I switched from a "consumer" setup to a SOHO/Enterprise setup for my home network. Speaking of devices, my network is made of:
1) FWG as router, with port 4 to WAN and port 3 failover with a 4gLTE modem, port 1 Tado bridge, port 2 to switch (see following)
2) Switch Ubiquiti Enterprise 8 POE: port 1 is connected to FWG, port set to accept all traffic (this should be the trunk, right? everything will pass to FWG), port 3 is connected to Zyxel AP NWA210AX, port set to accept all traffic (again, is this correct?), port 2 is connected to an unmanaged 2.5gbit switch, VLAN 103 untagged, ports 4-5 aggregated to a Synology NAS 220+, VLAN 103 untagged.
3) Unmanaged switch (the one connected to port 2 of the ubiquiti) with 7 devices, all of them are not capable of sending tagged packets (i.e. TV, AVR, Nvidia Shield, WD My Cloud, Xbox, BRD), that's why I set VLAN 103 as untagged
4) Zyxel access point (the connected to port 3 of the ubiquiti), with 3 SSID: one is the "main", no VLAN and hidden, on which I connected my personal devices such as laptops, phones, tablets ets. One SSID is for Guests (VLAN 102 untagged), the last one is for IoT, (VLAN 101 untagged), with several devices on it (i.e. smart clock, printer, google home, security camera etc)
Apart from devices, I now have:
1) LAN "main" connection ip class 192.168.58.x, with Ubiquiti Switch, Zyxel Access Point, and my personal wi-fi devices
2) VLAN 101 IoT, ip class 192.168.214.x with said devices all connected via Zyxel AP, hidden SSID
3) VLAN 102 Guest, ip class 192.168.12.x, connection via Zyxel AP
4) VLAN 103 Multimedia, ip class 192.168.82.x, connection via Ubiquiti switch ports 2, 4 and 5
1) VLAN 101 (IoT): allow traffic from LAN, block: traffic to LAN, traffic from&to IoT, traffic from internet, traffic from&to Multimedia, traffic from&to Guest
2) VLAN 102 (Guest): allow traffic from LAN, block: traffic to LAN, traffic from&to IoT, traffic from internet, traffic to LAN, traffic from&to Multimedia, traffic from&to Guest
3) VLAN 103 (Multimedia): allow traffic from LAN, allow traffic from&to Multimedia (needed because I want Nvidia shield to access NAS and Western Digital), block: traffic to LAN, traffic from&to IoT, traffic from&to Guest, traffic from internet.
That's it, is this in your opinion a correct configuration? Or can I add something more in terms of VLANs, rules etc? I could, for example, add a specific VLAN for work devices (2 laptops and 2 phones)... maybe a VLAN only for my personal devices also?
Is there anything about the tagged/untagged setting I can change? The only device which is capable to send tagged packets is the synology NAS, but I don't know if I can set a mixed tagged and untagged profile in ubiquiti switch.
I tried pinging devices from my LAN and it's ok, and if I connect to guest network ping other devices results in loss, as I was expecting
Sorry for the very long post, but it's my first time with VLANs :D
Please sign in to leave a comment.