[SOLVED] General VLAN question

[dieter]

Hello,

Connected to my ASUS RT-AC1900P, are several hardwired (including a Media Server) and wireless computers, a ROKU, and 2- Chromecasts devices, and wireless "guests" computers/cell phones.

My question: Is a VLAN feasible considering a mediaserver on the LAN will stream to the ChromeCast devices? In addition, "guests" will want access the internet AND stream to the ChromeCasts. Or should the Chromecasts remain on the main LAN subnet?

In the future there will be some IoT devices, which I understand should be on a different subnet.

How complicated will it be for me (as you can tell, a VLAN novice) to set this up?

Is there detailed HELP available on how to set up a VLAN?

Thanks.

 

[dieter]

Found the SNB help on VLANs. Should be very helpful.

Vlan setup seems very complicated. Not for me...

 

[degrub]

Found the SNB help on VLANs. Should be very helpful.

Vlan setup seems very complicated. Not for me...

VLANS are straightforward. Just think of them as shelves. Each VLAN is a shelf, each box on a shelf is a dhcp range assigned to the vlan, and items in the box are devices assigned to the ip range and thus the vlan. Each shelf has a number (VLAN ID). you assign, in the router, the vlan to a DHCP range.

So if you have devices - a NAS or a PC that you do not want guests (or anyone else) to have access to, put it in a vlan. Put anyone else under a Guest VLAN and allow access to the specific devices you mentioned by placing them in that vlan's ip range. Put IOTs on their own vlan separate from all. You may want to physically separate them as well using a second router or managed switch to segregate traffic and loading ( keeping that load off of the streaming side for example).

 

[dieter]

Thanks for your comments. I get the general concepts, and am reading more on the subject: VLAN How to: Segmenting a small LAN.

What I'm confused about is: how does a VLAN prevent IoT device to get hacked and prevent DDNS attacks, for example?

Will having my servers on a separate subnet prevent hacking from the internet, or just make it harder?

 

[sfx2000]

What I'm confused about is: how does a VLAN prevent IoT device to get hacked and prevent DDNS attacks, for example?

Will having my servers on a separate subnet prevent hacking from the internet, or just make it harder?

The main thing - watch the WAN side - no matter what's hanging out on the LAN - keep ports close, expose only trusted services, and even there - sandbox that.

VLAN's just complicate things there - just saying...

 

[dieter]

I'm beginning to realize the RT-AC1900P does NOT have VLAN capabilities with the Asus firmware. Does the AsusWRT-Merlin firmware support VLANs on the 4 router ports? Or do I have to purchase a managed switch?