{
  "id": 18938485,
  "title": "I put every smart device on its own VLAN, and found out which ones were phoning home constantly",
  "url": "https://urgent.news/2026/11/08/i-put-every-smart-device-on-its-own-vlan-and-found-out-which-ones",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-08T13:01:20.000Z",
  "source": {
    "name": "XDA Developers",
    "slug": "xda-developers",
    "url": "https://www.xda-developers.com/put-every-smart-device-own-vlan-found-which-were-phoning-home-constantly/"
  },
  "original_language": "en",
  "account": "In today's world, many smart devices like wireless plugs, IP cameras, and robotic vacuums rely on continuous internet access for vendor cloud connectivity. However, these devices can generate unsolicited telemetry, DNS lookups, and unencrypted data streams. When all devices share the same network, vulnerabilities arise. Network segmentation, implemented with VLANs and strict firewall rules, can isolate untrusted hardware and monitor outbound traffic. DNS query logging and sinkhole integration can help identify persistent phoning-home behavior. Some devices hardcode DNS servers or use DNS over HTTPS, potentially missing local cache solutions like Pi-hole or AdGuard Home. Devices may ignore DHCP-advertised NTP servers and contact external time servers, which is usually essential but worth noting. Devices stream device state, uptime metrics, and local environment diagnostics, creating multiple connection attempts. Network segmentation relies on managed switches and routers configured with 802.1Q VLAN trunking to separate physical switch ports and SSIDs into distinct subnets. Within each VLAN, dedicated DHCP scopes ensure that broadcast traffic doesn't leak across boundaries. Firewall rules between VLANs should be explicitly denied, blocking IoT subnet traffic from initiating TCP or UDP sessions with trusted networks. Enforcing inter-VLAN firewall rules blocks unauthorized WAN access that could prevent firmware checks. By revoking internet access for specific IoT devices while retaining local subnet communication, you can protect your network from unauthorized port-scanning attempts, external firmware-check queries, and unrequested telemetry payloads.",
  "summary": "A flat network has vulnerabilities.",
  "key_points": [
    "Separate smart devices into individual VLANs to isolate untrusted hardware",
    "Monitor outbound traffic with DNS query logging and sinkhole integration",
    "Implement inter-VLAN firewall rules to block unauthorized WAN access"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}