Trying to understand the tradeoffs between these. Currently have Proxmox box with dual NIC ports and NVR and Home Assistant. Cameras are on isolated network. Starting to get some onvif cams so want to use HA for notifications. Have a Reolink doorbell cam initially set up on the main network with their app but want to move it to the isolated network. Is working fine but see a lot of suggestions of VLAN. Plus seems to be that both could be routed through one cable so I could have both at different locations with less wiring. Negative is I need switches that can deal with VLAN tags. Negative of separate networks is more wire and need for 2 NICs. I have some old ddwrt routers that may work for that. But most of my cams and other stuff are home run to a wiring closet and I already have 2 NICs in the box with the stuff that needs to do both (for now at least). Don’t see a reason to go to VLANs. Am I missing something?
VLANs
Sounds like your understanding of VLAN’s is correct.
In a nutshell you tag packets on a “Trunk” link so that you don’t have to run separate wires for each VLAN - although technically if you never tagged any packets you could drop the V (virtual) since each LAN would be independent / isolated from each other.
In a corporate environment it’s probably a bit more useful since you don’t know in advance what networking/security posture you need, so you can setup a basic cable layout - connect all the jacks to a networking room on each floor, then connect the floors together. They you can overlay the actual networking requirements “virtually” on top of the physical hardware.
The whole discussion is a three way trade off: Cheap, Performant, Flexible (Pick 2).
- Cheap + Performant - Fixed “Dumb” LANs
- Performant + Flexible - VLANs
- Cheap + Flexible - Send all packets back to a central router (hub & spoke). **
** - The central router typically becomes a bottle neck.
For a home environment most of this becomes irrelevant, in that there are typically only 2 bottlenecks:
- The internet connection.
- Moving a single large file to a NAS
Home Routers
Some home routers blur the line between:
- Zones
- VLANs
- Subnets
- Ports
- Tagging / Trunking
- Firewall rules.
So people will often say that they use a separate VLAN for X or Y (I have said the same in various posts).
What they really mean is that they use a separate subnet with firewall rules to control the access between subnets - if you have separate (routable) ports on a router there is no need to use VLAN’s to achieve that, although your router software may force you do do so - if the router software doesn’t provide another way to do it.
Trust Levels
The real question is how many trust levels do you need on your home network?
In my case I said two:
- Untrusted - Home Assistant + IOT
- Trusted - Everything else
I can see the need for more trust levels for Guests / Family / Kids - especially if you work from home.
Anyway once you identify the number of trust levels you need, then you can choose how to implement them (VLANs or separate physical LANs).
Note: You also need to think about WIFI - higher end gear can expose VLAN’s as separate WIFI SIDs using a single AP, its much more difficult to do that without VLANs.
Cameras
I was able to say that HA was untrusted, because I don’t have any cameras - hence if it gets compromised someone could mess with lights, AC, motion sensors etc - i.e. stuff that wouldn’t really be so bad if it was compromised.
I am not sure I would want to put Cameras into the same category - the issue you will have is which trust zone you put your cameras in and what will the rules be for crossing trust zones.
Generally HA is happy if everything it talks to, is in the same Subnet / Trust zone - it gets less happy when it can no longer broadcast to find/talk to devices.
One minor point to add is when you run into windows systems (running desktop not server, but even on server) it’s often easier to use separate NIC’s rather than VLAN’s. Windows support for VLANs exists, but is dependent on drivers’ support and drivers for windows NIC’s are often supported poorly.
Linux support for vlans are pretty complete.
It’s arguable if VLAN’ing is a networking (device) concern or a host concern.
I understand that in some specific cases, most notably:
- File Servers
- NAS
- Virtual Machine Host.
There are some legitimate reasons for needing the host to be VLAN aware.
However for a typical home user, I struggle to even make the case that it’s necessary for a fileserver or NAS to be VLAN** aware.
Saying that another way most people end up on that path because they want to do it (hobby) not because it’s actually necessary.
** - I am not singling out VLAN’s here - I would also say it’s typically not necessary for a home computer to be on multiple physical LANs/subnets.