Are you looking for a way to protect your smart home from potential bad actors or intruders? A VLAN is the perfect tool for the job. Here’s how I configure my VLAN and how I plan to use it to protect my smart home network.
Few smart devices value cybersecurity
Companies really only care about their own interests, not yours.
Did you know that your IoT (Internet of Things) devices could be A major hole in your smart home security strategy.? Most people don’t realize this. Whether we like it or not, most IoT devices call home quite frequently, even for the simplest things. At the beginning of this year, a massive AWS outage showed how momentous this can be when people couldn’t control their bedslet alone smart switches or plugs.
This dependence on the Internet is due to the fact that even when you are on the same network as your IoT devices, most of the time, any command you send to them goes through the cloud and back down again. That may not seem like a terrible thing, but it means data is being sent from your network to who knows where and who knows what country.
What data is sent to those servers? It’s more than just “turning on this light.” That’s where VLAN and network segregation come into play.
How does a VLAN solve smart home security problems?
An isolated network is a secure network
Chances are, your home only has one network used for everything. That works in most cases, but there is actually a big drawback to having a network: all devices on the network can communicate with each other.
If one device, for example a 3D printer or security camera, is compromised, your entire network will be compromised. That device can access every other device on your network whether you like it or not.
That’s why VLANs, or virtual local area networks, are so important in a smart home (or any home, for that matter). With a VLAN, you can separate network traffic into its own lanes. Think of it as a road that has one or many lanes, but with walls between them.
With a VLAN, you can say “Traffic on VLAN 1 can travel to any other lane without issue, but traffic on VLAN 2 can only access VLAN 2 and nothing else.” In that case, your computer could be on VLAN 1 and can communicate with devices on both VLAN 1 and VLAN 2. Your IoT devices could be on VLAN 2 and can only communicate with devices on VLAN 2, and not VLAN 1.
Depending on the networking hardware you have, this can go as deep as you want. I have a VLAN that specifically blocks all It intercommunicates traffic between devices and only allows external Internet access. If I put two computers on that VLAN, they wouldn’t know that the other one exists and they wouldn’t know that any other device exists on my network; that VLAN simply has access to the external network and nothing else.
How does this solve your IoT security problems? Well, if you have a separate IoT VLAN where devices cannot communicate with each other and also cannot communicate with devices outside of that VLAN, then if that same 3D printer or security camera is hacked, nothing else will be compromised outside of that specific element.
To save my smart home sanity, I segregated my network with VLANs
A lot goes into setting up a segregated smart home network
My home network runs on Unifiwhich makes creating IoT-specific VLANs much easier. I’m still working on the perfect setup, but so far, this is what I’ve done.
To start, I created the VLAN and called it IoT. This is pretty simple, but this is how I want to identify it. I have enabled IGMP Snooping and mDNS as both capabilities are required for many smart home devices. I have the network configured for 253 IP addresses, of which 205 are in the DHCP pool for automatic assignment. I can expand on this later if needed, but it gives me 50 addresses that I can configure as static if I need them and over 200 that are dynamic, which is more than I’ll probably ever need.
I also have IoT and my primary trusted VLAN on the mDNS proxy, so that devices in my primary VLAN and the IoT VLAN can properly communicate with each other. However, that’s where my VLAN configuration ends.
I am currently in the process of completely renewing my smart home infrastructure to move everything to a local approach first. My IoT VLAN shares access to my LAN and also has external access. This is something I plan to change in the future once I finish migrating to devices that support those types of features.
I already have home assistant on my network and I also use Apple’s HomeKit a lot, which both offer a local approach to smart home and IoT devices. I am also in the process of building many of my own sensors using the ESP32 platform.
In the future, I will create firewall rules so that the IoT VLAN will not be allowed to cross over to my trusted VLAN, which means that IoT devices will not be able to communicate with my network to achieve the enhanced security I talked about. I’m also going to create an easy toggle so I can open that network to the outside world when adding a new device, if required, and then close it again once I have the device set up.
For me, the issue is configuring the VLAN in stages. I already have the VLAN there and I have a Wi-Fi network connected to the VLAN (which is set to 2.4GHz only and an IoT network), and most of my smart home devices are in the VLAN. This means that once I have all the firewall rules configured, all my devices will be immediately protected since I’m going to go the route of building the network first and so securing it.
What you need to set up a VLAN smart home network
It’s easier than you think
If you’re interested in building your own smart home network with VLANs, you’ll first need some type of managed network. Unfortunately, this is not yet common on most consumer networking hardware. I went the route of using Unifi and Ubiquiti on my home network, which is actually becoming much more affordable with the Dream Router 7.
However, there are other options as well. You can build your own with something like pfSense or OPNSense, or you can simply purchase other managed networking hardware like Omada from TP-Link.
Once you’ve set up the hardware, you’ll just need to make sure everything is compatible. Because I use Unifi, my Wi-Fi access points and my managed switch talk to each other, so I can handle the managed network from top to bottom across all devices.
9/10
- Brand
-
Unifi
- Range
-
1,750 square feet
The Unifi Dream Router 7 is a complete networking device that offers NVR capabilities, fully managed switching, an integrated firewall, VLANs, and more. With four 2.5G Ethernet ports (one with PoE+) and one 10G SFP+ port, the Unifi Dream Router 7 also features dual WAN capabilities in case you have two ISP connections. It includes a 64GB microSD card for IP camera storage, but can be upgraded for more storage if needed. With Wi-Fi 7, you can achieve a theoretical network speed of up to 5.7 Gbps when using the 10G SFP+ port, or 2.5 Gbps when using Ethernet.
My VLAN isn’t all sunshine and rainbows
Sometimes it just works and other times…
I love having a segregated network, but I’ve had quite a few issues during setup so I don’t have my VLAN completely locked down yet. For example, when my iPhone is on my trusted network, I cannot successfully add an IoT device to HomeKit on the IoT network. I’ve tried and tried, but entering IoT network credentials from my iPhone on my trusted network just doesn’t work for me. The workaround for this is to simply connect my iPhone to the IoT network, and it seems to work.
I also had some major issues trying to use Home Assistant on one VLAN and devices within Home Assistant on another VLAN, with my primary devices on a third VLAN. I’m sure there is a solution for this and I’m working on getting everything set up, but it’s still an issue I ran into.
These are just two of the main problems I’ve had when configuring an IoT VLAN. If you are thinking that it will be very easy to do and there will be no problem, think again. Just be prepared for some headaches in the initial changeover and know that there will definitely be some issues related to configuring an IoT VLAN.
The pain will be worth it, you just need to know that there, most likely, willpower be pain
Start slow and work your way up to a super secure network
VLANs are an extremely deep aspect of networking and I’m really just scratching the surface. However, having a dedicated IoT VLAN is one of the best ways to protect your smart home and I’m excited to finish setting up my firewall in the new year.
