Selfhosted

Yes, you should not be thinking about security in terms of an outside intruder here. Think about untrustworthy or potentially compromised devices.

• WiFi smart devices are notorious for calling home, possibly collecting data, even if you’re trying to use them locally.
• There have been botnets from unsecured video cameras, and even some compromised from before import.
• TVs report back what you’re using them for and when, even playing through hdmi, and some have been caught listening in to your private conversations.

How do you prevent these from happening, or limit what they can do? One way is to put them on a separate vlan without internet access (your HA or other hub can listen on multiple VLANs and be the gatekeeper) and without access to your computers.

That being said, for similar requirements, I found managing the more complex network to be too much hassle, and went back to a simple flat network

Vlans are really only useful with firewalls. If you setup VLANs by themselves it does nothing (mostly)

Like many other security mechanisms VLANs aren't really about enabling anything that can't be done without them.

Instead it's almost exclusively about FORBIDDING some kinds of interactions that are otherwise allowed by default.

So if your question is "do I need VLAN to enable any features", then the answer is no, you don't (almost certainly, I'm sure there are some weird corner cases and exceptions).

What VLANs can help you do is stop your PoE camera from talking to your KNX and your Chromecast from talking to your Switch. But why would you want that? They don't normally talk to each other anyway. Right. That "normally" is exactly the case: one major benefit of having VLANs is not just stopping "normal" phone-homes but to contain any security incidents to as small a scope as possible. Imagine if someone figured out a way to hack your switch (maybe even remotely while you're out!). That would be bad. What would be worse is if that attacker then suddenly has access to your pihole (which is password protected and the password never flies around your home network unencrypted, right?!) or your PC or your phone ...

So having separate VLANs where each one contains only devices that need to talk to each other can severely restrict the actual impact of a security issue with any of your devices.

In general terms, if you are not sure if you need a VLAN, you do not need a VLAN.

It dramatically complicates your home networks (yes, plural at that point), which is fine if IT serves a purpose.

But if there isn’t a compelling reason for them you are just imposing a management cost for no benefit.

It looks like you’re not understanding what a VLAN is. It is a virtual LAN, it’s near physical separation of traffic.

In your example, your IoT devices and HA would sit in their network. Your PCs and phones on another, reaching outside through PiHole. Your *arr suite in a third, only routed outside through a VPN. You get the gist. And then you set rules on how these subnets talk to each other in a router, like you would do if they were physically separate.

If you want to learn about VLANs and spend some time setting everything up (and more time each time a new device joins your network) then you should go for it.

I for myself decided it’s not worth it for my little home network and instead just use a /16 net and group devices into different ranges. E.g. computers are xxx.xxx.1.yyy, phones are .2.yyy, etc. All unknown devices get a .99.yyy from the DHCP, so they are easily identified.

All public facing stuff is in some Docker container, so there’s at least a small hurdle should something/someone get access.

Cameras are mirrored into Apple HomeKit via Home Assistant, so I can use Apple Home to watch them from afar. Or VPN into my home network.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #709 for this sub, first seen 24th Apr 2024, 09:15] [FAQ] [Full list] [Contact] [Source code]

Maybe I am not thinking of the access control capability of VLANs correctly (I am thinking in terms of port based iptables: port X has only incoming+established and no outgoing for example).

I think of it like this: grouping several physical switch ports together into a private network, effectively like each group of ports is it's own isolated switch. I assume there are routers which allows you to assign vlans to different Wi-Fi access points as well, so it doesn't need to be literally physical.

Obviously the benefits of vlans over something actually physical is that you can have as many as you like, and there are ways to trunk the data if one client needs access to multiple vlans at once.

In your setup, you may or may not benefit, organizationally. Obviously other commenters have pointed out some of the security benefits. If you were using vlans I think you'd have at a minimum a private and public vlan, separating out the items that don't need Internet access from the Internet at all. Your server would probably need access to both vlans in that scenario. But certainly as you say, you can probably accomplish a lot of this without vlans, if you can aggressively setup your firewall rules. The benefit of vlans is you would only really need to setup firewall rules on whatever vlan(s) have Internet access.

I consider client devices to be a big risk factor and if I can keep them from having direct access to the Backup NAS and the IoT I consider that a big win. A simple ransomware attack on a client device would find any NFS/SMB shares the client can access and start encrypting - having the Backup NAS on a separate VLAN that only the server can access stops most of those from affecting the backup and makes restoring a lot easier. I would definitely recommend having an offline backup of the NAS as well in case of the server being breached.

It all comes down to what you trust each type of device to do and how you want to handle their traffic.

I have seven VLANs, with each one's traffic being treated very specifically. The subnets for each VLAN route to specific interfaces on a virtualised OPNsense firewall, which is where my traffic handling and policy enforcement takes place.

Also remember VLANs are just plain useful for segregating traffic, particularly broadcast traffic, without having to invest in separate switching/routing for each subnet. Having a single managed switch that limits the broadcast domains for you is a really efficient way to (physically) setup your network.