• 0 Posts
  • 5 Comments
Joined 3 years ago
cake
Cake day: March 29th, 2024

help-circle
  • Your comment about #2 is not true. VLANs can be fully isolated from other subnets on the LAN - sure. But they can also NOT be isolated. I have one fully isolated VLAN, and the rest are not isolated.

    With a savvy user, you can also tehnically isolate VLANs form only specific other VLANs. I’ve never needed to do this, but know it’s possible.

    Edit: for reference, I looked up details and found a helpful link and example:

    5. Firewall zones for VLANs

    config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'     <-- This line allows intra-zone (inter-subnet) routing
        list network 'lan'
        list network 'your_new_vlan' <-- Adding your new VLAN here stops it from being isolated
    

  • I did #2 and it works perfectly. I have an IoT VLAN and my Brother printer/scanner is on it. I pivoted to the Ubiquiti/Unifi network infrastructure several years ago due to mostly seemless integration with the routers/switches/APs. But have used OpenWRT in the past (but didn’t set up VLANs then). Not sure the steps and if it requires manual firewall rules for the VLAN in OpenWRT.

    In case there identical/similar options to Unifi, however, I’ll just mention it’s pretty simple. Create the VLAN (new subnet vs the default network, e.g. 10.0.0.0/24 vs 10.1.0.0/24), deselect the “allow internet access” option, and make sure to select “network isolation” option (which blocks it from speaking to other VLANs/subnets). That’s it. (For conveniences, I also created another Wifi network call “XYZ_IOT” and then connected the printer to it. The network is fixed to that new IoT VLAN).

    Technically, those options are effectively convenient shortcuts for firewall rules that will get removed or created, accordingly, for that specific VLAN.

    Takes longer when you’re uncomfortable or struggling through it, but the complete setup time took maybe 15-20mins. If OpenWRT doesn’t have those convenience shortcuts, might take a bit longer to search for example firewall rule configs online and then make them.




  • Various websites suck in one browser or the other or simply don’t work in more than one single browser. We’re not that far away from the days when Internet Explorer (IE) was the only thing that loaded a site (often for something work-related… groan)

    That said, if you need Chrom(e/ium) and want a non-data-sucking version, I think Ungoogled Chromium is your best bet currently.

    For the Firefox side of things, there are already several forks that aim to do things differently/better. Floorp is one I see recommended regularly. There seem to be a larger number of Firefox forks focusing on security/privacy than Google forks, but this is the most well-regarded from my research.

    Simultaneous post-enshittification from both Chrome/Chromium and Firefox is probably (hopefully) leading towards more active development/contribution to these (and other) forks!