That reminds me, I need to configure VLANs in my router so that all my trusted computers are isolated from all the other garbage that makes it into the network.
back
3 comments
Doesn’t help when the garbage starts proxying illegal traffic through your home ISP.
Yeah but at least the garbage can't attempt to exploit my laptop.
What happens then?
Feds come to your door asking why you downloaded/distributed CSAM
Is there any evidence this ever happened?
It has happened with tor exit nodes, so I imagine it is possible with shady unconsentual residential proxies.
Seems like a motivation to switch to using a VPN for such untrusted devices that still require internet access.
Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security?
I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is?
Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel?
Just wondering.
Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on.
A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them.
And an Ethernet “hub” does no filtering at all.
Also: if you need a streaming box to see your AirPlay or UPnP devices for “casting” it necessarily has to be on the same VLAN as the devices it’s connecting to. Sonos speakers have this problem when subject to client isolation setups based on VLANs or switch-level packet filters.
And any kind of multicast (used for local service discovery and media streaming) has the same limitations.
Network switches typically aren't known for their outstanding security record, but the vlan tags themselves are trivial and should be hard to mess up. Should someone hack your switch all bets are off, but as long as you don't have management accessible in-band you should be fine. Security problems are more likely to stem from bad configuration.
> Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel?
That would be an exceptionally weird configuration. If a device "sits on VLAN1" that typically means that it's on an "untagged" port where only VLAN1 traffic is allowed. Ports that carry multiple VLANs are "tagged" ports and you normally wouldn't say they "sit" on any specific VLAN, precisely because that port carries tagged traffic for multiple VLANs. It's at best an irregular use of the terminology but likely a misunderstanding somewhere.
A VLAN is a virtual LAN. having two VLANs is like having two LANs but without as much duplicated wiring. It's quite well-supported and reliable.
You usually want to interconnect them at one central point, usually a router, and enforce a security policy there.
this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it.
Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.