Sign in

SEGMENTING A TINY NETWORK: WHATS THE MINIMUM THATS WORTH IT?

Solvediotnetwork-designvlan6 replies · 199 views · started
Reply
Accepted solution by Omar J. — lol same thing happened to me discovery breaks across VLANs cuz mDNS and SSDP are link local. Most business firewalls and some consumer…
  1. Dario Alvarez
    @dario_regex-1ix

    Our smart theromstats at a home lab get firmware updates maybe once in their lifetime. They sit next to computers with sensitive data :D i want to isolate them, but Im worried about discovery and casting breaking. Whats your experience?

    Some of these smart thermostats were installed by external contractors who still need remote access for maintenance. That complicates things a bit. How do you handle vendor access in a segmented setup without poking big holes?

    12
  2. Vera
    @verag45

    uhh who manages the firewall rules at an online shop long-term?

    thinking

    2 0 helpful
  5. Omar J.
    @ojansen

    yeahhh the minimum useful setup is three segments: staff, guest, IoT. Default deny from IoT to staff, allow staff to IoT only on the ports needed (for example, teh cmaera NVR web UI or printing ports). good luck man!

    1 0 helpful
  6. Omar J.
    @ojansen
    Accepted solution

    lol same thing happened to me discovery breaks across VLANs cuz mDNS and SSDP are link-local. Most business firewalls and some consumer routers have an mDNS reflector or proxy; enable it only bewteen the VLANs that need it.

    6 4 helpful
  7. Dario Alvarez
    @dario_regex-1ix
    in reply to @ojansen

    @ojansen Isolated the smart thermostats, kept printers on the staff side. Two small rules and everything still works. Thanks for the practical advice.

    18 0 helpful

Reply to this topic

Sign in or create an account to reply.