I do su©k on subNetting... reddit / selfhosted ---------------------------------------------------------------------- THMMYos · 2023-11-10 23:39 It's been a while since I started selfHosting and as I'm growing more comfortable with the various networking - application subjects I want to improve my infrastructure & skills. Im planning to move from accessing the each service from its ip:port to (propably) treafik, domains& certificates. While I was designing this transition I was thinking about what other improvements I could implement : A) some sort of network segmentation, till now I didn't have any reason to move away from a 192.168.0.0/24 subnet, it's a home network with just a few phones and laptops as clients... But with 1. The increasing amount of VMs, ip phones, set-top-boxes etc that get their own ip, I'm starting to loose track of the devices on the dhcp list, I cannot see easily where each device is connected (wifi, ethernet, plc power line)... I was thinking of the network we have over at the work place, wifi gets it's own dhcp pool, wired clients another and so on. Setings whise I know how to set this one up but.. I don't know what I donnow about the setup, what should I take care and keep in mind should I implement smt similar? 2. Friends that they set up their own homelabs have talked about putting VMs and services on a separate network, a dmz, I can see why to do it if you want wan access, but why would you do it if you only want local / vpn access? Tldr : I do know how to set up networks & subnets on my equipment, but I lack the understanding of how to do it in the most optimal and effective way And searching for tips and pointers to information ---------------------------------------------------------------------- techtornado · 2023-11-10 23:43 What gear do you have? You need some VLAN’s and a few lessons in routing to have multiple networks available ---------------------------------------------------------------------- joecool42069 · 2023-11-10 23:56 There's no one way to do it. You could do it with ACLs on a layer 3 switch. You could do it with only layer 2 switch and a firewall being the gateway for your subnets. You could do it with VRFs on a layer 3 switch and route out a firewall. You could use virtual firewalls, you could use hardware filrewalls. You could just use stateless ACLs. You could do it with iptables on the hosts. All depends on what you want to do . ---------------------------------------------------------------------- JunglistFPV · 2023-11-10 23:57 Makes me wonder if Ive been doing it wrong, Ive separated my homelab/server traffic by using physical subnets (dumb AP for wireless on its own subnet). How could VLANs help me? ---------------------------------------------------------------------- timothyclaypole · 2023-11-11 00:16 The infosec theory behind the recommendation for subnets even without open wan access is that if one system is compromised proper subnets can help limit horizontal movement by an attacker. This requires that each subnet basically has a deny all firewall rule for both inbound and outbound traffic and that only the required ports are opened to allow for specific desired traffic to flow between subnets Very few home setups will go to the bother of doing this correctly. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-11 00:25 People can set subnets and ping all devices. If you use VLAN's at switch Level, they only can access the assigned subnet, and cant change it manually ---------------------------------------------------------------------- ithilelda · 2023-11-11 00:43 I kinda don't see your reason of frustration here. If you have a plethora of devices with dhcp and cannot remember each one's ip, then setting different subnet isn't going to help. If you wanna see where everything is connected by looking at the ip, then I don't see why you are struggling here. It's LAN. If you don't expose unnecessary stuff to someone else, it's safe. anyway, how are you going to configure your wifi APs to distribute ips under another subnet and still be able to manage them from one place? Bridge mode let your main router handle dhcp and it will just equally treat everything. Router mode would then distribute ips with each AP, but you won't be able to manage them in one place either. maybe I'm missing something here? also, don't use DMZ. It's just a lazy way to open up all WAN traffic to that machine in one click. why would anyone even want to do that?? If you need WAN access, open up only the corresponding port in your firewall! don't listen to them. ---------------------------------------------------------------------- EvilEyeV · 2023-11-11 03:32 So you have 3 physical switches then? Simple, vlans would allow you to have 3 separate networks on one switch. ---------------------------------------------------------------------- sintheticgaming · 2023-11-11 06:19 You can setup VLANs with inter vlan routing allowing you to talk across different VLANs ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-11 08:14 Yeah ofcourse you can. But that kinda defeats the purpose ---------------------------------------------------------------------- sintheticgaming · 2023-11-11 08:25 Not really it’s called firewall rules you only allow certain ips from each vlan to talk to one another… ---------------------------------------------------------------------- THMMYos · 2023-11-11 11:34 I m running A pfsense box with varius Dell & unifi smart swiches & unifi APs ---------------------------------------------------------------------- THMMYos · 2023-11-11 11:38 Thank you very much for the reply , this "theory" is what i looking for , network segmentation is one of the things i know the \*\*HOW\*\* to do it , but not the \*\*WHY\*\* to do it . > Very few home setups will go to the bother of doing this correctly. imho all the networks we have here in r/selfhosted propably go beyond a clasic CPE and just wifi for the shuephone, As i see it by creating sepere networks for the varius stuff you make a more easly manageable network & (as you explain) using the correct measures a more secure ---------------------------------------------------------------------- yakadoodle123 · 2023-11-11 11:58 I won't comment on the VLAN bits as everyone else seems to have covered that. But one thing you may want to consider is getting away from 192.168.0.x and choosing something less popular because when you start looking at setting up VPNs and you go to someone else's house / a hotel etc and they also have 192.168.0.x then you will have trouble getting to your VPN at home. I made the mistake of not doing this early on and it was a little bit of a pain to change it all later. ---------------------------------------------------------------------- THMMYos · 2023-11-11 14:57 I'm in fact thinking of moving out from 192.168.0.0/24, If not for my whole network, for the vms and services, for sure. But, I have my vpns set up with gateway redirection and not just split tunneling, I think ( and I could be wrong with that) I'm coverd from what you described. ---------------------------------------------------------------------- timothyclaypole · 2023-11-11 15:07 My cynicism is that collectively we are most likely to create separate subnets and then simply setup routing between the new subnet and any existing nets, we might place a deny all rule on inbound traffic but we continue to all outbound because figuring out exactly what outbound traffic to allow is a much harder proposition than opening ports for inbound services. ---------------------------------------------------------------------- hereisjames · 2023-11-12 23:39 Having spent a fair amount of time on this topic - VLANs and ACLs are probably ok for small networks like most homelabs. This is macrosegmentation and, set up correctly, it'll slow or limit lateral movement between the types of devices you've put in each VLAN. You still need some sort of detective control though so you know if your stuff gets compromised. For microsegmentation - basically isolating inter-workload traffic into very small segments, like an app web server and the backend, there's almost no tooling I can find that's free and anything other than a big administrative headache. There are a few common services that are hard to protect and probably the risks are low enough to leave them out - DNS, NTP, logging, etc. - and you can use things like Tailscale, Warpgate, Teleport etc to do your SSH access management. Ideally you'd put all your users on the internet, have an authentication front end/reverse proxy outside your homelab, and route all your interactive traffic through it; but again the options are limited outside HTTPS and the free versions onerous to manage. You can do this with Twingate to some extent but the latency can be noticeable.