Project #23 - What Makes Sense to ChangeUp in the Network?

What makes sense in the changeup of my network?

I do have a problem in the way that things are partitioned:

1. vlans are just that, they are setup to not have connection to each other.  This is by design, and I went out of my way when I setup my Edgerouter-12 to force vlan isolation even though by default vlans can talk to each other.

2. I actually setup some vlans so that the elements in those vlans would only be able to talk outside the router to the internet and not to each other.  This was a security design.

3. I made sure that vlans that were isolated to other vlans were not able to modify any of the settings on my Edgerouter-12 except for the admin vlan.  This was a security design.

4. I have a couple of specific computers that are allowed to contact other vlans.  This was by design and allows me to monitor equipment as necessary without having to give all my equipment the same level of access.  This was a security design.

5. The above way of partitioning has resulted in some problems with being able to get to certain servers.  I actually need the following:

• I need to be able to get to port 8123 of my HA-IOT server, on the IOT vlan, from the LAN3 vlan which contains my iPhones, iPads, and laptops.
• My HA-IOT server needs to get to the data servers in the Server vlan
• My Plex server resides in the Server vlan and both the Media and the LAN3 vlan need to get to it
• My Media equipment needs to get to the data servers in the Server vlan
• For testing purposes I need to have some Docker containers in the Development vlan be able to get to the MQTT server on the HA-IOT server in the LAN3 vlan
• My iPhones, iPads, and laptops on the LAN3 vlan need to be able to get to Media equipment on the Media vlan
• Some of these alternate connections are going to require the device to be on the same subnet

So, this means that there needs to be overlap between the different vlans, but at the same time it needs to be controlled.  I do have an additional Edgerouter-X which I can use for that purpose.  This will be an exploration of what I can accomplish.  This Edgerouter-X will not be used as a normal router, but will in fact be the way that I can provide a controlled interface between vlans.  If the router is removed, then everything will go back to the way it was before.  This will also give me a chance to try out zone based routing on the Edgerouter-X.

Patch Panel Connections

  DwnFR            DwnBRM       Attic       Kitchen                         LftFire
+------+   (3)   +------+    +------+    +-------+               (2)    +-----------+   (4)
| PP#4 +---------+ PP#5 |    | PP#9 |    | PP#12 |           +----------+  PP#6     +----------+
+--+---+         +--+---+    +--+---+    +-+-----+           |          +--+--------+          |
   |                |           |          |                 |             |                   |  SideRm
   |                |           |          |(1)              |      +------+               +---+---+
   |                |           |          |                 |      |                      | PP#10 |
   |(1)             |(1)        |(1)       |                 |      |    RtFire            +---+---+
   |                |           |          |                 |      |        +------+  (3)     |
   |                |           |          |                 |      |        | PP#7 +----------+
   |                |           |          |                 |      |        +------+
   |                |           |          |                 |      |
   |           +----+-----------+----------+-----------------+-+    |(2)
   +-----------+                  PP#1                         |    |
               +-+-----------+------------------+------------+-+    |
                 |           |    Toolroom      |            |      |
                 |(1)        |                  |            |      |
                 |           |                  |(5)         |(1)   |
            +----+--+        |(9)               |            |      |
      Hutch | PP#11 |        |               +--+---+    +---+------+-+
            +----+--+        |               | PP#2 |    |    PP#8    |
                 |           |               +--+---+    +---+--------+
                 |(2)        |          Outtool |            |
                 |           |                  |            |
                 |           |                  |            |
                 |           |                  |            |
                 |           |                  |(1)         |(3)
                 |           |                  |            |              Table
               +-+-----------+------------------+------------+-+   (3)    +-------+
               |                  PP#3                         +----------+ PP#13 |
               +-----------------------------------------------+          +-------+
                                         Rack

Diagram completed at http://asciiflow.com/.  Rectangles are patch panels, connecting lines have the number of Ethernet cables between.

