to flash some special firmware on some bulbs that were programmed to reset every 10 minutes if they didn't hit their cloud endpoint.
I keep ha on my lan or or how you said it trusted vlan.
Why?
Well because you can control it especially in docker.
You can't actually control devices that are cloud dependent or have closed source firmware or disabled root access.
You can put ha in separate vlan but I didn't set up my network like that as I don't want to over complicate things. I want security but I don't want to be sysadmin 24/7 365 days.
If you want to use VLANs and have your IoT devices (and I see HA as such one) spread out over multiple VLANs, then you need to understand the different kind of network packets, like Unicast, Broadcast and Multicast.
The number one error with VLANs is that people think they know network, but they only understand Unicast and then try to rectify their lack of knowledge by fiddling with their firewall, which also only affect Unicast.
Even if they removed the firewall completely they would still have issues.
VLANs will split the broadcast domain and that is the issue.
Once you understand that then Multicast will make sense too and then you can set up Multicast proxies, like for mDNS.
mDNS is however only one protocol that use Multicast/Broadcast, so you need to understand this part.
Many install a mDNS reflector and then most things work, but later they get some device that use a proprietary Multicast protocol and they will then not understand that the device works, but they themselves are the cause of the failure.
1 Like
Yup that can happen with reflectors and if you have multihomed your HA.
The issue occur if you have devices named the same on multiple VLANs.
And then many sat they haven't, but realize later that there network gear, especially the router might be on multiple VLANs and announce itself with the same name on all VLANs.
1 Like
Looking into it further. Initially I used this APP to address the issue.
Of note, it appears there is a cli command that HA added since per this issue that supercedes the need for the app:
That "official solution" is news to me, and my "network manager fix" app is showing lots of
[08:10:26] INFO: no changes needed for enp0s18 (Supervisor enp0s18)
I just double checked firewall rules and while I have some set to block mDNS from the HA MAC address, they are disabled, so I'm not actually sure what "fixed" it at this point.
@WallyR, I'm definitely in that "partially understand the different packet types" camp. Enough to muddle through fixing something, but not enough to explain it well.
That was the point I tried to make.
Firewall rules have no effect on Multicast.
It is like trying to empty your leaking row boat with a pair of tweezers.
I can't access my ha instance from any of my VLAN. I can't access any of other local services I run on my server or any of my routers, if I didn't allow it per device. I can scan my VLAN using nmap but it give me 0 clients connected to it although this is not the case.
In my rule book this is more then ok.
1 Like
No kidding. I was pretty sure it worked at the time, but then disabled them because it was causing some other issue down the road. Would it have made any difference if they were set up like this, on the LAN Local area?
Yes, and networking hasn't changed since the last time it was asked and answered.
'Here be dragons' is not just a warning, but an useful search term on these forums to find out more.
Succinctly: Don't unnecessarily subject yourself to a lot of pain. Plan wisely, and clearly understand what you are doing and why before you embark on this painful journey.
No.
A firewall works on Unicast.