this post was submitted on 23 Mar 2024
154 points (98.1% liked)

Selfhosted

39435 readers
5 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
154
What do I need to separate devices to its own no-internet network and still be able to communicate with within the house and outside? (Diagram provided) (programming.dev)
submitted 9 months ago by Mir to c/[email protected]
50 comments fedilink hide all child comments
 

Hello, I'm planning on creating a home server and getting some cameras.

I would like to have the server, cameras and all IOT devices be disconnected from the internet but still be able to access them within the house from different devices and maybe have limited access to them when outside.

Do I need a specific hardware for this? And what router would support this? I'm still in the planning phase but I'm looking for budget friendly solutions.

Thank you

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 52 points 9 months ago (3 children)

Vlans firewall rules and something to route between the different networks.

This can all be achieved with pretty much every Linux installation.

[–] [email protected] 5 points 9 months ago (3 children)

Are there any decent interfaces for configuring routing and vlans with linux these days?

[–] [email protected] 27 points 9 months ago* (last edited 9 months ago) (2 children)

OPNsense is excellent. You can run it on a cheap mini PC with multiple Ethernet ports and it makes a great router. I run several VLANs through it.

Edit: It's based on FreeBSD, not Linux, in case that matters to you.

[–] [email protected] 5 points 9 months ago

I do the exact same thing, only over PFSense (no issues with OPNSense at all, I just get along with PFSense better). 6 VLANs and 7 APs around the house, no VLAN can see the other, and all my "smart devices work exclusively local, and if I need to reach them from outside, I VPN into my house over WireGuard. It sounds more complicated than it is. Once it's all set up, it just works.

[–] [email protected] 2 points 9 months ago

Excellent, thanks!

[–] [email protected] 7 points 9 months ago

OpenWRT?

[–] [email protected] 1 points 9 months ago* (last edited 9 months ago) (1 children)

OpenWRT and Untangle are the most user-friendly Linux options for running on your own hardware, but most people in homelab use pfsense or opnsense which are based on FreeBSD.

[–] [email protected] 1 points 9 months ago

Hadn't heard of untangle.

load more comments (2 replies)
[–] [email protected] 34 points 9 months ago (2 children)

This one of those questions I am overwhelmingly eqipped to answer, but only with the weird proprietary knowledge about software defined networking and microsegmentation that my job has endowed me with...

So I'll resist the urge to give you that overcomplicated answer and just say get a firewall like others have suggested.

[–] [email protected] 7 points 9 months ago (2 children)

I bought myself a mikrotik router to force myself to understand networking better. So I would really like to hear your over complicated answer that comes from professional needs. pretty please 🙂

[–] [email protected] 4 points 9 months ago (1 children)

Oh man, uh, here's a primer: https://mkomu.kapsi.fi/hipl/index.php?index=how

I am most familar with HIP, but there are ways to isolate hosts so that they can only talk to what you want them to talk to in a distinctly different way than a firewall. You could have three hosts (A, B, & C) on the same subnet where A can talk to B & C, but B & C cannot talk to each other. Likewise, A and C could have access to an Internet gateway, while B does not.

So far HIP is the only protocol I have seen for microsegmentation that actually works in an intuitive way, but I suspect Wireguard could be used to the same effect with some creative engineering.

[–] [email protected] 1 points 9 months ago (1 children)

After looking through it a little bit, it sounds like HIP is mainly used for verifying hosts' identities. It sounds like you'll still need firewall rules in order to create the scenario in your example, right?

[–] [email protected] 1 points 9 months ago

Not if HIP is a part of your network stack (adding a waist). Unfortunately this is not a plug-and-play solution unless you have the budget for my employer's product, which is not priced for consumers.

[–] [email protected] 1 points 9 months ago

I was just looking into this for myself. Can I ask what you went with?

