VLAN
The same separation as in the other two paths, but controlled one direction at a time. A VLAN divides one physical network into several separate networks.
Choose a VLAN if your equipment supports it and you can configure firewall rules. Otherwise, start with the simpler guest network.
What can reach where
Three networks and six directions. Select a direction and see what follows. Every state is also written out below, so the tool works without the picture.
Trusted
Computers, phones and the network drive. The things you do not want to lose.
IoT
Cameras, bulbs, plugs, the television. Devices you cannot update yourself.
Guest
Visitors' phones. Devices you do not control at all.
The current state
- From the trusted network to the IoT network: allowed
- From the trusted network to the guest network: blocked
- From the IoT network to the trusted network: blocked
- From the IoT network to the guest network: blocked
- From the guest network to the trusted network: blocked
- From the guest network to the IoT network: blocked
This is an illustration, not a configuration tool. It contacts nothing and changes nothing on your network.
The concepts, by platform
OpenWrt
- Create a new network and give it a separate address range.
- Bind a wireless network to it under its own network name.
- Write a firewall rule that allows traffic out from the new network but not in.
UniFi
- Create a new network and give it its own identifier.
- Attach the network name to that network.
- Block traffic from the new network to the other internal networks.
OPNsense
- Create an interface for the new network and give it an address range.
- Turn on address assignment for that interface.
- Write rules that block access to the other internal networks.
MikroTik
- Create a network identifier and attach it to the bridge.
- Give the network its own address range and address assignment.
- Restrict traffic to the other internal networks in the firewall.
What this does not protect against
It does not stop a device sending data to the internet. Add outbound firewall rules if the device does not need unrestricted access.
It does not fix faults in the device. A device without updates is still a device without updates inside its own network.
It does not help if the rules point the wrong way. One permissive rule in the wrong direction defeats the whole separation, and no error message appears.
It does not protect devices from one another inside the same network unless you block those connections with client isolation or firewall rules.
Checked