Re: Placing our Squeezeboxes in a separate IoT network?

I have a separate VLAN for running the squeezebox devices but I run LMS
on the same embedded device that serves as my NAS, home automation and
Wifi access point. Originally I had LMS configured to only listen on the
squeezebox VLAN, however since Covid started I now also allow the
squeezeplay protocol on my main LAN because my partner wanted to run the
squeezeplay app on her laptop. The separate squeezebox VLAN is in fact
an unencrypted wifi and wire bridged network, however it is not open
because MAC restrictions are set. I chose to do it this way to save CPU
cycles on encrypting and decrypting the traffic which contains no vital
data anyway but is substantial even when no device is playing. Obviously
since MAC addresses can be spoofed I have the firewall configured in
such a way that it is rather pointless to try hack into this network
segment.

VLAN ruleset:

Code:
--------------------
    -A SQUEEZEBOX_fwd -p tcp -m multiport --dports 80,3483,9000,9090 -j ACCEPT
  -A SQUEEZEBOX_fwd -p udp -m multiport --dports 3483,17784 -j ACCEPT
  -A SQUEEZEBOX_fwd -j REJECT --reject-with icmp-port-unreachable
  -A SQUEEZEBOX_in -p tcp -m multiport --dports 3483,9000,9090,514 -j ACCEPT
  -A SQUEEZEBOX_in -p udp -m multiport --dports 67,68,53,3483,17784,514 -j ACCEPT
  -A SQUEEZEBOX_in -d 224.0.0.0/24 -j ACCEPT
  -A SQUEEZEBOX_in -j REJECT --reject-with icmp-port-unreachable
  
--------------------

note: the forward rules are required for listening to internet radio and
include port 80 (http) for fetching album art.


Like Kev I have several more VLANs, most particular for a TV settopbox
that is controlled by my provider and this segment thus has even more
strict firewall rules to prevent interaction with any other VLAN.


------------------------------------------------------------------------
gordonb3's Profile: http://forums.slimdevices.com/member.php?userid=71050
View this thread: http://forums.slimdevices.com/showthread.php?t=116703