Edgerouter-12 setup for isolated Home-Assistant and IOT vlan

 Here is the cli firewall setup that I decided to use on my Edgerouter-12 (ER-12) to isolate the vlan for my home-assistant and IOT equipment.  This equipment is setup to work within my local network.  You still need a DHCP service defined on the ER-12, unless it comes from an external source.  The basics are:

1. the HA-IOT are allowed to access the internet, they need this to connect to the Wyze servers
2. the HA-IOT can access each other on the vlan
3. the HA-IOT can be accessed by specific laptops located on different vlans
4. the HA-IOT are not allowed to modify configuration on the Edgerouter-12 but can get their DNS and DHCP services from the ER-12
5. the HA-IOT are not allowed to access any other vlan on the ER-12
6. other specific vlans are allowed to access the home-assistant server at the 8123 port (not implemented yet)

First we need a Group of addresses for the RFC-1918 private addresses, control laptops, printer, and the HA-IOT vlan addresses:

set firewall group address-group RFC-1918_GROUP address 192.168.0.0/16
set firewall group address-group RFC-1918_GROUP address 172.16.0.0/12
set firewall group address-group RFC-1918_GROUP address 10.0.0.0/8
set firewall group address-group RFC-1918_GROUP description 'RFC-1918 Group'
set firewall group address-group CONTROL_LAPTOP address <control_laptop_1_IP>
set firewall group address-group CONTROL_LAPTOP address <control_laptop_2_IP>
set firewall group address-group CONTROL_LAPTOP description 'Laptop used for Admin on Network'
set firewall group address-group PRINTER address <printer_IP>
set firewall group address-group PRINTER description 'Printer IP on Network'
set firewall group network-group HA-IOT_GROUP description 'ip addresses in HA-IOT vlan'
set firewall group network-group HA-IOT_GROUP network <HA-IOT_vlan_address_range>/24

Next we need a vif off of switch0 for our vlan:

set interfaces switch switch0 vif <HA-IOT_vlan_tag> address <router_address_on_HA-IOT_vlan>/24
set interfaces switch switch0 vif <HA-IOT_vlan_tag> description HA-IOT
set interfaces switch switch0 vif <HA-IOT_vlan_tag> firewall in name HA-IOT_IN
set interfaces switch switch0 vif <HA-IOT_vlan_tag> firewall local name HA-IOT_LOCAL
set interfaces switch switch0 vif <HA-IOT_vlan_tag> firewall out name HA-IOT_OUT
set interfaces switch switch0 vif <HA-IOT_vlan_tag> ip enable-proxy-arp

The rules for traffic from our HA-IOT vlan to the ER-12 [HA-IOT_IN]:

set firewall name HA-IOT_IN default-action accept
set firewall name HA-IOT_IN description 'Guest In'
set firewall name HA-IOT_IN rule 10 action accept
set firewall name HA-IOT_IN rule 10 description 'accept established and related'
set firewall name HA-IOT_IN rule 10 log disable
set firewall name HA-IOT_IN rule 10 protocol all
set firewall name HA-IOT_IN rule 10 state established enable
set firewall name HA-IOT_IN rule 10 state invalid disable
set firewall name HA-IOT_IN rule 10 state new disable
set firewall name HA-IOT_IN rule 10 state related enable
set firewall name HA-IOT_IN rule 20 action reject
set firewall name HA-IOT_IN rule 20 description 'reject invalid packets'
set firewall name HA-IOT_IN rule 20 log disable
set firewall name HA-IOT_IN rule 20 protocol all
set firewall name HA-IOT_IN rule 20 state established disable
set firewall name HA-IOT_IN rule 20 state invalid enable
set firewall name HA-IOT_IN rule 20 state new disable
set firewall name HA-IOT_IN rule 20 state related disable
set firewall name HA-IOT_IN rule 30 action accept
set firewall name HA-IOT_IN rule 30 description 'allow printer'
set firewall name HA-IOT_IN rule 30 destination group address-group PRINTER
set firewall name HA-IOT_IN rule 30 log disable
set firewall name HA-IOT_IN rule 30 protocol all
set firewall name HA-IOT_IN rule 30 source group address-group CONTROL_LAPTOP
set firewall name HA-IOT_IN rule 40 action accept
set firewall name HA-IOT_IN rule 40 description 'accept HA-IOT traffic'
set firewall name HA-IOT_IN rule 40 destination group network-group HA-IOT_GROUP
set firewall name HA-IOT_IN rule 40 log disable
set firewall name HA-IOT_IN rule 40 protocol all
set firewall name HA-IOT_IN rule 50 action drop
set firewall name HA-IOT_IN rule 50 description 'Block RFC-1918 Traffic'
set firewall name HA-IOT_IN rule 50 destination group address-group RFC-1918_GROUP
set firewall name HA-IOT_IN rule 50 log disable
set firewall name HA-IOT_IN rule 50 protocol all

