Matter over Thread with Apple Thread Border Router across VLANs (Solved)

Configuration Matter/Thread
1

I spent several days debugging this and wanted to share what ultimately fixed it.

Setup

  • Home Assistant OS on bare metal
  • Apple TV as the Thread Border Router
  • Home Assistant on a server VLAN
  • Apple TV on an IoT VLAN
  • UniFi network

Symptoms

  • Apple Home worked perfectly.
  • Home Assistant couldn’t commission Matter-over-Thread devices.
  • Matter logs showed the device’s Thread IPv6 address, but communication failed.

Solution

I added a second network interface to Home Assistant on the Apple TV’s VLAN and configured it as:

  • IPv4: Disabled
  • IPv6: Automatic

My primary NIC remained on the server VLAN and continued handling all IPv4 traffic.

As soon as the second interface received its IPv6 address, Matter commissioning completed successfully and my Aqara U300 and U400 locks started working.

The key was making the second interface IPv6-only. My first attempt with both IPv4 and IPv6 introduced routing issues, but disabling IPv4 avoided that while still giving Home Assistant direct access to the Apple Thread network.

Hopefully this helps someone keep their VLANs separated instead of moving Home Assistant onto the IoT network.

2

Your multihomed HA setup might break with each reboot, since HA have really poor tools to manage service binding to NICs.

It might work now, but it is not a good solution.
Your setup might also not require IPv6 in both your VLANs, but others can maybe not shutdown IPv6 on one VLAN.
IPv6 is also hard to manage that way, because IPv6 is designed to be configured automatically and without needing any other devices, like a router.

3

FWIW, I’ve had my HA dual-homed, with both IPv4 and IPv6, for a few years with no issues. One thing I learned is that binding a service to a NIC does not control outgoing traffic. A device can still make other connections using another interface depending on your routing tables. In this case, HA bound to the LAN IP will only accept connections on the LAN. But HA can still send MQTT, DNS, API calls, etc. out of another interface. Controlling outbound traffic will require routing tables, policy routing, firewall rules, and/or vlans. Since HA is a host device, it’s not designed to do any of that out of the box and will need custom programming to do. Your router on the other hand… that’s what it’s designed to do.

1 Like
4

And some things, like discovery protocols that usually will require broadcasts will need extra non-standard services to be routed, because they are per definition not designed to be routed with standard IP routing.