How to secure home network with budget 200$?

[fat_pikachu]

Currently I have a router TP-LINK Archer C6 AC1200 which can’t create VLAN - only guest network.

I would like to be secured in case of being hacked, spied on etc (devices in main network). Budget 200$

I’m considering:

1. putting all IoT devices into guest network. I don’t use guest network so it’s not a problem.
2. flashing current router with openwrt, then create VLANs
3. buying new router + switch + ap with VLAN support (TP-Link ER605 router, TL-SG2008P switch, EAP 110)
4. buying new sim card and creating hotspot from old phone and then put IoT devices into this network - crazy idea, almost for free, maybe not so bad?

I will use dedicated tablet for steering home assistant so I dont need to use my mobile phone for steering ligts etc (separted network is fine for me).

What would you do?

[tom_l]

@fat_pikachu

putting all IoT devices into guest network. I don’t use guest network so it’s not a problem.

Not a good idea. This idea of a guest network is that it has access to the internet but not to the local network or other devices on the guest network.

@fat_pikachu

buying new router (or maybe switch + access point) with VLAN support - probably out of budget

An EdgeRouter X is incredibly cheap for the power it has. It requires some knowledge to configure though, there aren’t a lot of GUIs. A Ubiquiti AP AC Lite might be within your budget too, if you run the Unifi software on an existing server.

@fat_pikachu

buying new sim card and creating hotspot from old phone and then put IoT devices into this network - crazy idea, almost for free, maybe not so bad?

Sounds like a terrible idea. The wifi coverage will be awful and most cellular networks use CGNAT complicating remote access.

@fat_pikachu

flashing current router with openwrt, then create VLANs

Viable idea but… unless you are quite familiar with VLANs you will probably end up making your network less secure.

[jaalperin (Jeff Alperin)]

OpenWRT for sure. Start with your current router. However, a Pi4B puts most routers to shame.

[koying (Chris B)]

I second that. I bought my last router (a while ago) specifically to be able to install OpenWRT on it.

Now, generally speaking, using VLAN’s is a recipe for headaches, imo.
Not sure what kind of hacking or spying the OP has in mind, but plain using SSL everywhere would mitigate 99.99% of those.

[k8gg]

@koying

Now, generally speaking, using VLAN’s is a recipe for headaches, imo.
Not sure what kind of hacking or spying the OP has in mind, but plain using SSL everywhere would mitigate 99.99% of those.

I’m interested in this topic also.

I understand not all IoT devices would/could be easily configured to go SSL (we are talking about local SSL within LAN, right?) So if SSL is not 100% feasible, and VLAN introduces headaches, what other options do we have?

Do we… firewall everything with a bunch of rules?

[koying (Chris B)]

@k8gg

what other options do we have?

DO.NOT.USE.WIFI.IOT

Now, seriously, what spying/hacking do you think your Tuya plug will do?
Phone home, that’s sure, but that’s the base idea of cloud-based IoT (unless you manage to reflash it, ofc).

Until someone point me to an actual hacking example where a VLAN would have made a difference, it’s all FUD to me…

[Tromperie (Frank Collins)]

I suggest an older x86 computer with two Gigabit ports & install OPNsense as the router, buy a switch, & use your current router as an AP. It is what I use.

[ghvader]

@fat_pikachu

1. tting all IoT devices into guest network. I don’t use guest network so it’s not a problem.
2. flashing current router with openwrt, then create VLANs
3. buying new router + switch + ap with VLAN support (TP-Link ER605 router, TL-SG2008P switch, EAP 110)
4. buying new sim card and creating hotspot from old phone and then put IoT devices into this network - crazy idea, almost for free, maybe not so bad?

I will use dedicated tablet for steering home assistant so I dont need to use my mobile phone for steering ligts etc (separted network is fine for me).

What would you do?

buy a mini-pc (something like an intel nuc, you can get cheaper versions from other OEMs) and put pfSense on it.

[Tromperie (Frank Collins)]

I don’t have any objections to pfsense, only that I’ve found OPNsense to be more user friendly, including the forums.