The rules for traffic from our HA-IOT vlan to the ER-12 itself (DNS, DHCP, other services) [HA-IOT_LOCAL]:

set firewall name HA-IOT_LOCAL default-action drop
set firewall name HA-IOT_LOCAL description 'Guest Local'
set firewall name HA-IOT_LOCAL rule 10 action accept
set firewall name HA-IOT_LOCAL rule 10 description 'accept established and related'
set firewall name HA-IOT_LOCAL rule 10 log disable
set firewall name HA-IOT_LOCAL rule 10 protocol all
set firewall name HA-IOT_LOCAL rule 10 state established enable
set firewall name HA-IOT_LOCAL rule 10 state invalid disable
set firewall name HA-IOT_LOCAL rule 10 state new disable
set firewall name HA-IOT_LOCAL rule 10 state related enable
set firewall name HA-IOT_LOCAL rule 20 action reject
set firewall name HA-IOT_LOCAL rule 20 description 'reject invalid packets'
set firewall name HA-IOT_LOCAL rule 20 log disable
set firewall name HA-IOT_LOCAL rule 20 protocol all
set firewall name HA-IOT_LOCAL rule 20 state established disable
set firewall name HA-IOT_LOCAL rule 20 state invalid enable
set firewall name HA-IOT_LOCAL rule 20 state new disable
set firewall name HA-IOT_LOCAL rule 20 state related disable
set firewall name HA-IOT_LOCAL rule 30 action accept
set firewall name HA-IOT_LOCAL rule 30 description 'Allow DHCP'
set firewall name HA-IOT_LOCAL rule 30 destination port 67
set firewall name HA-IOT_LOCAL rule 30 log disable
set firewall name HA-IOT_LOCAL rule 30 protocol udp
set firewall name HA-IOT_LOCAL rule 30 source port 68
set firewall name HA-IOT_LOCAL rule 40 action accept
set firewall name HA-IOT_LOCAL rule 40 description 'Allow DNS'
set firewall name HA-IOT_LOCAL rule 40 destination port 53
set firewall name HA-IOT_LOCAL rule 40 log disable
set firewall name HA-IOT_LOCAL rule 40 protocol tcp_udp

The rules for traffic from the ER-12 to our HA-IOT vlan [HA-IOT_OUT]:

set firewall name HA-IOT_OUT default-action accept
set firewall name HA-IOT_OUT description 'Guest Out'
set firewall name HA-IOT_OUT rule 10 action accept
set firewall name HA-IOT_OUT rule 10 description 'accept established and related'
set firewall name HA-IOT_OUT rule 10 log disable
set firewall name HA-IOT_OUT rule 10 protocol all
set firewall name HA-IOT_OUT rule 10 state established enable
set firewall name HA-IOT_OUT rule 10 state invalid disable
set firewall name HA-IOT_OUT rule 10 state new disable
set firewall name HA-IOT_OUT rule 10 state related enable
set firewall name HA-IOT_OUT rule 20 action reject
set firewall name HA-IOT_OUT rule 20 description 'reject invalid packets'
set firewall name HA-IOT_OUT rule 20 log disable
set firewall name HA-IOT_OUT rule 20 protocol all
set firewall name HA-IOT_OUT rule 20 state established disable
set firewall name HA-IOT_OUT rule 20 state invalid enable
set firewall name HA-IOT_OUT rule 20 state new disable
set firewall name HA-IOT_OUT rule 20 state related disable
set firewall name HA-IOT_OUT rule 40 action accept
set firewall name HA-IOT_OUT rule 40 description 'accept HA-IOT traffic'
set firewall name HA-IOT_OUT rule 40 log disable
set firewall name HA-IOT_OUT rule 40 protocol all
set firewall name HA-IOT_OUT rule 40 source group network-group HA-IOT_GROUP
set firewall name HA-IOT_OUT rule 50 action drop
set firewall name HA-IOT_OUT rule 50 description 'Drop Non-Guest Traffic'
set firewall name HA-IOT_OUT rule 50 log disable
set firewall name HA-IOT_OUT rule 50 protocol all
set firewall name HA-IOT_OUT rule 50 source group address-group RFC-1918_GROUP

