this post was submitted on 01 Jul 2024
53 points (98.2% liked)
homelab
6651 readers
3 users here now
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That's what I did
You get a gateway, and you get a gateway.
Everybody gets a gateway!
One router
One love
Virtually…
It's going to haunt you for years. Wife: "why doesn't this iot thing work?" Oh its on the wrong network. "I don't understand it just doesn't work". Then I go add more exceptions in pfsense and the cycle continues.
The correct way of doing this is to never interact with an iot device directly. Put all of them on the same network with Home Assistant and then control all of them only via Home Assistant. Then you make one exception for home assistant to be accessible to the other networks.
This also allows you to disable Internet access for every single iot device Except home assistant.
I have so much trash on my network. For instance my security cameras are decentralized and we use tinycam on android to view them so I had to allow an exception for rtsp to get between the dirty iot WiFi and our normal WiFi. Our WiFi connected Bose speakers and Spotify is also another set of annoyance, they will only work if you try to connect to them from the same subnet via Spotify and app. I've tried to NAT the traffic and it didn't work.
It's not easy but they only way to make it all work without creating massive security holes is to only buy things that allow connection with open standards (which means home Assistant can connect to it.
Wan rules already takes 5 minutes to load. No more hosting, only blacklists.
That's not least privilege