Hey everyone,
I am completely stripping my house and am currently thinking about how to set up the home network.
This is my usecase:
-
home server that can access the internet + homeassistant that can access IoT devices
-
KNX that I want to have access to home assistant and vice versa
-
IoT devices over WiFi (maybe thread in the future) that are the vast majority homemade via ESPHome. I want them to be able to access the server and the other way around. (Sending data updates and in the future, sending voice commands)
-
3 PoE cameras through a PoE 4 port switch
-
a Chromecast & nintendo switch that need internet access
Every router worth anything already has a guest network, so I don't see much value in separating out a VLAN in a home use case.
My IoT devices work locally, not through the cloud. I want them to work functionally flawless with Home assistant, especially anything on battery so it doesn't kill its battery retrying until home assistant polls.
The PoE cameras can easily have their internet access blocked on most routers via parental controls or similar and I want them to be able to send data to the on-server NVR
I already have PiHole blocking most phone homes from the chromecast or guest devices.
So far it seems like a VLAN is not too useful for me because I would want bidirectional access to the server which in turn should have access from the LAN and WiFi. And vice versa.
Maybe I am not thinking of the access control capability of VLANs correctly (I am thinking in terms of port based iptables: port X has only incoming+established and no outgoing for example).
I figure if my network is already penetrated, it would most likely be via the WiFi or internet so the attack vector seems to not protect from much in my specific use case.
Am I completely wrong on this?
I'll be honest. It was a hell of a time getting things working correctly due to the lack of documentation, but now I have everything except scanning and document signing working which I rarely use anyway. (Rocket league runs fine, just with half the fps I should be getting) I literally don't have to touch anything anymore, it will just keep itself updated and working completely hands-off. That is what I want out of a system now that tweaking and debugging is a distraction from my other hobbies rather than a hobby itself.
The biggest feature that I like is Linux without having any manual update intervention at all. It all just runs and updates itself and works.
If something goes wrong in my software, I can uninstall and reinstall the flatpak delete remaining files, and reinstall with 3 clicks instead of having to search for where the hell this specific program decided to stash its files and configs and cache on my system like I had to with a traditional system. It takes the recurring annoyances out and trades them with 1-time annoyances.