TP-Link Easy Smart Switch security question

[stephenw10]

You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

Steve

[jusjay]

You mean specifically the VLAN1 restriction?

Yes, just in case it might be an issue.

[warheat1990]

@stephenw10:

You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

Steve

So it should be fine as long as I stay away from the default VLAN1?

[Taiidan]

@warheat1990:

@stephenw10:

You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though…  ;)

Steve

So it should be fine as long as I stay away from the default VLAN1?

No.

Crappy fly-by-nite chinese company networking hardware is almost always full of security problems, you would be better off purchasing a used switch off ebay from a more reputable OEM.

[warheat1990]

@stephenw10:

I've never really tested VLAN isolation to any depth, I have a hard time believing it's not isolated if configured correctly. I've never seen any stray traffic on the wrong VLAN/Port. I could probably run a test if you need me to.

I'd appreciate if you can run a simple test to check if it's isolated correctly.

[johnpoz]

Are we talking installation in a DOD facility or your house?? ;)

Pretty sure it does vlan isolation, kind of useless of them to state its a smart switch with vlan support if it doesn't actually isolate the vlans..  It might be very limited in what "vlan" its managment IP is on - most likely its going to be default vlan 1 with no way to change it..  And will have to be untagged.

I really don't see how that is an issue in a "home" setup.. Are you worried about someone coming into your house plugging into one of your switch ports and doing a vlan hop attack on you?  Really??? ;)

While I agree in enterprise setup you always remove vlan 1, do not use vlan 1 etc.. Your management vlan is not vlan 1, etc etc etc..  But pretty sure your setting this up in you house right??  Your looking at very LOW END smart switches.. To expect the bells and whistles of a fully managed switch??  If you want the ability to change your management vlan away from an untagged vlan 1 setup then your going to have to spend a few more $'s

But for quick and dirty hey I need to have vlan support on my home budget that is really low or the wife will kill me.. Then sure the tplink or negear low end less than $40 smart switches are fine.. I have a netgear 108ev3 in my av cabinet.  It does what it needs to do.. Not worried about someone plugging into my av cab switch and doing a vlan hop attack on me ;)  And yeah I run vlan 1 on my "home" network - its just easier!!

I wish it did more, has not snmp support, etc.  again its a LOW END smart switch - you get what you pay for..  Now if you bump your budget to say closer to 200 then sure you can get some really feature rich switches..

[stephenw10]

If someone wants to suggest a test I can probably run it.

I've never had any issues with it. I have different DHCP servers on different VLANs and clients always pull from the expected subnet.

Yes the management interface is always on the default vlan, effectively untagged. I'm using it at home, that's not a problem.

Steve

[johnpoz]

Well per the link he gave says

"attacker on VLAN1 can spoof the ARP table for other VLANs."

So on vlan 1 can you arp for other devices on other vlans?  If you are connected to a vlan 1 port, can you spoof a mac that is on different vlan and then gain access to that vlan device?  I find it highly unlikely to be honest..  But then again this is a HOME setup.. Who exactly is going to have access to your vlan 1 in the first place?  And they are going to be doing a vlan hop attack?

As you mentioned already if there was no actual layer 2 isolation then you would have issues with your multiple dhcp servers.  There are many switches that are open to vlan hoping attacks.. not just the cheap ones.. Especially if they are not configured secure..

Either way I don't see how any of that really matters for a "home" setup.. It does what you need it to do right - which is isolate your traffic at layer 2.  It clearly does that ;)  Or Stephenw10 for example would have all kinds of issues with his dhcp servers and other vlans getting the wrong IP..

You could use any of the vlan hopping pentesting tools, frogger comes to mind.

[jahonix]

@warheat1990:

… my sister laptop won't be able to access my NAS or PC...

Unless your sister is a hardcore hacker this is totally over the top!
Even if she was then there are different ways to solve this "problem" in the family - get her involved in testing the network security for example. But if she was she'd taken care of it already and not you…
So you worry about problems you don't have.

[warheat1990]

I don't want to sound offensive, but my question is simple if this have proper isolation before I drop $150 on it. I don't see any relevance on "this is home switch, you better not to expect anything", well yeah if it doesn't do anything that I want it, I'd rather invest in a better switch because $150 is not cheap for me.

And I don't see any relevance in "your sister is probably not a hacker" or "this is highly unlikely someone's going to come to your house and plug something into the port". Well it's also very highly unlikely that someone will get your modem or router password especially if you turn your wifi off so why not just leave the default admin/admin or it's also very highly unlikely someone will get into your email account especially if you have 2 way auth so don't bother with password manager.

I mean what's the point of the discussion then? That being said, I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.

