IoT VLAN on OPNsense: three firewall rules that don't break casting or Home Assistant
Moving smart plugs, bulbs, TVs and cameras onto their own VLAN is the single biggest security win on a home network, and it is also the change most people roll back a week later because the cast button went grey and Home Assistant lost half its devices. The usual "fix" is an allow-any rule from IoT back into the house, which quietly undoes the whole point. This is the setup I use on OPNsense at…
Separating IoT devices onto their own VLAN offers the most significant security enhancement for a home network, though many people revert to their previous configuration shortly after implementing it due to difficulties with casting and Home Assistant connectivity. The common solution to this issue involves allowing unrestricted traffic from the IoT VLAN back into the home network, which ultimately negates the purpose of the VLAN segmentation.
The setup employed in this scenario on OPNsense involves a three-rule firewall policy within the IoT zone, coupled with selective exceptions to maintain the functionality of discovery, casting, and Home Assistant. It is crucial to note that the specified IP addresses are illustrative and should be replaced with the actual addresses relevant to your network.
The foundational network layout consists of a single firewall rule governing the connection between the home and the internet. The concept of zones facilitates network segmentation by categorizing devices based on trust levels, thereby regulating the flow of incoming connections. Each zone is assigned a unique subnet, allowing for easy identification of device types through the third octet of the IP address.
The three octets of the IP address correspond to the VLAN ID, ensuring that a log entry containing an address such as 192.168.30.57 immediately identifies the device as part of the IoT VLAN. The guiding principle for firewall rules is that devices within a zone are permitted to initiate connections to lower-numbered zones but never to higher-numbered zones.
Responses from these connections are automatically permitted due to the stateful nature of the OPNsense firewall. This principle ensures that Home Assistant can effectively control IoT devices while preventing the reverse flow. To optimize firewall rule implementation, it is essential to recognize that rules are evaluated based on the interface they encounter traffic on rather than the destination zone.
The first matching rule dictates the outcome, with any unmatched traffic being blocked by the built-in default deny policy. Utilizing aliases to simplify the rule set is highly recommended. Aliases streamline the process by allowing you to define groups of devices or networks under a single name, making the rules more readable and easier to manage.
The creation of the IoT rule set entails establishing three primary rules: permitting necessary services from the firewall, specifying exceptions for particular devices, and blocking connections to private networks. The first rule permits DNS and time services from the firewall to the IoT network, crucial for maintaining accurate time synchronization and name resolution.
The second rule is paramount, blocking IoT devices from establishing connections to other networks within the home, with the exception of Home Assistant and logging all blocked attempts for monitoring purposes. Lastly, the third rule allows IoT devices to communicate with the internet, specifically for DHCP requests, which are automatically permitted by the OPNsense firewall on interfaces where DHCP service is active.
Additionally, a rule on the SERVERS tab allows Home Assistant to initiate connections to IoT devices, ensuring bidirectional communication. The inclusion of descriptive comments within each rule enhances maintainability by clarifying the purpose behind each rule, which proves invaluable for troubleshooting and future modifications.
A common issue encountered post-VLAN implementation is the greyed-out cast button, indicating that IoT devices are unable to discover each other. This problem stems from the fact that routers do not forward multicast traffic between different subnets, preventing devices on separate networks from detecting one another. The solution involves deploying an mDNS repeater, which relays multicast discovery packets between the TRUSTED and IoT interfaces, facilitating device discovery without introducing additional firewall rules.
This effectively restores the functionality of the cast button, demonstrating that the issue was not due to misconfigured firewall rules but rather a limitation inherent to network multicast traffic.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
