How I re–over-engineered my home network for privacy and security

Re:How I re–over-engineered my home network for privacy and ... by egberts1 on Wednesday September 01, 2021 @12:50PM (#28382329)

You probably shouldn’t deploy an one-SSID model for your home network.

Not many kernel can separate traffic within a single SSID (even if you did use VLAN, tcpdump on a malicious IoT can still view the traffic.

Better to have four to seven SSID, each mapped to a subnet. Make one subnet/SSID for encrypted MAC with laptops.

Cable TV, Smart TV, power-line LAN adapters, smart lightbulbs and webcams should go on separate SSID/subnet.

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by megous on Wednesday September 01, 2021 @01:59PM (#28383399)

Or just one SSID, where you directly put all the Androids, iPhones, IoTs, and similar garbage in addition to your trusted devices connected via a overlay wireguard network on top in full mesh configuration.

You will not have to trust the potentially outdated wifi firmware, that is quite likely vulnerable to all the latest holes in wifi security.

[ Parent | on HN ]

Re:How I re–over-engineered my home network for privacy and ... by privacyking on Wednesday September 01, 2021 @08:08PM (#28387142)

Wait so does enterprise wifi just send all VLAN traffic to every device despite a login being assigned to a single VLAN?

[ Parent | on HN ]