[KOM]

I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.

We get a fair amount of people (usually with little networking knowledge) who think they're trying to secure their family photos from nefarious Russian super-hackzors.  This usually leads to overly-complex configurations that nobody can decipher.  Gauging your users & their abilities will help you to determine how tightly to wind the tinfoil around your head.  I run networks at the office and at home.  At the office, everything is locked down.  At home, things are much looser since my family wouldn't know a network if they tripped over the Ethernet cable.

For what it's worth, I just bought the 105E over the holidays for $40, but I haven't had much time to play with it or its VLAN support.

[jahonix]

No offense taken.

@warheat1990:

before I drop $150 on it.

What do you want to buy for $150?
A TL-SG108E is something like 25 Euros which should be $30 max, double that for a TL-SG1016DE

Personally, I don't like Esay Smart Switches and prefer one step up. Have a look at the TL-SG3210 of which I use multiple myself at home.

Don't use VLAN1 for anything and you should be fine and have proper isolation.

[whosmatt]

I've got 2 of the TL-SG108E and while they're basic in function, they are inexpensive and do work as intended.  They will indeed provide the level of security you're looking for, as long as you have the networking knowledge to do so.

[warheat1990]

@jahonix:

A TL-SG108E is something like 25 Euros which should be $30 max, double that for a TL-SG1016DE

Where do you find 1016DE for $60? Here 1016DE is about $125 but it's currently on sale on Amazon for $100, 108E is about $25-30.

[jahonix]

@warheat1990:

Where do you find 1016DE for $60?

I just looked here

but it seems that those are only TL-SG1016D, which is the unmanaged version.

The version in question isn't that much more expensive though:

That is including 19% VAT.

This isn't, that's dealer cost…


[n3by]

Hi,
I just bought one TL-SG108E ( it is v2 with web management interface HTTP ) and price is ~30Euro.

PVID 1 it is default and can't be changed.

I defined 3 VLANS
101 for WIFI private
103 for WIFI guests
105 for LAN private

I wanted to use port 8 as Trunk & port 6 & 7 for AP:
port 8 from pfSense interface Tagged ( for VLAN 101 & 103 & 105 )
port 7 Tagged to AP1 CISCO 2602 ( for VLAN 101 & 103 ).
port 6 Tagged to AP2 CISCO 2602 ( for VLAN 101 & 103 ).
port 3-2-1 Untagged to LAN devices ( for VLAN 105 ).

It's working, but in this configuration watching with NTOPNG on each VLAN interface it reveal that all traffic, from other/all VLANs it is broadcasted / visible in every VLAN interface, not exactly what I wanted … any ideas ?

[whosmatt]

@n3by:

PVID 1 it is default and can't be changed.

Yes, it can.  I have a simple setup with two of the TL-SG108E (one of which is V1, the other V2) and I changed the PVID of all ports to my primary VLAN ID (not 1).  My primary VLAN is for my home LAN; the only other VLAN I have defined is for my guest network and that is provided entirely via wireless.  So I set the port for my Ubiquiti AP to tag that one, and the port for my ESXi box (which hosts pfSense) to tag both.  The tagged traffic is passed to the pfSense VM still tagged via a port group in ESXi with VLAN ID 4095 (which is ESXi's version of a trunk.  In other words, pass all traffic with tags intact).  I also have an uplink between the two switches, which tags both VLANS.  No problems here; everything works as expected and traffic is isolated.  It's not super intuitive if you've come from managing switches that have a Cisco-like CLI, but once you get it, it works.

I'm showing the web interface of the V2 switch here because I'm on my Mac and can only access the V1 switch with a Windows app (at least easily).

[n3by]

For me it look like you can change PVID for any port, only if that port is member in that VLAN… if you can show the VLAN Configuration page we can see exactly what you set.

[whosmatt]

@n3by:

For me it look like you can change PVID for any port, only if that port is member in that VLAN…

Then change the PVID to whatever VLAN you want that port to be a member of.

Here's my tagging config for my V2 switch.  Port 1 is the trunk between the two switches.  Port 4 is connected to my Ubiquiti AP.  Bear in mind I have another V1 switch connected to this one, so you're not seeing the whole picture:

[n3by]

Exactly how I anticipated I already tested this model of config and for my config will not solve that all traffic is mirrored on all VLANs.

Now when you have time have a look with NTOPNG in every VLAN interface you defined and let us know if you see all tagged traffic from all VLAN.

For example in your VLAN 11 you will see all traffic from 44, for me this is not normal to be seen there.

In my test all traffic from all clients on LAN, WIFI can be seen also on GUESTS… etc.