Privacy

39611 readers

218 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

Keeping "smart" devices on guest network (lemmy.world)

submitted 1 month ago by applemao@lemmy.world to c/privacy@lemmy.ml

8 comments fedilink hide all child comments

I realized I was at risk by having smart devices on my normal network, so decided to move them to my guest network.

I don't like my smart tv, but it's all I have to work with for now. I want to keep it on my guest network, but still stream using jellyfin. I see on my netgear router there is an option to "let devices on guest network see other devices and access local network" which would probably allow it to see my jellyfin server, but then doesn't that defeat the point of a guest network? Maybe I need to learn what a reverse proxy is...jellyfin server is currently on windows (not my pc) but could move it to my linux pc if needed.

And yes, I plan to get a media center linux box in the future so I don't have to deal with the garbage smart tv os!

you are viewing a single comment's thread
view the rest of the comments

[–] FeelzGoodMan420@eviltoast.org 0 points 1 month ago* (last edited 1 month ago) (1 children)

A better solution is to use a pihole to block all domains that the TV pings, and only let through ones that allow you to use streaming apps (i.e. netflix API domain.)

Another good solution is to block WAN access for specific devices and only allow them to communicate over LAN. This would be done on your Router. This method would allow local streaming using Jellyfin but wouldn't allow streaming apps like Netflix since that requires communication with the outside Internet.

[–] marsara9@lemmy.world 4 points 1 month ago

If you're worried about your IoT devices on your LAN the problem isn't necessarily that they can access WAN but rather that there's a security vulnerability and that they can be accessed by the WAN. Once a device is compromised and attacker can then use it as a "beachhead" to access other devices on your network.

So for example, with my setup every IoT device is on a separate VLAN (the guest network acts similarly) which can't get access to WAN, can't be accessed from the WAN and can't initiate any network calls to any other VLAN. Now my primary VLAN can talk to my IoT VLAN, and IoT can talk back, it just can't start the communication.

This does pose a problem for TVs though that need to talk to Jellyfin as hinted at in the original post. So what you could do is create a specific firewall rule that allows the TVs to at least initiate communication to Jellyfin but not any other device on your primary VLAN. This will probably require a more sophisticated router though than most of the consumer ones out there. Just be mindful that if n IoT device is compromised they can then try to attack the jellyfin server to jump to your other VLAN and then the rest of your network.