Comment by ur-whale
2 hours ago
Mmmh, I've always wondered ... as much as VLAN's are a very useful tools to - for example - route two separate LAN's traffic through a shared physical link ... are they any good when it come to security?
I mean, I don't believe VLAN's were designed with security as a goal, and I wonder how "strong" the virtual wall between two VLAN's actually is?
Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel?
Just wondering.
Network switches typically aren't known for their outstanding security record, but the vlan tags themselves are trivial and should be hard to mess up. Should someone hack your switch all bets are off, but as long as you don't have management accessible in-band you should be fine. Security problems are more likely to stem from bad configuration.
> Can't a device on VLAN1 not peek at VLAN2 traffic if it sits on physical connection where packets from both VLANs happen to travel?
That would be an exceptionally weird configuration. If a device "sits on VLAN1" that typically means that it's on an "untagged" port where only VLAN1 traffic is allowed. Ports that carry multiple VLANs are "tagged" ports and you normally wouldn't say they "sit" on any specific VLAN, precisely because that port carries tagged traffic for multiple VLANs. It's at best an irregular use of the terminology but likely a misunderstanding somewhere.
Depends on your networking setup. A good switch will simply refuse to route packets between clients on different VLANs, and hide the existence of the tags that determine which VLAN a host is on.
A bad switch or router (which almost certainly includes a ton of crappy home APs and routers, compromised by the same actors who ship these devices) could let clients see VLAN tags and ignore them.
And an Ethernet “hub” does no filtering at all.
Also: if you need a streaming box to see your AirPlay or UPnP devices for “casting” it necessarily has to be on the same VLAN as the devices it’s connecting to. Sonos speakers have this problem when subject to client isolation setups based on VLANs or switch-level packet filters.
And any kind of multicast (used for local service discovery and media streaming) has the same limitations.
this is a good question, i asked claude sonnet 5 and the answer is too big and complex for me to type out on mobile. but long story short, you absolutely need separate VLANs and Firewalls in conjuction to secure traffic between networks
Yeah, I've been using Claude to help me secure my home network. I applied to Anthropic's cyber program and got accepted despite being a hobbyist. I'm not very good at networks so I'm gonna try to make the most of it.
Really wish I could point Mythos at my router and just loop it until my router becomes literally unhackable.
Making your router unhackable is trivial. Just pull the AC cord. You didn't specify that it had to be useable.