How to isolate WiFi router and connected IoT devices from rest of the LAN
-
Hi everyone
I am hoping for some advice on this situation
Current network topology:
WAN > pfsense (building X) > LAN (building Y) > various PCs, IP phones and GLiNet WiFi Router (in router mode with IoT devices and guests connected via WiFi) all interconnected via (three) dumb switches.
I would like to isolate the WiFi router and the connected IoT devices from the rest of the LAN (i.e. prevent IoT devices from communicating with PCs – not necessarily the other way around) whilst giving internet access to the WiFi router and IoT devices.
I have read about various solutions, and they seem to fall under the following options:
- Use Vlans on a smart switch placed directly between pfsense and WiFi Router (with no dumb switches in-between) with appropriate firewall rules on pfsense.
- Create Wireguard VPN on pfsense and WiFi router with appropriate firewall rules on pfsense.
- Place the WiFi router in a DMZ (but not sure how this would work given network topology?).
Which of these options would you recommend? Are there other options?
Thank-you for your advice :)
-
At first glance, options #1 and #3 are two ways of describing the same thing. A DMZ is usually just a dedicated VLAN with specific firewall rules that allow some public traffic in eg for webservers, DNS servers etc, and have restrictive firewall rules to prevent malicious traffic from reaching private LANs.
A WireGuard tunnel that connects 2 endpoints a few feet from each other makes very little sense to me. Why add the overhead of encryption if there's no MITM risk?
I'd go with option #1 (VLAN)- you didn't say what hardware you're running pfSense on, but if it has an extra interface you can dedicate to the IoT network, then you really don't need any new smart switches, just plug your dumb switch into the IOT LAN port, connect your IoT gear + the GL.inet to that, set the GL.Inet device to bridged AP-only mode, and create a "block any from IOT LAN to MAIN LAN" firewall rule on your IOT interface...
Even the most basic Netgate 2100 can do this out of the box with no extra hardware needed.
-
@luckman212 Thank-you for your quick reply luckman
I should have mentioned that pfsense in physically located in building X whereas most of the LAN is located in building Y with only one ethernet cable in between.
The hardware on pfsense is over spec (I built it myself 4 years ago) and it does have multiple NICs which are used for other networks in building X e.g. office, NTP server, and separate WiFi network.
The LAN that I am referring to is all in building Y with PCs, IP phones and WiFi router.
So I don't really have the possibility of utilizing the extra NICs on the pfsense box without running another (long) cable.
-
Ah, yes those are definitely important details!
In that case, yes I would acquire a VLAN-capable switch, put it at your point of entry in Building Y, and deliver the IOT VLAN to the GL.Inet device.
-
@luckman212 Thanks luckman for your advice :)
Yes this seems like the most straightforward solution and it is physically possible to implement as I have an old HP smart switch available.
I was rather looking forward to the challenge and complexity of setting up a VPN tunnel and all the required firewall rules, but you have made me see sense ;) Thank-you
-
Technically most 'dumb' switches will pass VLAN tagged traffic so you could probably just setup VLANs between pfSense and the GL.Inet router. Or use some other type of tunneling there such as GRE.
But, I agree, doing it right with at least one VLAN capable switch is the way to go.
-
@stephenw10 Thanks Stephen
I dusted off my old trusty HP 1810-8G and inserted it into where the LAN cable enters the building and just created the one (1) VLAN 20 for the WiFi Router with IoT devices attached.I left the rest of the LAN untagged on the default VLAN of 1 since the various nodes are interconnected using dumb switches.
After adding some firewall rules to the VLAN 20 interface and doing various ping tests back and forth, all seems to be working as intended.
I was looking to experiment with an internal VPN using wireguard which would also create an isolated network I believe, but as luckman pointed out, this was just going to add unnecessary encryption overhead.
I had forgotten how simple and elegant VLANs are :)
