homelab

6612 readers

1 users here now

founded 4 years ago

MODERATORS

[email protected]

How can I set up a VLAN for IOT devices on a GL.iNet OpenWRT-based router? (sh.itjust.works)

submitted 5 months ago by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

I would like to create a VLAN that can access the internet but cannot access the rest of my network, with one exception. It should still be able to connect to my HomeAssistant server which isn't on the VLAN.

I have never set up a VLAN before so I am a bit lost. Does anybody have any good guides on how to set up something like this on a GL.iNet router? I am able to access the OpenWRT settings including interfaces, devices, etc. from LuCI.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 5 months ago (1 children)

To lay some foundation, a VLAN is akin to a separate network with separate Ethernet cables. That provides isolation between machines on different VLANs, but it also means each VLAN must be provisioned with routing, so as to reach destinations outside the VLAN.

Routers like OpenWRT often treat VLANs as if they were distinct NICs, so you can specify routing rules such that traffic to/from a VLAN can only be routed to WAN and nowhere else.

At a minimum, for an isolated VLAN that requires internet access, you would have to

define an IP subnet for your VLAN (ie /24 for IPv4 and /64 for IPv6)
advertise that subnet (DHCP for IPv4 and SLAAC for IPv6)
route the subnets to your WAN (NAT for IPv4; ideally no NAT66 for IPv6)
and finally enable firewalling

As a reminder, NAT and NAT66 are not firewalls.

[–] [email protected] 3 points 5 months ago

People that down voted you don't know how to network engineer...