Edgerouter-12 setup for completely isolated camera vlan

 Here is the cli firewall setup that I decided to use on my Edgerouter-12 (ER-12) to isolate the vlan for my cameras.  You still need a DHCP service defined on the ER-12, unless it comes from an external source.  The basics are:

1. the cameras are allowed to access the internet, they need this to connect to the Wyze servers
2. the cameras cannot access each other on the vlan
3. the cameras are not allowed to modify configuration on the Edgerouter-12 but can get their DNS and DHCP services from the ER-12
4. the cameras are not allowed to access any other vlan on the ER-12
5. this ruleset is patterned after a normal Guest vlan with limited access

First we need a Group of addresses for the RFC-1918 private addresses:

set firewall group address-group RFC-1918_GROUP address 192.168.0.0/16
set firewall group address-group RFC-1918_GROUP address 172.16.0.0/12
set firewall group address-group RFC-1918_GROUP address 10.0.0.0/8
set firewall group address-group RFC-1918_GROUP description 'RFC-1918 Group'

Next we need a vif off of switch0 for our vlan:

set interfaces switch switch0 vif <camera_vlan_tag> address <router_address_on_camera_vlan>/24
set interfaces switch switch0 vif <camera_vlan_tag> description Cameras
set interfaces switch switch0 vif <camera_vlan_tag> firewall in name CAMERA_IN
set interfaces switch switch0 vif <camera_vlan_tag> firewall local name CAMERA_LOCAL
set interfaces switch switch0 vif <camera_vlan_tag> firewall out name CAMERA_OUT
set interfaces switch switch0 vif <camera_vlan_tag> ip enable-proxy-arp

The rules for traffic from our camera vlan to the ER-12 [CAMERA_IN]:

set firewall name CAMERA_IN default-action accept
set firewall name CAMERA_IN description 'Guest In'
set firewall name CAMERA_IN rule 10 action accept
set firewall name CAMERA_IN rule 10 description 'accept established and related'
set firewall name CAMERA_IN rule 10 log disable
set firewall name CAMERA_IN rule 10 protocol all
set firewall name CAMERA_IN rule 10 state established enable
set firewall name CAMERA_IN rule 10 state invalid disable
set firewall name CAMERA_IN rule 10 state new disable
set firewall name CAMERA_IN rule 10 state related enable
set firewall name CAMERA_IN rule 20 action reject
set firewall name CAMERA_IN rule 20 description 'reject invalid packets'
set firewall name CAMERA_IN rule 20 log disable
set firewall name CAMERA_IN rule 20 protocol all
set firewall name CAMERA_IN rule 20 state established disable
set firewall name CAMERA_IN rule 20 state invalid enable
set firewall name CAMERA_IN rule 20 state new disable
set firewall name CAMERA_IN rule 20 state related disable
set firewall name CAMERA_IN rule 30 action drop
set firewall name CAMERA_IN rule 30 description 'Block RFC-1918 Traffic'
set firewall name CAMERA_IN rule 30 destination group address-group RFC-1918_GROUP
set firewall name CAMERA_IN rule 30 log disable
set firewall name CAMERA_IN rule 30 protocol all

The rules for traffic from our camera vlan to the ER-12 itself (DNS, DHCP, other services) [CAMERA_LOCAL]:

