Feature: Specific Exception Suggestions w/ VLAN Isolation Issues

[Smithprops]

So in the security audit, it says that the IoT network isnt isolated which it isn't but it would be nice to have it recommend me a way to still have it isolated but still be able to access the devices from another vlan like a roku smart tv on the IoT vlan and be able to access it from another vlan so that I can use the roku app.

[tvancott42]

Totally. Typically, you would isolate the IoT VLAN but not your main/home VLAN where the client devices live, and then enable mDNS proxying (check mDNS on each Network, and then confirm the Gateway mDNS Proxy settings under Networks), or the new Multicast Filtering feature under the Wi-Fi networks in Network 10.x.x, but I prefer the former.

[Smithprops]

hmm, ok, I will try this, thanks for the feedback on this.

[Huelsi]

Maybe I should go to the UniFi Forum, but maybe you can help as well. As soon as I activate isolation my Home Assistant does no longer connect to the devices in IoT even with firewall rules and mDNS proxy configured. “Isolation” only works when I set firewall rules to block anything for the IoT network. But it’s not considered isolated within the network optimizer.

[tvancott42]

Maybe I should go to the UniFi Forum, but maybe you can help as well. As soon as I activate isolation my Home Assistant does no longer connect to the devices in IoT even with firewall rules and mDNS proxy configured. “Isolation” only works when I set firewall rules to block anything for the IoT network. But it’s not considered isolated within the network optimizer.

If you're isolating the IoT network, inbound traffic to the IoT VLAN is still permitted. It's your choice whether to lock that down or not. If you're isolating the network your HASS server is on, then that's why it's getting blocked. You'll need to double-check the ordering of your firewall rules, but even with both networks fully isolated, the correct firewall rules will allow the necessary traffic through.

It's most likely an mDNS issue, assuming a simple ping check works from HASS box to the IoT device(s). Try using an mDNS explorer utility from the same VLAN as your HASS to make sure traffic is propagating.

[Huelsi]

If you're isolating the IoT network, inbound traffic to the IoT VLAN is still permitted. It's your choice whether to lock that down or not. If you're isolating the network your HASS server is on, then that's why it's getting blocked. You'll need to double-check the ordering of your firewall rules, but even with both networks fully isolated, the correct firewall rules will allow the necessary traffic through.

It's most likely an mDNS issue, assuming a simple ping check works from HASS box to the IoT device(s). Try using an mDNS explorer utility from the same VLAN as your HASS to make sure traffic is propagating.

Did some testing yesterday. IoT is set to isolated and Hue Bridge is witin IoT VLAN. HASS server and my phone are in another VLAN. I created a rule that allows traffic from these two devices to the bridge (TCP 80, 443) but no matter where it is placed, communication is not working. mDNS is in fact working with the settings you provided but it seems that Hue Bridge needs port 80 to communicate. To me it looks like that as soon as I activate Iosolated Network no communication is possible. Or am I just missing a simple return rule (established and related) from IoT network to the Device VLAN, which might also trigger a critical warning in the optimizer.

[tvancott42]

If you're isolating the IoT network, inbound traffic to the IoT VLAN is still permitted. It's your choice whether to lock that down or not. If you're isolating the network your HASS server is on, then that's why it's getting blocked. You'll need to double-check the ordering of your firewall rules, but even with both networks fully isolated, the correct firewall rules will allow the necessary traffic through.
It's most likely an mDNS issue, assuming a simple ping check works from HASS box to the IoT device(s). Try using an mDNS explorer utility from the same VLAN as your HASS to make sure traffic is propagating.

Did some testing yesterday. IoT is set to isolated and Hue Bridge is witin IoT VLAN. HASS server and my phone are in another VLAN. I created a rule that allows traffic from these two devices to the bridge (TCP 80, 443) but no matter where it is placed, communication is not working. mDNS is in fact working with the settings you provided but it seems that Hue Bridge needs port 80 to communicate. To me it looks like that as soon as I activate Iosolated Network no communication is possible. Or am I just missing a simple return rule (established and related) from IoT network to the Device VLAN, which might also trigger a critical warning in the optimizer.

I've run into similar struggles with the Hue Bridge... actually just recently. I believe it does some websocket-esque connection that isn't getting handled by allowing return traffic so it may be one of those that just has to stay on the same VLAN as the HASS box.

If you open up everything on TCP and UDP for the Bridge -> HASS just temporarily via a test FW rule, does it work?

Then you can probably identify what it's doing via Flows. Or you may actually see the blockage in Flows right now.

BTW, thank you for the sponsorship!