Network isolation for IoT devices

Installing and Using OpenWrt Network and Wireless Configuration
1

I’ve had a “basic” OpenWrt setup for a long time. It’s a ZyXel WSM20 working as a vanilla router, attached to a 16 port dumb switch. This switch connects to faceplates throughout the house, one of which is attached to another ZyXel WSM20 running as a dumb AP. I have a mixture of wired and wireless devices connected.

Up until now I have just been letting all my devices mix in a single network, but the number of devices is getting quite large and there are an increasing number of them that I don’t control the software for and I’m starting to worry about security.

What is the correct approach here? I’m fairly sure I should have a separate SSID for the wireless IoT devices, but do I set it up as a guest wireless network? Do I need a VLAN? How should it work with wired IoT devices (such as my TV and music players) that are connected via the dumb switch.

I don’t really want to move to a managed switch, so I’m hoping that I can achieve something reasonable without investing more (other than time).

2

Yes.

For that you'd need VLANs or make them use the guest wifi, or put a router as wifi client in front of them, if they don't have wifi support.

And yes, you need a smart switch for wired VLANs.

3

Thank you for confirming. Would there be any value in setting up a different subnet and allocating the wired IoT devices to it? I could then try to use the firewall to prevent access in the wrong direction. I’m not a networking expert so I completely understand that this might be a stupid idea and/or offer no real benefit.

4

Yes, but that would require a managed switch (at least once your untrusted wired clients exceed the ports on your router).

5

You could do that with wired ports on the dumb AP. Look at this guide https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap but adding some wired ports to the guest bridge.

As others have said, its not possible on the wired ports connected to the switch without moving to VLANs and a managed switch

BTW I dont know where you're located but if its UK, then a 16 port managed switch needn't be too expensive at £49 https://www.amazon.co.uk/Cudy-GS1016E-Managed-Shielded-Rack-Mountable-Black/dp/B0DQV5WCQB
I've not used one but I've been very pleased with my Cudy router