Re: Placing our Squeezeboxes in a separate IoT network?

Thanks! 
This is exactly what I was looking for :-)

Looks like you opened a lot of ports for LMS (?). Does it really need
that many ports? :eek:

Do you disallow IoT network from accessing the internet?
I noticed that my IoT devices do not work if I do not give their VLAN
internet access.

Since I setup these VLANs just last week, I have not done enough
research to secure down tight, yet.

gordonb3 wrote: 
> I have a separate VLAN for running the squeezebox devices but I run LMS
> on the same embedded device that serves as my NAS, home automation and
> Wifi access point. Originally I had LMS configured to only listen on the
> squeezebox VLAN, however since Covid started I now also allow the
> squeezeplay protocol on my main LAN because my partner wanted to run the
> squeezeplay app on her laptop. The separate squeezebox VLAN is in fact
> an unencrypted wifi and wire bridged network, however it is not open
> because MAC restrictions are set. I chose to do it this way to save CPU
> cycles on encrypting and decrypting the traffic which contains no vital
> data anyway but is substantial even when no device is playing. Obviously
> since MAC addresses can be spoofed I have the firewall configured in
> such a way that it is rather pointless to try hack into this network
> segment.
> 
> VLAN ruleset:
> > 
Code:
--------------------
  >   > -A SQUEEZEBOX_fwd -p tcp -m multiport --dports 80,3483,9000,9090 -j ACCEPT
  > -A SQUEEZEBOX_fwd -p udp -m multiport --dports 3483,17784 -j ACCEPT
  > -A SQUEEZEBOX_fwd -j REJECT --reject-with icmp-port-unreachable
  > -A SQUEEZEBOX_in -p tcp -m multiport --dports 3483,9000,9090,514 -j ACCEPT
  > -A SQUEEZEBOX_in -p udp -m multiport --dports 67,68,53,3483,17784,514 -j ACCEPT
  > -A SQUEEZEBOX_in -d 224.0.0.0/24 -j ACCEPT
  > -A SQUEEZEBOX_in -j REJECT --reject-with icmp-port-unreachable
  > 
--------------------
> > 
> note: the forward rules are required for listening to internet radio
> and include port 80 (http) for fetching album art.
> 
> 
> Like Kev I have several more VLANs, most particular for a TV settopbox
> that is controlled by my provider and this segment thus has even more
> strict firewall rules to prevent interaction with any other VLAN.


------------------------------------------------------------------------
rajdude's Profile: http://forums.slimdevices.com/member.php?userid=71085
View this thread: http://forums.slimdevices.com/showthread.php?t=116703