I’m going to be overhauling my network over the next few months as I get ready for my new municipal fiber installation. I have a general idea of how to set things up, but I’m not an expert and would appreciate a few extra pairs of eyes in case I’m missing something obvious.

Hardware available:

  • Microtik Routerboard - 5 ports
  • Ubiquiti AP - AC-Lite; plan to add U6+ or U6 Lite once I get faster service
  • some dumb switches

Devices (by logical category; VLANs?):

  • main - computers and phones (Wi-Fi for now, I plan to run cable)
  • media - TVs, gaming consoles, etc
  • DMZ - wired security cameras, Wi-Fi printer (2.4GHz wireless g only)
  • guest - guests, kids computers

Goals:

  • main - outgoing traffic goes through a VPN
  • media - outgoing traffic limited to certain trusted sites; probably no VPN
  • untrusted - cannot access internet, can be accessed from main
  • guest - can only access internet, potentially through a separate VPN from main

Special devices:

  • NAS (Linux box) - can access main, media, and DMZ
  • printer - accessible from main, rest of devices on untrusted don’t need to be (I can tunnel through the NAS if needed); can potentially configure a CUPS server on the NAS to route print jobs if needed

Plan:

Router ports:

  1. Internet
  2. WiFi APs
  3. main VLAN
  4. untrusted (VLAN)
  5. unused (or maybe media VLAN)

WiFi SSIDs (currently have a 2.4Ghz and 5Ghz SSIDs):

  1. main VLAN
  2. guest VLAN
  3. untrusted - hidden SSID (mostly for printer) - 2.4GHz only

If the VPN causes issues, I would like the ability to move individual MACs to another VLAN (say, to media, or a separate, usually unused backup VLAN). Not required, just a backup plan in case the VPN causes issues.

This is my first time configuring VLANs, so I’m not really sure what my options are. Also, I’m not super familiar with Mikrotik routers (I’m not a sysadmin or anything, just a hobbyist), I just got fed up with crappy consumer hardware and wanted something a bit more reliable.

Does that sound like a reasonable plan? Is there something I could improve or suggestions you have?

Edit: DMZ is the wrong term, so I replaced it with “untrusted”. By that I meant a local-only network, so no Internet access. Ideally I could access these devices from my main network, but they can’t initiate connections outside their VLAN. However, that’s not necessary, since I can tunnel through my NAS if needed.

  • atzanteolEnglish
    1·
    9 months ago

    Nothing important, and sometimes leaking them

    Sorry it’s difficult for me to care too much about an IP addresses being “leaked” since they’re basically public information. I can “leak” IPs by scanning a subnet and reporting systems that respond to “ping”. Account information being leaked is much more serious though.

    There used to be a time when everybody’s name, phone number and address were printed in books and literally dropped on your doorstep for free. But your IP address is now highly confidential info for… reasons.

    They don’t need my IP for anything, so if I can protect myself and my family with a simple config change, why not?

    Why not? Rapidly diminishing returns - that’s why. Each component you add to your network is a point of failure that takes work to maintain and gains you very little in actual value. Your IP address is the very least important bit of information compared to account and credit card information you may be providing your services. Especially if you’re on a NAT’d connection from your ISP - your IP address isn’t even unique to you.

    And to protect you from… What exactly? Everyone who rants about “MY IP ADDRESS!” seems to fear only nebulous boogy men. Seriously I think VPN marketing is having a crazy effect on people. “HAXORS MIGHT GET YOUR IP ADDRESS!!!” … and do … what exactly?

    The biggest threat to self-hosting is automated scanning and intrusion done by hoards of bots. They just blindly scan and look for hosts exposing compromised services. They don’t get “lists of IP addresses” from a leak to scan. Do you know how much greater effort it would be for somebody to spend time specifically curating IP address vs. just blindly scanning?

    • sugar_in_your_teaOPEnglish
      1·
      9 months ago

      Yes, my IP isn’t particularly important by itself, it only has value when paired with other identifying information, like account names, personal names, etc. My house has my name on it, but that’s not associated with my IP address outside my ISP.

      So here’s a theoretical attack:

      1. My wife/kids decide to stream
      2. The streaming platform has a breach and our IP is associated with my wife/kid’s account
      3. An unrelated breach on SM or e-commerce associates their name with the IP address (or maybe that’s included in the streaming service breach)
      4. Some viewer looks up that info and doxxes my wife/kids, and someone decides to swat us
      5. Since I tend to screen my calls (I get a lot of spam), we don’t respond to police inquiry and someone gets hurt

      Unfortunately, I don’t think that’s all that unrealistic, so I want to secure my network a bit to reduce the risk of that. If I can do that mostly transparently with a local VPN, why not? I also get some obfuscation from ad networks and whatnot as well. Adding a couple ms to my latency is worth that.

      My current IP is behind NAT (my ISP gives me a 10.x.x.x address), but I’m switching providers soon and want to be prepared. Maybe it’ll be unnecessary, IDK, I’m mostly asking to see if my plan is reasonable or if there’s a better way to accomplish my goals.

      scanning

      That only works if you’re already on the network or at least in close proximity.

      I’m more worried about some script kiddie looking at data breach dumps than a drive by attack of some sort.

      • atzanteolEnglish
        11·
        9 months ago

        I don’t think that’s all that unrealistic

        I mean… That’s a near pathological level of paranoia. So you do whatever you need to do in order to sleep at night.

        That only works if you’re already on the network or at least in close proximity.

        Scanning open ports across the internet works just fine. Here’s a scan of some Google IPs just looking for open port 80.

        $ nmap 64.233.160.0/24 -P -p 80
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-21 09:20 EDT
Nmap scan report for oi-in-f17.1e100.net (64.233.160.17)
Host is up (0.054s latency).

PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for oi-in-f18.1e100.net (64.233.160.18)
Host is up (0.053s latency).

PORT   STATE SERVICE
80/tcp open  http

(more below)

        Now you just send a payload to each of those checking for known vulnerabilities. Done. I’m a script kiddie now.

        • sugar_in_your_teaOPEnglish
          1·
          9 months ago

          Sure, I know how port scanning works, I’ve used nmap before.

          But you were talking about discovering my IP, not checking for open ports. The only way I can think of to discover someone’s IP when they’re using a VPN are:

          • hacking the VPN
          • malware on a device
          • someone scanning Wi-Fi networks in my physical area with something like Wireshark

          If I don’t use a VPN, just one service I use needs to be compromised, and I use a lot of services.

          I think paranoid would be going to great lengths to prevent the above, e.g.:

          • hacking VPN - I guess Tor?
          • malware - using something like TailsOS that containerizes everything and persists nothing
          • Wi-Fi scanning - don’t use Wi-Fi, or wrap my home in a faraday cage

          I’m not that paranoid. Setting up a VPN on my router takes 10 min or so, and I can have a backup SSID with no VPN in case something gets messed up. On the paranoid spectrum, that’s pretty tame, especially since I’m only really looking at VPNs in a close geographical area to minimize latency (i.e. very low pings, like 5ms).

          But there’s also a practical reason. My state passed some stupid laws requiring some level of ID by social media sites. I’d like an easy way to tunnel to a neighboring state to avoid the restrictions (closest is ~20ms ping away). I definitely want an easy way for my family to avoid that nonsense, so an SSID is a lot easier to use than configuring a device level VPN.