<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On Mon, 6 Apr 2020 at 18:04, Michael <<a
href="mailto:mythtv@blandford.net" moz-do-not-send="true">mythtv@blandford.net</a>>
wrote:<br>
<blockquote type="cite"
cite="mid:CA+FgBZaCg8odp1ZNkGT5-bieor9=kTeMYMXZ5N6KNQd=DZV7pQ@mail.gmail.com">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
I have something similar to this at my house.<br>
<br>
Desktop computers and infrastructure on VLAN1. Can route to
the <br>
internet or any of the other VLANs<br>
<br>
IOT devices on VLAN 2. Can only route to the internet.
Limited access <br>
to VLAN1 on specific ports/protocols for things like plex or
mythtv<br>
<br>
Guest internet on VLAN 3. Can only route to the internet<br>
<br>
Cameras on VLAN4. Can't route anywhere<br>
<br>
<br>
All VLANs have access to DNS/DHCP on VLAN1<br>
<br>
<br>
I set this up with an Edgerouter and Unifi switches. If you
google <br>
'edgeos IOT vlan' you can find many guides on how to set
something like <br>
this up.<br>
<br>
<br>
The key thing to note is the VLANs don't extend down to the
individual <br>
devices. It is virtual concept that happens between the
swtiches and <br>
routers to separate the networks.<br>
<br>
<br>
Michael</blockquote>
</div>
</blockquote>
<p><br>
I have a similar setup at home. I'm using an older Juniper SSG140.
<br>
<br>
You could also build your own using something like OPNsense which
handles VLANs quite nicely (and could be a firewall for your
home).<br>
<br>
The only caveat I would say is that VLANs COULD extend to end
devices if you set the port on the switch to be a TRUNK port
instead of an ACCESS port.<br>
<br>
But most of the time, switch ports that go to end devices are set
to ACCESS and then a specific VLAN. The end device has no idea
it's on a VLAN.<br>
<br>
Cheers, <br>
<br>
-Ben<br>
</p>
<p><br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="0">--
Ben Kamen - O.D.T., S.P.
----------------------------------------------------------------------
eMail: ben AT benjammin DOT net <a class="moz-txt-link-freetext" href="http://www.benjammin.net">http://www.benjammin.net</a>
Fortune says:
It is more rational to sacrifice one life than six.
-- Spock, "The Galileo Seven", stardate 2822.3
- -
NOTICE: All legal disclaimers sent to benjammin.net/benkamen.net
or any of it's affiliated domains are rendered null and void on
receipt of communications and will be handled/considered as such.
</pre>
</body>
</html>