[–] Mir 5 points 9 months ago (1 children)

So I’ll resist the urge to give you that overcomplicated

Please don't, if it wasn't useful for me someone else might find it useful

[–] [email protected] 21 points 9 months ago (1 children)

You’d put a router with firewall capabilities in place of that cloud on the right. The devices you don’t want to have internet access will be put into a different subnet than your normal home LAN on the left. You’ll then make a “Deny all” rule so that the devices on the right can’t leave their subnet, with the exception of any explicit allow rules that you make.

[–] [email protected] 2 points 9 months ago

This, pretty much - except you can do it with one router, the internet access point/gateway router.

Set up DMZ that can only access internal network, then set up a VPN and use that to access DMZ. If you need to, you can make a pinhole for one service or another, but you shouldn't need to because they're exposed to the LAN, and the LAN is accessible via VPN.

I suppose "DMZ" isn't exactly the right term, there, because that's typically somewhat exposed externally, but.. ..same idea, just no external exposure.

[–] [email protected] 13 points 9 months ago (2 children)

I have a similar set-up

I use a wireless access point that can expose multiple ssid with different vlans (I think it a fairly common feature)

my router runs openwrt and the iot vlan is in a different firewall zone

use wireguard to remotely access the lan zone

[–] [email protected] 2 points 9 months ago

I was attempting this, but TP link doesnt actually care to tag their different SSIDs to vlans and don't provide the configuration to, I only found that their guest may be tagged on some models. Just a word of caution, I think I'll have to use IP range filters to achieve this

[–] Mir 1 points 9 months ago

Does the router creates the VLAN or the access points?

Also to achieve this I have to gave wiregaurd on a device connected to the internet right? I can't install it on my home server if I wanted it disconnected from the internet, correct?

[–] [email protected] 12 points 9 months ago* (last edited 9 months ago) (2 children)

For home, use your firewall. Either physical ports on the firewall with dumb switches or vlans with managed layer 2 switches.

There are many ways to do this. Proxmox can do it with ovs if all your devices are virtualized. Pfsense is probably the most straightforward.

The best way to run pfsense is on dedicated hardware. This would work for you https://protectli.com/vault-4-port/

You'll also then need switches or a managed switch with vlans for each network segment.

[–] [email protected] 8 points 9 months ago (1 children)

Just throwing in the usual comment that OPNSense is a pfSense fork with a nicer interface.

[–] [email protected] 2 points 9 months ago (1 children)

Just throwing in the usual over-complication. The OP can do this with a simple OpenWRT router and by setting a few firewall rules. To be fair there are even some comercial routers from Asus and Netgear with their stock firmware that will allow you to block a device from accessing the internet.

[–] [email protected] 2 points 9 months ago* (last edited 9 months ago) (1 children)

Consumer routers fall apart when you want to do many common networking tasks, like setting up a VLAN on a separate subnet with pinhole access, so when faced with having to buy a significantly more expensive SMB router vs the cheap FOSS solutions others have mentioned, you're better off just going the FOSS route.

Note: some consumer routers can be flashed with FOSS firmware, but be prepared to waste days tinkering and testing.

[–] [email protected] 3 points 9 months ago* (last edited 9 months ago)

Just a few notes:

  1. What you’re describing is not what the OP is asking for. He simply wants a quick solution to block a couple of devices from accessing internet.

  2. I don’t get your “note” as that’s precisely what I suggested the OP to do. And if you actually read the manual and pick a recommend model it can be as simple as uploading the firmware using the router’s firmware upgrade feature.

  3. The scenario you described can be done with OpenWrt on a consumer router and it isn’t that complex to setup. Even older hardware like the Netgear R7800 will be able to handle that.

[–] [email protected] 1 points 9 months ago

Adding to that that you can also easily make a separate WiFi network (tied to a vlan even) for IoT. OpenWRT makes this very easy.

[–] [email protected] 11 points 9 months ago

If you have an AVM Fritz!Box home router you can simply create a new profile that disallows internet access and set the devices you want to "isolate" to that profile. They will be able to access the local network and be accessed by the local network just fine, but they won't have any outgoing (or incoming) connectivity.

[–] [email protected] 10 points 9 months ago (1 children)

Pfsense and opnsense are also very good for this.

