114 lines
3.2 KiB
Markdown
114 lines
3.2 KiB
Markdown
|
# VLAN 30 — IoT Network
|
|||
|
|
Subnet: **192.168.130.0/23**
|
|||
|
|
|
|||
|
|
Last Updated: 2026-05-24
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧩 What This Network Is
|
|||
|
|
VLAN 30 is the **dedicated smart‑home and automation network** for all IoT and consumer smart devices.
|
|||
|
|
It is intentionally isolated from trusted networks to reduce security risk while still supporting full functionality for Home Assistant and other automation systems.
|
|||
|
|
|
|||
|
|
This VLAN is designed for devices such as WiZ bulbs, TVs, smart plugs, cameras, sensors, and other automation hardware that require internet access or controller communication but should not interact with trusted user devices.
|
|||
|
|
|
|||
|
|
The network provides a **controlled, low‑trust environment** with carefully scoped access to Home Assistant and DNS services.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 📡 Access Types
|
|||
|
|
- LAN / Cable
|
|||
|
|
- WiFi
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🌐 Subnet
|
|||
|
|
- **192.168.130.0/23**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🖥️ Expected Devices
|
|||
|
|
- Lights
|
|||
|
|
- Switches
|
|||
|
|
- Outlets
|
|||
|
|
- Blinds
|
|||
|
|
- TV & streaming devices
|
|||
|
|
- Alarm systems
|
|||
|
|
- HVAC controllers
|
|||
|
|
- Fans
|
|||
|
|
- Voice assistants
|
|||
|
|
- VOIP phones
|
|||
|
|
- Vacuums
|
|||
|
|
- Door locks
|
|||
|
|
- Garage door openers
|
|||
|
|
- Smoke detectors
|
|||
|
|
|
|||
|
|
## 📌 Notable Devices
|
|||
|
|
| Device | IP | Role |
|
|||
|
|
|--------|-----|------|
|
|||
|
|
| Aqara M100 | 192.168.130.30 (static reservation) | Thread Border Router / Matter hub |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🔒 Security Rules for VLAN 30
|
|||
|
|
|
|||
|
|
### **Outbound (VLAN 30 → Others)**
|
|||
|
|
- **Allowed:**
|
|||
|
|
- IoT → Home Assistant (192.168.150.30:8123, TCP/UDP)
|
|||
|
|
- IoT → Pi‑hole DNS (192.168.150.35, TCP/UDP 53)
|
|||
|
|
- IoT → UCG Max Matter controller (192.168.100.1:5540, TCP)
|
|||
|
|
- **Blocked:**
|
|||
|
|
- IoT → VLAN 20 (Trusted)
|
|||
|
|
- IoT → VLAN 1 (Infrastructure) — except Matter controller port above
|
|||
|
|
- **Default‑Policy Dependent:**
|
|||
|
|
- IoT → VLAN 10 (Management)
|
|||
|
|
- IoT → VLAN 40 (Guest)
|
|||
|
|
|
|||
|
|
### **Inbound (Others → VLAN 30)**
|
|||
|
|
- **Allowed:**
|
|||
|
|
- VLAN 1 (Infrastructure) → VLAN 30
|
|||
|
|
- VLAN 20 (Trusted) → VLAN 30
|
|||
|
|
- Home Assistant (192.168.150.30) → VLAN 30 (TCP/UDP, any port)
|
|||
|
|
- **Blocked:**
|
|||
|
|
- VLAN 50 (Lab/Servers) → VLAN 30
|
|||
|
|
|
|||
|
|
### **Net Effect**
|
|||
|
|
- IoT devices can communicate with Home Assistant and DNS.
|
|||
|
|
- IoT cannot reach Trusted or Infrastructure networks.
|
|||
|
|
- IoT may reach Management or Guest depending on default policy.
|
|||
|
|
- Management, Trusted, and Home Assistant can initiate into IoT.
|
|||
|
|
- Lab cannot reach IoT.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## ⚙️ Important Configuration
|
|||
|
|
- **mDNS reflection enabled** (VLANs 1, 10, 20, 30, 50)
|
|||
|
|
- **IGMP Snooping enabled**
|
|||
|
|
- **Multicast/discovery traffic required** for many integrations
|
|||
|
|
- **Client Isolation must be disabled** — required for Matter/Thread device pairing and intra-VLAN device communication
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🔍 Discovery Protocols Expected
|
|||
|
|
- mDNS
|
|||
|
|
- Multicast
|
|||
|
|
- UDP discovery
|
|||
|
|
- Home Assistant auto‑discovery
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 🧠 Summary for AI Systems
|
|||
|
|
- VLAN 30 = **untrusted IoT zone**, tightly restricted.
|
|||
|
|
- Outbound allowed only to:
|
|||
|
|
- Home Assistant (8123/TCP/UDP)
|
|||
|
|
- Pi-hole DNS
|
|||
|
|
- UCG Max Matter controller (192.168.100.1:5540/TCP)
|
|||
|
|
- Blocked from initiating to VLAN 20 and VLAN 1 (except Matter controller port 5540).
|
|||
|
|
- May reach VLAN 10 or VLAN 40 depending on default policy.
|
|||
|
|
- Inbound allowed from VLAN 1, VLAN 20, and Home Assistant.
|
|||
|
|
- Designed to contain IoT devices while preserving automation functionality.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# ✔️ End of File
|
|||
|
|
|