Hacker News Reader

Comment by randerson | Hacker News Reader

It's not enough to simply have a IoT VLAN that you put all your IoT devices on. Because those devices can see one another. In this case, if the coffee machine can see what type of smart fridge and smart toaster you're using, they can sell that data.

I default to adding IoT devices to a 2.4g "Guest" network where they can't see each other. Exceptions are IoT devices that need to see their friends to do what I bought them for, or devices I want to integrate with HomeAssistant. In those cases I create a separate IoT device per IoT brand. Excessive but necessary.

View on HN

In those cases I create a separate IoT device per IoT brand.

That requires a lot of SSIDs though and AFAIK it reduces airtime for each SSID on the same router (which may be bad if you also use 2.4GHz for your regular devices).

So far two separate VLAN + SSID (IoT-Good and IoT-Bad) with client isolation on IoT-Bad has worked pretty well for me. In some cases mDNS advertisements have to travel at least from the IoT VLAN to the VLAN HA is on for the devices to be discovered.

SSIDs are indeed expensive in airtime.

There's ways to reduce the expense like changing DTIM interval (for less-frequent broadcasts) and increasing base data rate. Few folks in 2026 have anything at home that requires the 1Mbps base rate of 1999's 802.11b anyway, and slower DTIM can have other advantages, so these tend to work well at increasing available airtime for more SSIDs.

There's an additional trick that can also be used, though: Wifi client isolation. This lets the IoT widgets share an SSID and VLAN with which to talk to the HA machine and/or their cloud-based mothership(s) or whatever, but without being able to see eachother on the SSID.

It still needs set up right lest stuff walk right by it, but it's an available feature.

A smart coffee machine may need to talk to some kind of controlling endpoint (whether local or afar) in order to do whatever it does. It does not need to be able to enjoin in a conversation with my light bulb in order to get there. But that doesn't mean that they can't share an SSID. :)

Indeed, this is what I do on our home network. I have two IoT SSIDs. One with devices I generally trust, where mDNS proxying is enabled and another that is excluded. I've found that the worst devices are generally not locally controllable anyway and always want to go through the cloud, even when you control them through HA or your phone.

I think that's a sensibly-measured approach. :)

I hope to be able to find the time and motivation to re-do the wifi stuff at home this weekend. I'll try to adopt the good-and-bad model of having two IoT SSIDs.

Reply on news.ycombinator.com