Plex Pass though to IOT Network

[custmblt]

I would like to have my Plex server available to my IOT devices (TV;s) that are separated from my normal network but still on the same router (rt-ax86u pro) My home network is setup on 10.xxx.xxx.1 and the guest and IOT network is setup on 192.xxx.xxx.1 not sure how to safely do this other than remotely connected and that does work but is much slower that to use just local LAN traffic. I don't trust these new smart TV's to behave on my network.

Thanks

 

[bbunge]

I would like to have my Plex server available to my IOT devices (TV;s) that are separated from my normal network but still on the same router (rt-ax86u pro) My home network is setup on 10.xxx.xxx.1 and the guest and IOT network is setup on 192.xxx.xxx.1 not sure how to safely do this other than remotely connected and that does work but is much slower that to use just local LAN traffic. I don't trust these new smart TV's to behave on my network.

Thanks

Looks like you are running an AX86U Pro? If so, with the new Asus firmware you have the ability to do VLAN. Depending upon the box you are running the Plex server on, you can add a second LAN interface and tag it to use the guest network. I did this with my DS220+ which has two LAN ports and it worked. If the Plex box has only a single LAN port it may be possible to set up a second IP address to connect to the guest network.

 

[RobJack]

My recommendation is to scratch one of the private networks and separate your IoT from your regular network using VLANs and then use VLAN tagging to enable Plex to talk to the TV. If you absolutely insist on the need for a second address space, then you will have to add a Layer 3 device to the network to bridge the two via default gateways and a static route.

 

[custmblt]

Great stuff, thanks for the reply. I should have been more clear in the beginning or maybe Ive miss understood you. The 10.xxx.xxx.1 is the LAN IP range that Plex is connected too. The 192.xxx.xxx.1 is one of the guest network WiFi connections and the IP is assigned by the default IP range(192). When I set up the router I modified the default LAN IP to the 10.xxx.xxx.1. I though it might add some additional security? My Plex server is attached to my file & backup server for my endpoints. I believe from our conversation here is that I needed to run a separate machine running just the Plex server on the IOT network(guest) The Plex server started out as a project but has turned into much more and probably just needs to be isolated not only for ease of programming but security as well.

 

[RobJack]

Great stuff, thanks for the reply. I should have been more clear in the beginning or maybe Ive miss understood you. The 10.xxx.xxx.1 is the LAN IP range that Plex is connected too. The 192.xxx.xxx.1 is one of the guest network WiFi connections and the IP is assigned by the default IP range(192). When I set up the router I modified the default LAN IP to the 10.xxx.xxx.1. I though it might add some additional security? My Plex server is attached to my file & backup server for my endpoints. I believe from our conversation here is that I needed to run a separate machine running just the Plex server on the IOT network(guest) The Plex server started out as a project but has turned into much more and probably just needs to be isolated not only for ease of programming but security as well.

What I meant by adding a layer 3 device is to add either another router, or (preferably) a Layer 3 switch (which will route) and put all of the other private network on it. This will allow the two networks to talk to each other while still allowing the security you are looking for. Honestly, and at least in my opinion, I would say most folks would not consider a smart TV to be part of the IoT family, as IoT devices are usually things like smart plugs, lights, wall switches, microwaves, ovens, etc...basically single function devices that do not run apps. Your TV is capable of running multiple apps (every streaming service is its own app) and has a complex operating system, unlike a "smart" plug or other IoT devices. TV manufacturers get a lot more scrutiny than the hundreds (if not thousands) of offshore manufacturers of smart plugs and the like, and this is where the security concerns with IoT devices lies. No one knows with certainty how much and what data these things are collecting and phoning home with, therefore the reason for isolating them. I would put my Plex server and all my TVs on the same network, and then isolate all your "smart" plugs, lights, light switches, etc either via VLAN or a separate network. Hope this helps?

 

[bennor]

I would like to have my Plex server available to my IOT devices (TV;s) that are separated from my normal network but still on the same router (rt-ax86u pro) My home network is setup on 10.xxx.xxx.1 and the guest and IOT network is setup on 192.xxx.xxx.1 not sure how to safely do this other than remotely connected and that does work but is much slower that to use just local LAN traffic. I don't trust these new smart TV's to behave on my network.

