Looking for a way to protect your smart home from potential bad actors or intruders? VLAN is the perfect tool for the job. Here’s how I set up my VLAN and how I plan to use it to secure my smart home network.
Few smart devices value cybersecurity
Companies really only have their own interests in mind, not yours
Did you know you can have IoT (internet of things) devices? a major gap in your smart home security strategy? Most people don’t realize this. Whether we like it or not, most IoT devices phone home frequently, even for the simplest of things. Earlier this year massive AWS outage time has shown how wide it can be people could not control their bedslet alone smart switches or plugs.
This internet trust comes from the fact that even if you’re on the same network as your IoT devices, most of the time any commands you send them will go through the cloud and back. This may not sound like a terrible thing, but it means that data is being sent from your network to who knows who is where, and who is in which country.
What information is sent to those servers? It’s more than just ‘turning this light on’. This is where VLANs and network segregation come into play.
How does VLAN solve smart home security problems?
An isolated network is a secure network
Chances are you only have one network in your home that is used for everything. This works for the most part, but actually having a network has a pretty big drawback: all the devices on the network can talk to each other.
If one device, such as a 3D printer or a security camera, is compromised, then your entire network is compromised. That one device can access all the other devices on your network whether you want it to or not.
This is why VLANs, or virtual local networks, are so important in a smart home (or any home). With VLANs, you can separate network traffic into its own lanes. Think of it as a highway with one lane or multiple lanes but with walls in between.
With a VLAN, you can say “Traffic on VLAN 1 can go to any other band, no problem, but traffic on VLAN 2 can only go into VLAN 2, nothing else.” In this case, your computer may be in VLAN 1 and it can talk to devices in both VLAN 1 and VLAN 2. Your IoT devices may be on VLAN 2 and they can only communicate with devices on VLAN 2, not VLAN 1.
Depending on what network equipment you have, this can go as deep as you like. I have a specific blocking VLAN all of them allows cross traffic between devices and access to the external internet only. If I put two computers on that VLAN, they won’t know the other exists, and they won’t know any other devices exist on my network – the VLAN just has access to the external network and nothing else.
How does it solve your IoT security challenges? Well, if you have a separate IoT VLAN where devices can’t talk to each other and also can’t talk to devices outside of that VLAN, then if that 3D printer or security camera gets hacked, nothing is broken except that particular element.
To keep my smart home sane, I separated my network with VLANs
A lot goes into building a dedicated smart home network
My home network runs on Unifithis makes creating IoT-specific VLANs quite easy. I’m still working on the perfect setup, but this is what I’ve done so far.
For starters, I created a VLAN and called it IoT. It’s pretty simple, but here’s how I want to define it. I enabled IGMP Snooping and mDNS as both of these features are required for many smart home devices. I have a network configured for 253 IP addresses, of which 205 are in the DHCP pool for auto-assignment. I can expand this later if needed, but this gives me 50 addresses that I can set statically if needed, and over 200 that are dynamic, which is more than I’ll likely need.
I also have my IoT and primary Secure VLAN on the mDNS proxy so that devices on the primary VLAN and IoT VLAN can communicate with each other properly. However, this is where my VLAN setup ends.
I am currently completely overhauling my smart home infrastructure move everything to a local-first approach. My IoT VLAN shares access to the LAN and it still has external access. This is something I plan to change in the future once I finish migrating to devices that support these types of features.
I already have it House helper on my network and I also use Apple’s HomeKit a lot both offer a native-first approach to smart home and IoT devices. I’m also in the process of building a bunch of my own sensors using the ESP32 platform.
In the future, I’ll make firewall rules to prevent the IoT VLAN from switching to the Trusted VLAN, meaning IoT devices won’t be able to talk to my network for the enhanced security I talked about. I’ll also set up an easy switch so that when I add a new device, I can open that network to the outside world if it requests it, and then reconnect it after installing the device.
For me, it is to set up the VLAN in stages. It already has a VLAN and I have a Wi-Fi network connected to the VLAN (2.4GHz and IoT network only) and most of my smart home devices are on the VLAN. This means that once I set up all the firewall rules, all my devices will be protected immediately because I go the network setup route first and after to provide
What you need to set up a VLAN smart home network
It’s easier than you think
If you’re interested in building your own smart home network with VLANs, you’ll need some form of managed networking first. Unfortunately, this is not yet common in most consumer-grade networking hardware. I’ve gone the route of using Unifi and Ubiquiti on my home network, which really becomes more convenient with the Dream Router 7.
However, there are other options. You can set up your own with something like pfSense or OPNSense, or just buy managed networking hardware like TP-Link’s Omada.
Once you’ve installed the hardware, you just need to make sure it all fits. Because I use Unifi, my Wi-Fi access points and managed switch talk to each other, so I can manage the managed network from top to bottom on all devices.
9/10
- Brand
-
Unifi
- Range
-
1,750 square feet
Unifi Dream Router 7 NVR capabilities, fully managed switching, built-in firewall, VLANs and more. is a full-fledged network device that offers With four 2.5G Ethernet ports (one with PoE+) and a 10G SFP+ port, the Unifi Dream Router 7 also has dual WAN capabilities when you have two ISP connections. It includes a 64GB microSD card for IP camera storage, but can be upgraded for more storage if needed. With Wi-Fi 7, you’ll be able to reach a theoretical network speed of 5.7 Gbps when using the 10G SFP+ port, or 2.5 Gbps when using Ethernet.
My VLAN is not sunshine and rainbows
Sometimes it just works, sometimes…
I love having a dedicated network, but I had a few issues with it during setup, so I still have the VLAN locked down completely. For example, when my iPhone is on my Trusted network, I can’t properly add an IoT device to HomeKit on the IoT network. I’ve tried and tried but entering the IoT network credentials from my iPhone into my trusted network doesn’t work for me. A workaround for this is to simply connect the iPhone to the IoT network and it seems to work.
I’ve also had some major problems trying to use Home Assistant on one VLAN and devices inside Home Assistant on another VLAN, with my primary devices on a third VLAN. I’m sure there is a solution for this and I’m working on setting things up, but this is still the problem I’m having.
These are just two of the main problems I encountered when setting up an IoT VLAN. If you think it will be very simple and there will be no problems, think again. Just be prepared for some headaches in the initial transition, and know that there will definitely be some troubleshooting involved with setting up the IoT VLAN.
It’s worth the pain, just know that there’s probably will be to hurt
Start slow and work your way up to a super secure network
VLANs are an extremely deep aspect of networking, and I’m really just scratching the surface. Having a dedicated IoT VLAN is one of the best ways to secure your smart home, and I’m excited to finish building my firewall in the new year.