set firewall name CAMERA_LOCAL default-action drop
set firewall name CAMERA_LOCAL description 'Guest Local'
set firewall name CAMERA_LOCAL rule 10 action accept
set firewall name CAMERA_LOCAL rule 10 description 'accept established and related'
set firewall name CAMERA_LOCAL rule 10 log disable
set firewall name CAMERA_LOCAL rule 10 protocol all
set firewall name CAMERA_LOCAL rule 10 state established enable
set firewall name CAMERA_LOCAL rule 10 state invalid disable
set firewall name CAMERA_LOCAL rule 10 state new disable
set firewall name CAMERA_LOCAL rule 10 state related enable
set firewall name CAMERA_LOCAL rule 20 action reject
set firewall name CAMERA_LOCAL rule 20 description 'reject invalid packets'
set firewall name CAMERA_LOCAL rule 20 log disable
set firewall name CAMERA_LOCAL rule 20 protocol all
set firewall name CAMERA_LOCAL rule 20 state established disable
set firewall name CAMERA_LOCAL rule 20 state invalid enable
set firewall name CAMERA_LOCAL rule 20 state new disable
set firewall name CAMERA_LOCAL rule 20 state related disable
set firewall name CAMERA_LOCAL rule 30 action accept
set firewall name CAMERA_LOCAL rule 30 description 'Allow DHCP'
set firewall name CAMERA_LOCAL rule 30 destination port 67
set firewall name CAMERA_LOCAL rule 30 log disable
set firewall name CAMERA_LOCAL rule 30 protocol udp
set firewall name CAMERA_LOCAL rule 30 source port 68
set firewall name CAMERA_LOCAL rule 40 action accept
set firewall name CAMERA_LOCAL rule 40 description 'Allow DNS'
set firewall name CAMERA_LOCAL rule 40 destination port 53
set firewall name CAMERA_LOCAL rule 40 log disable
set firewall name CAMERA_LOCAL rule 40 protocol tcp_udp

The rules for traffic from the ER-12 to our camera vlan [CAMERA_OUT]:

set firewall name CAMERA_OUT default-action accept
set firewall name CAMERA_OUT description 'Guest Out'
set firewall name CAMERA_OUT rule 10 action accept
set firewall name CAMERA_OUT rule 10 description 'accept established and related'
set firewall name CAMERA_OUT rule 10 log disable
set firewall name CAMERA_OUT rule 10 protocol all
set firewall name CAMERA_OUT rule 10 state established enable
set firewall name CAMERA_OUT rule 10 state invalid disable
set firewall name CAMERA_OUT rule 10 state new disable
set firewall name CAMERA_OUT rule 10 state related enable
set firewall name CAMERA_OUT rule 20 action reject
set firewall name CAMERA_OUT rule 20 description 'reject invalid packets'
set firewall name CAMERA_OUT rule 20 log disable
set firewall name CAMERA_OUT rule 20 protocol all
set firewall name CAMERA_OUT rule 20 state established disable
set firewall name CAMERA_OUT rule 20 state invalid enable
set firewall name CAMERA_OUT rule 20 state new disable
set firewall name CAMERA_OUT rule 20 state related disable
set firewall name CAMERA_OUT rule 30 action drop
set firewall name CAMERA_OUT rule 30 description 'Drop Non-Guest Traffic'
set firewall name CAMERA_OUT rule 30 log disable
set firewall name CAMERA_OUT rule 30 protocol all
set firewall name CAMERA_OUT rule 30 source group address-group RFC-1918_GROUP

Thinking of making the IOT network self contained

 It occurred to me that at some time in the future, I might have problems with my network again.  But this time I will probably be more dependent on the elements of the network since I am highly dependent on the router providing DHCP IP addresses and the WAP providing the wifi connection for other elements that require support.  I now think it would be wise to be able to isolate my HA-IOT network from the other part of my network, and still be able to have it work if things happen.  Since I use an Atom based computer for the Home-assistant and MQTT base, I might be able to use that to provide both a WAP and a DHCP/DNS server for the network.  If I do that the wifi port can provide connection for the wifi components, the z-wave adapter for the z-wave components, and if the DHCP/DNS server extends to the HA-IOT vlan as it's control, I don't have to depend upon the router to give me those elements.  If I go on a trip, I can cut off everything else and still have the HA-IOT network working as it needs to be.  Since it is on an UPS, it won't be going down anytime soon.  I just have to figure out how to accomplish this on the Atom processor.

Update: over the weekend 1/9 - 10/2021, I modified the HA-IOT vlan to be completely isolated from other vlans, but at the same time able to communicate within the vlan itself.  It is also isolated from modifying the router or any other switch component in the network.  I am also thinking of changing the bandwidth to the internet to something that is below video capability.  My cameras are on a separate vlan which is isolated from everything due to their nature of using an external server.

