Hi, folks. I’m trying my best to do my homework before I come here with questions, but even when trying to be selective about what I’m searching for, it’s often a fire hose of information that’s hard to take in.

I’m trying to prepare for exposing self hosted services to the internet with a reasonable amount of security. Tailscale isn’t going to be a great option for my use cases due to added friction for additional users as well as the total number of users I expect to have, so my goal is to segregate my 1-2 servers from the rest of my home network, so that if they’re compromised, the rest of my network is fine. Based on what I’ve read, I think I want my regular VLAN 1 to be my network as is, and then I can make a separate VLAN for my NAS and, eventually, a mini PC that are hosting services. I want to be able to talk to those devices from VLAN 1 but not the other way around, and I think I can do that with VLAN rules.

I’m trying to follow this Home Network Guy guide, but as it relates to what I’m trying to do, I have a few questions. My network setup is partially constrained by the layout of my apartment and where I can find electrical outlets, so I can only change it so much. Basically, it’s internet in->Verizon’s provided router->living room switch->office switch. The living room switch is sort of a repeater just to make everything reach, but it also connects game consoles, which also double as media streaming machines, like streaming Jellyfin from our own NAS. The NAS, my desktop, and my work PC are all connected to the office switch, and eventually a mini PC will live here full-time as well; as stated above, I want just the NAS and mini PC on their own VLAN. I think what I need to do is put a firewall between my router and the living room switch to define the VLAN rules and tag packets, and then replace the office switch with one that understands VLAN tags. So my questions are:

  1. In that guide, he has a firewall mini PC that costs about $540. A quick search on Amazon results in similar machines ranging from $100 to almost $600. It’s not going to break the bank in either case, but I don’t want to buy something I don’t need, and I can’t tell what “too much” or “not enough” is.
  2. I’d prefer not to replace the Verizon router if I don’t have to, because I’m not sure how much of my service depends on it, so assuming that’s possible to leave untouched, would it then connect to the firewall’s WAN port or LAN port? If it’s not serving as the router itself, I’d imagine LAN, and then I’d need at least two LAN ports on the firewall device, but I just wanted to be sure.
  3. There are two hops before any packet makes it to its destination in the office; do both switches need to be managed switches for the VLAN tags to stay intact? Or just the office switch?
  4. Is there anything in the above that I’ve gotten so wrong that it somehow invalidates my questions, and I’m further away from understanding this than I think I am?

Thanks for any help you folks can offer!

  • IsoKiero@sopuli.xyzEnglish
    1·
    24 days ago

    In most common case you can think VLANs at the firewall end like whole different physical networks. On port LAN1 you have a switch and whatever else you happen to have, on LAN2 similar setup and so on. All the networks can (and should) have their own IP range and it’s the firewall who decides what traffic is allowed, like is a machine in LAN1 allowed to talk with printer on LAN2.

    Virtual LAN just bundles that all to one set of cables and network devices with the obvious benefit that you can have benefits of multiple networks for security, access control or whatever but you don’t need extra hardware for each setup. In theory it is possible to break out of VLAN separation, but in practice it’s really not something a home gamer should worry about too much.

    What you need is a managed switch (or multiple if needed) so that you can assign ports to different VLANs or a combination of many VLANs in a single port, commonly known as trunk. Some unmanaged switches pass trough VLAN frames as is, but it’s not guaranteed, so safe bet is to get only managed switches.

    For the firewall/router, the best option would be to either drop the ISP router totally or if possible use bridged port on it so that you can get ‘raw’ internet to your own device. You can make it work with ‘LAN’ port on your current router too, there’s just one set of port forwarding and firewall rules extra to manage before anything even hits your own network. Instead of firewall PC I’d recommend an actual router. They are often more suited to the task, are physically smaller and tend to consume less energy. Also dedicated firewall/routers are often a bit cheaper (at least less than 600$, I paid ~150€ for my router). I personally have a Mikrotik device and I like it, but there’s plenty decent ones to choose from. PC will work as well, but they tend to have more potentially failing components than dedicated routers.

    But in general, at least I can’t see anything fundamentally wrong with your plan. Remember to have fun while setting it up.