Question in the title. Feel free to include details, like what networks have wifi, what kinds of devices are on what, etc etc.

Right now I have 4 VLANs, each with a separate wifi SSID:

  1. Base - servers, workstation, and any trusted devices
  2. Business - work laptop, dock, and phone - enforces network and device isolation - lighter adblocking settings, so that work programs and services aren’t nerfed
  3. Isolated - visiting friends and family use this one - again, enforces network and device isolation
  4. Security - for cameras, doorbell, and other security devices - strongest security settings, isolation, and no direct internet access

Looking forward to hearing what others are doing, to see if I can improve my setup.

  • f3nyx ( f3nyx@lemmy.ml ) 
    3·
    5 months ago

    you have a good balance OP. I’d consider a DMZ if you’re planning on hosting any public services (or even services at all, check out the ffmpeg exploit that happened last week). other than that I wouldn’t recommend you get any more granular.

    the more granular you get with this stuff, the more you have to go through if/when something goes wrong or otherwise doesn’t work. which is great when you have a lot of time on your hands and an obsession with networking, but starts to become a detriment when your interest and time need to be dedicated to other things.

    • 4am ( 4am@lemmy.zip ) 
      1·
      5 months ago

      I had a DMZ and the only thing in it was a virtualized OPNSense router that handled all the traffic restrictions in and out of the network.

  • parityboy ( parityboy@lemmy.ml ) English
    2·
    4 months ago

    I have four primary VLANs, each with its own IP subnet:

    1. Production - TV, media servers, family desktops, laptops & smartphones
    2. Lab - my own space for learning & testing
    3. Management - this is for host management (currently applies to physical hypervisor infrastructure)
    4. IoT - this is for devices that like to “call home” - my printer is on this VLAN (I need to put the video doorbell on it too)

    I have an additional three VLANs - two for work and one for the odd project I might find myself working on. I also organised my SSIDs to reflect their purpose: <SSID>, <SSID>.lab, <SSID>.iot etc.

  • Sailing7 ( Sailing7@lemmy.ml ) 
    1·
    5 months ago

    Imma shame myself now publicly.

    Got 3 Wifi SSIDs, one for internal, one for legacy internal (2.4 only - mostly IOT), one for guests (and my work devices)

    AP and FW are from Unifi and i made the guest wifi to be with client isolation.

    My entire internal network is one vlan and one subnet.

    I plan on fixing that, but yeah…

    I’ve got a synology nas that got its webserver ports exposed and synology photo backup ports.

    I plan on putting it similary like you, when i get time and a cheap managed switch.

    • Putting servers in a managed vlan
    • Putting my gaming pc and shady VM (because of mods and root level anti-cheat software, which i dont trust either of them even a tiny bit) into a seperate vlan
    • putting my externable reachable stuff (soon to be also a proper reverse proxy with basic and cert auth, for Homeasssitant, jellyfin, […] access without a vpn (because vpn and android auto dont work together and i use my gps tag for automations in Homeassistant)
    • putting all other internal devices that i trust, such as my phones and CCTV cams and whatnot in a vlan
    • though maybe i would split that too, because i like to keep my cameras and other iot stuff without an internet connection.

    Regarding your setup: i think it is pretty strong, only a dmz for externaly reachable stuff is missing. But the rest? Pretty decent!