Tips #7 - My Network Philosophy in So Many Words

When considering how to think about, design, and develop a home network you must consider your specific situation.  If I were to pick one topic I would have to stress the word CHANGE.  Change will happen to your network over time and you must be able to react and plan for it.  Networks are never static over time.  Here are some items to consider:

1. Are you going to stay put for very long?
• Renters know this, you don't just punch a hole in the wall to do something; you will end up having to repair it before you leave
• The answer to this question might mean the difference between an all wifi or a partial wifi solution
2. What are you planning on doing with your network?
• You may have simple plans for what you are doing now, but what about the future uses?
• It's not always about gaming
• Consider things like setting up for IOT, cameras, and media in the future
• Write up a list of the order of importance for things you will use the network for
3. Cables will stay, devices will always be subject to moving
• If you have spent the time putting a cable into a wall or overhead, you will really not want to move it again
• I have moved my main router to 5 different locations in my house over the years - will you have to do the same
• Consider the fact that equipment may fail and have to be replaced
• You may, over time, have different ISPs that you deal with - I have dealt with 3 different ISPs over the years, each one had a different way of presenting their services to my house (dial up, cable, fiber optic)
4. Do you really want to drill that hole?
• Once you drill a hole, you are stuck with it
• If you ever move you will have to repair it
• Placement of a hole is important, can it be hidden - not everyone wants to see a cable sticking out of a wall, especially spouses
5. Always start with the cabling
• If your neighbors are "jaming" the wifi signal it will be nice to be able to fall back on cabling to supply your network needs
• Don't forget you have options: Ethernet, Coax Cable, fiber optic in addition to wifi
6. Patch panels, strategically placed, help in the movement of equipment
• If you use keystone patch panels with straight through couplers you will always have the ability to use already made cables
• Couplers allow you to move the positions of the Ethernet cable ends on a single patch panel
• Patch panels allow you to use small patch cables to make one long connection between patch panels when a direct connection was not available
7. Consider the judicious use of vlans in the Network to isolate equipment
• Vlans give you the ability to minimize the number of cables run to different parts of the house; you use a "trunk" line from one managed switch/router to another and keep other ports on the router/managed switch to one specific vlan
• Vlans give you the ability to isolate different segments of your network for different purposes
• If the router from your ISP doesn't have vlan capability, you can always put a router behind it that does, or alternatively use your own router for the connection to the ISP
8. Use the highest bandwidth switches and routers that your budget will allow
• As bandwidth gets cheaper, and/or the signal from your ISP changes over time you may encounter a situation where it is advantageous to have already installed equipment that can meet the bandwidth increase
• This means that you should always consider the cabling and what it's bandwidth capability provides; right now Cat5e should be sufficient, but you may want to consider Cat6 and above for growth
9. Always consider the unthinkable, like failures and how it will affect the network
• I have had older equipment fail on me when it was most inconvenient; being able to quickly replace the equipment because you thought out the problem beforehand will help
• I have lost equipment to lightning strikes; never assume that it will not happen to you
• Put lightning arrestors on Ethernet lines from the outside and on Coax cable connections to equipment
• If at all possible get a whole house surge protector for those times when a higher than usual voltage spike happens that gets into your house
• If it is within your budget consider the judicious use of UPS at different spots in your network; sometimes a hard fail of power will cause a failure in hard drives
• If some piece of equipment fails in the network, how fast can you come back up to a semi normal state, or at least most of your list of network importance from #1 above
10. Consider security when you are setting up the network
• It goes without saying that IOT equipment needs to be isolated, due to it's very nature of contacting outside servers; if at all possible, keep the information in your house
• Never assume that the router on the perimeter will always protect you from intruders; in fact, always assume that someone has already attacked and entered your network and design accordingly

Unusual problem connecting Node Red to Home-Assistant

I decided to update my IOT network, by updating all of my Docker containers.  In doing so, I encountered an unusual problem with connecting Node Red to my Home-Assistant container.  This was from several containers.  Normally, I would be using the simple username password authentication, but now that authentication mechanism is not working at all.  Interestingly enough, part of the problem shows up with the Node Red extension that connects to HA via websockets.  I can no longer set the Home Assistant server or any of the authentication mechanisms associated with it.  In fact, it now shows up as a simple text box to enter the server's name.  But that does no good because I cannot specify what IP, port, or authentication mechanism that I want to use.  I am not sure of how to fix this issue.

Update (2020-10-08): I put the Node Red container on a Raspberry Pi, completely away from the Home -Assistant container and I was able to get Node Red to connect.  Now I have to figure out what has happened to my Node Red container on the HA-IOT Server.