If you are not using AiMesh, one option is to install Asus-Merlin firmware on the Asus router if your router is supported. Then install the YazFi addon script. The YazFi addon script adds some additional configuration options to Guest Networks including the option to use custom firewall scripting to allow YazFi Guest Network clients to access a main LAN client.

Home | Asuswrt-Merlin

www.asuswrt-merlin.net

YazFi - YazFi v4.x - continued

v4.4.4 Updated 2023-11-26 Feature expansion of guest WiFi networks on AsusWRT-Merlin, including, but not limited to: * Dedicated VPN WiFi networks * Separate subnets for organisation of devices * Restrict guests to only contact router for ICMP, DHCP, DNS, NTP and NetBIOS * Allow guest networks...

www.snbforums.com

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

Some past posts on using YazFi custom firewall scripting to open communication between a YazFi Guest Network client and a main LAN client.
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521
https://www.snbforums.com/threads/help-with-iptables-script.87827/#post-878058

Otherwise like already suggested above, if you have a Pro series router that has 3.0.0.6.x firmware support, you can try using the Guest Network Pro feature. May take some trial and error to get the Guest Network Pro/VLAN to work right for what you seek.

[Guest Network Pro] What is Guest Network Pro? | Official Support | ASUS USA

 

[coxhaus]

If you have ACLs in firewall rules with the new software you should be able to do it. Otherwise, you can use a layer 3 switch with ACLs. I do it on my Cisco layer3 switch with ACLs. I share a printer.

 

[custmblt]

What I meant by adding a layer 3 device is to add either another router, or (preferably) a Layer 3 switch (which will route) and put all of the other private network on it. This will allow the two networks to talk to each other while still allowing the security you are looking for. Honestly, and at least in my opinion, I would say most folks would not consider a smart TV to be part of the IoT family, as IoT devices are usually things like smart plugs, lights, wall switches, microwaves, ovens, etc...basically single function devices that do not run apps. Your TV is capable of running multiple apps (every streaming service is its own app) and has a complex operating system, unlike a "smart" plug or other IoT devices. TV manufacturers get a lot more scrutiny than the hundreds (if not thousands) of offshore manufacturers of smart plugs and the like, and this is where the security concerns with IoT devices lies. No one knows with certainty how much and what data these things are collecting and phoning home with, therefore the reason for isolating them. I would put my Plex server and all my TVs on the same network, and then isolate all your "smart" plugs, lights, light switches, etc either via VLAN or a separate network. Hope this helps?

Well said and yes that helps. I haven't trusted the smart TV's because it was my believe that most of them are running older version of android that are no longer getting security patches? That said I replace all my TV's with Roku's as they do seem to keep up with security patches. I like the idea of using VLANs but haven't see any options for VLAN support in the RT86u-Pro, I do also like the idea of using another router(layer 3). Thanks for the great ideas and support.

 

[custmblt]

If you are not using AiMesh, one option is to install Asus-Merlin firmware on the Asus router if your router is supported. Then install the YazFi addon script. The YazFi addon script adds some additional configuration options to Guest Networks including the option to use custom firewall scripting to allow YazFi Guest Network clients to access a main LAN client.

Home | Asuswrt-Merlin

www.asuswrt-merlin.net

YazFi - YazFi v4.x - continued

v4.4.4 Updated 2023-11-26 Feature expansion of guest WiFi networks on AsusWRT-Merlin, including, but not limited to: * Dedicated VPN WiFi networks * Separate subnets for organisation of devices * Restrict guests to only contact router for ICMP, DHCP, DNS, NTP and NetBIOS * Allow guest networks...

www.snbforums.com

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

Some past posts on using YazFi custom firewall scripting to open communication between a YazFi Guest Network client and a main LAN client.
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521
https://www.snbforums.com/threads/help-with-iptables-script.87827/#post-878058

Otherwise like already suggested above, if you have a Pro series router that has 3.0.0.6.x firmware support, you can try using the Guest Network Pro feature. May take some trial and error to get the Guest Network Pro/VLAN to work right for what you seek.

[Guest Network Pro] What is Guest Network Pro? | Official Support | ASUS USA

Yes, I am using asus-merlin firmware. I just loaded the yazfi on the router does indeed bring extra funtion as you alluded too, thank you.