I’m sure many people have security concerns with certain IoT devices that are on the market. About a year ago, I was wanting to bifurcate my IoT things in to two networks and have one of them not connect to the internet, but I was told that Home Assistant wasn’t really set up for that.
While I could do this at the router level (ban certain local IPs from connecting to the internet), I would be a lot more comfortable if I could avoid having these potentially untrusted devices communicate with any device that can connect to the internet except Home Assistant.
I think it would be nice to be able to connect my Home Assistant computer to two different networks, one that has internet and one that doesn’t. Then I could put all my IoT devices that don’t need internet to work for my purposes could be on my non-internet network and my ones that need internet could use the internet network and have Home Assistant manage all of them as normal.
For example, I see no reason for my basic smart thermostat to connect to the internet if I’m using Home Assistant to manage it. So, I would like it on my non-internet network and have Home Assistant decide how to set it using what ever internet data is required (e.g. weather forecast).
While you are waiting on this enhancement request, I would check out Firewalla microsegmentation. Get the security you want, right now w/o the complexities of vlans, reflectors or advanced networking knowledge.
This can already be done. HA is naturally a host device designed for flat networks, but it can utilize more than one NIC, both physical and virtual simultaneously. Doing so will more than likely result in further configuration, as there will be challenges (VLAN segmentation? Isolation? Reflectors? Firewall rules? Etc.), but it is possible. One of the bigger hurdles in doing so is making sure HA is capable of seeing the discovery protocol packets (mDNS? AVAHI? Etc.).
With that said, multi-homing HA in multiple networks isn’t for the feint of heart. It tends to create more headaches than it does solve problems. There are other avenues, as mentioned above, like microsegmentation. The simple truth is your router/firewall is the brain of your network/s. Anything that could be done to the network/s by the router/firewall, should be done by the router/firewall before any other device is messed with, in most normal cases. I use OpenWrt , which allows me to block certain devices on my IoT network from the internet using one traffic rule in the firewall and I can do it using the device’s IP and/or MAC address. I can also isolate devices connected on the IoT network so they can’t communicate with any other device on said network.
YMMV, but the capability is already there. User beware, though. This topic can be rather sensitive to some people. Good luck.
@mmstano See, that all sounds like a massive headache and I think that it might be easier on the user side if there was just some kind of internal modularization of network connections so that it can monitor and send messages across both networks, then have the two networks be completely independent entities with the only thing in common being Home Assistant across both of them.
@sidjohn1 I’ll have to read up on this later, but thank you for sharing it. It looks, at a surface level, to be like what I want. But I my gut says having two networks, disconnected except through Home Assistant, would be so much safer and intuitive if possible.