[–] [email protected] 8 points 9 months ago (1 children)

Vlan I think. Don't quote me on it

[–] [email protected] 24 points 9 months ago (1 children)

Vlan I think

[–] [email protected] 6 points 9 months ago (1 children)

he's right, though. and a router between them.

vlans are not needed, but they are better than just using different ip ranges without physical seperation

[–] [email protected] 5 points 9 months ago (1 children)

I was just quoting COP because they said not to quote them

[–] [email protected] 2 points 9 months ago

i know, still wanted to add something 🤷

[–] [email protected] 6 points 9 months ago* (last edited 9 months ago)

There's already some good answers here, just wanted to share my "solution"

I had a similar problem where I wanted some specific device to not have internet connection but still be on LAN. My lazy ass solution was to manually set the network settings with default gateway set to 0.0.0.0. With IPv6 it would be [::].

But this is not meant to be an advice. You may not even be able to manually set network settings on some of those IoT devices, and removing default gateway from DHCP server is not exactly an elegant solution. Perhaps you could set it to serve different settings based on MAC, but then the other solutions are perhaps simpler and better in some other way.
As I said, this is not an advice.

[–] [email protected] 6 points 9 months ago

I know vlans is the answer, but I don't know how to set it up. I really need to do this with my own network some day. There must be an OPNsense guide for this, I know it…

[–] [email protected] 6 points 9 months ago* (last edited 9 months ago) (1 children)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
AP WiFi Access Point
DNS Domain Name Service/System
IP Internet Protocol
IoT Internet of Things for device controllers
VPN Virtual Private Network

5 acronyms in this thread; the most compressed thread commented on today has 13 acronyms.

[Thread #625 for this sub, first seen 24th Mar 2024, 13:45] [FAQ] [Full list] [Contact] [Source code]

[–] [email protected] 5 points 9 months ago

Good bot

[–] [email protected] 5 points 9 months ago* (last edited 9 months ago)

Put them all behind a firewall and configure it to block outgoing connections. Then forward the ports you need to the internal machines. Then only something connecting from the outside can talk to them. They won’t be able to initiate a connection.

(Keep in mind, this would also block things like DNS lookups, in case that’s important to you.)

[–] [email protected] 4 points 9 months ago

install openwrt on you router.

most routers that arent garbage support it.

[–] [email protected] 4 points 9 months ago* (last edited 9 months ago)

What about classic DMZ network and VPN?

The DMZ serves to your LAN only. You use the VPN to effectively become a part of your LAN.

[–] [email protected] 2 points 9 months ago (1 children)

My router's admin console, OOTB, gives me the option to either deny individual devices (based on MAC, etc.) access to the external internet, or create a second (or third, etc.) WiFi network that, itself, is not connected to the outside.

Perhaps you have similar settings?

[–] Mir 1 points 9 months ago (2 children)

Mine doesn't, what router are you using?

[–] [email protected] 3 points 9 months ago (1 children)

What's your router? Can you install OpenWrt on it? OpenWrt provides a GUI for the firewall where you can set that a specific device won't be able to access the internet with a few clicks.

[–] Mir 1 points 9 months ago

My router doesn't support OpenWrt, I'm planning on buying a new budget friendly one to support it

Thank you for the

[–] [email protected] 1 points 9 months ago

Asus RT-AC65

[–] [email protected] 2 points 9 months ago

I havent even bothered with it yet but my router has individual settings for internet access for devices. You can even set them in homeassistant. A other idea might be pihole since it works as dns in my home. But that also makes a lot of it absurd because the phone home function on a lot of these is blocked by pihole anyway.

[–] [email protected] 1 points 9 months ago

If you want an OoTB solution you can get a Cloud Gateway from Ubiquiti (the ultra is like $200 I think) and use its vlan feature though you may need another switch.

Otherwise, if you've got unlimited time to tinker, proxmox or pfsense are ok options.

I personally run the UDM SE and I highly recommend this approach if you don't want to roll it yourself.