Flint 3 devices on IoT network dont communicate with devices on main network

IoT
1

So as the title suggests, ive set up an IoT network on my Flint 3, this has devices like a couple of smart plug sockets, various light bulbs, 2 Google Home Hubs, Doorbell, Internal Camera’s, Kettle etc connected to it, everything else like my PC, phones, TV, Amp, laptops etc are all connected to my main network.

So the issue im having is when I ask my google home hub to turn on the TV, she cant do it as shes on the isolated IoT network, where the TV is on the main network, is there anyway around this ?

I get that I could connect the Home hub to the main network instead, but then she’ll stop controlling devices on the IoT network and vise versa.

So far the only waork around ive found for it is to just use the main 2.4ghz network for IoT devicess and completely dissable the IoT feature, but for obvious reasons this isnt as secure.

2

I don’t use IoT network on GL.iNET but is this not one of its most important features (isolation from main network)? If not wanting this, then why use it in the first place and why not just put everything on the same network?

1 Like
3

Smart devices are the easiest way into you network, so to put IoT devices on a seperate network, (especailly if you have a lot of IoT devices like I do), keeps tthem segrigated from you main network, ie if a hacker finds a way into your IoT devices, because they are effectivly on a seperate network its no threat to devices on your main network, like you PC or Smart Phones where you generally keep sensetive information.

Its just a shame there isnt some easy way to link certain devices on the IoT to devices on the main networks, like my Google Nest Max (IoT) to the TV (5ghz), or my Printer on the IoT network to my PC on the main network, I actually just sold my printer and brought a new Dual Band WiFi printer for this very reason, so I could have the printer on the 5ghz which my previous printer wasnt able to do.

4

You will need to enable mDNS repeating between the VLANS. Using Avahi is simplest as it’s pre-installed.

If you SSH into the router, and edit Avahi’s config /etc/avahi/avahi-daemon.conf:

  • Under [server], add allow-interfaces=br-lan,br-iot
  • Under [reflector], change enable-reflector=no to enable-reflector=yes

Then edit the firewall settings in /etc/config/firewall adding:

config forwarding
        option src 'lan'
        option dest 'iot'

config rule
        option name 'Allow-mDNS-IoT'
        option src 'iot'
        option dest_port '5353'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Allow-mDNS-LAN'
        option src 'lan'
        option dest_port '5353'
        option proto 'udp'
        option target 'ACCEPT'

Now make sure Avahi is enabled:

/etc/init.d/avahi-daemon start
/etc/init.d/avahi-daemon restart
/etc/init.d/avahi-daemon enable

And restart the firewall:

/etc/init.d/firewall restart
2 Likes
5

Generally speaking, network isolation is the whole point of using an IoT network. An IoT network that can communicate with main network offers no protection from compromised devices.

1 Like