Home network segmentation #75

New issue

Closed

opened 2023-10-08 15:55:14 +02:00 by simon · 1 comment

simon commented

2023-10-08 15:55:14 +02:00

Owner

Currently, I only have one network at home. All devices are in it. I propose to split the network into multiple zones.

network

trusted network
- lan/br-lan
- VLAN 10
- Subnet 10.80.1.0/24, fd00:80:1::/64
- SSID: Darknet (change the PSK, as the current one is known on untrusted devices)
management network (for manangement services offered by switches etc., wireless APs)
- management/br-management
- VLAN 20
- Subnet 10.80.2.0/24, fd00:80:2::/64
- no wireless
untrusted network
- untrusted/br-untrusted
- VLAN 30
- Subnet 10.80.3.0/24, fd00:80:3::/64
- SSID: Industriespionage
IoT network
- iot/br-iot
- VLAN 40
- Subnet 10.80.4.0/24, fd00:80:4::/64
- SSID: Krepel

This requires activating VLAN on the switch and have it connect tagged VLAN 1 from the port connected to shinobu to the other ports untagged.

Firewall

trusted → * ACCEPT
* → trusted [established,related] ACCEPT
untrusted → 192.168.0.1/24 DROP # plastic router, might be vulnerable
untrusted → wan ACCEPT
untrusted → * DROP
iot → 10.80.3.1:1883 ACCEPT
iot → *:123 ACCEPT # ntp
iot → * DROP
untrusted → wan ACCEPT # maybe, depends on what devices are in that network

QoS

New qdisc for untrusted on enp1s0

TODO

Migrate MQTT server for wordlock to shinobu

Currently, I only have one network at home. All devices are in it. I propose to split the network into multiple zones. ## network * trusted network + `lan`/`br-lan` + VLAN 10 + Subnet `10.80.1.0/24`, `fd00:80:1::/64` + SSID: `Darknet` (change the PSK, as the current one is known on untrusted devices) * management network (for manangement services offered by switches etc., wireless APs) + `management`/`br-management` + VLAN 20 + Subnet `10.80.2.0/24`, `fd00:80:2::/64` + no wireless * untrusted network + `untrusted`/`br-untrusted` + VLAN 30 + Subnet `10.80.3.0/24`, `fd00:80:3::/64` + SSID: `Industriespionage` * IoT network + `iot`/`br-iot` + VLAN 40 + Subnet `10.80.4.0/24`, `fd00:80:4::/64` + SSID: `Krepel` This requires activating VLAN on the switch and have it connect tagged VLAN 1 from the port connected to shinobu to the other ports untagged. ### Firewall ``` trusted → * ACCEPT * → trusted [established,related] ACCEPT untrusted → 192.168.0.1/24 DROP # plastic router, might be vulnerable untrusted → wan ACCEPT untrusted → * DROP iot → 10.80.3.1:1883 ACCEPT iot → *:123 ACCEPT # ntp iot → * DROP untrusted → wan ACCEPT # maybe, depends on what devices are in that network ``` ### QoS * New qdisc for untrusted on `enp1s0` ## TODO * Migrate MQTT server for wordlock to shinobu