Dual LANs on Same wire provide Security?

[master_tinkerer]

Setup for Question: Cameras and TiVos and pc and house control stuff on wired network, interspersed and cameras not isolatable. If Household and router LAN is RED and cameras are all set to Green subnet, and BI server with REd and Green nic port,
Questions? Can BI server connect to switch with tow ports ( different subnets) I have a big fancy switch Netgear GS752TP but have not made and custom settings.. Just use the channels.
Second question: Is the green VLAN isolated from the internet so cameras can not communicate out?
I asked same in the security forum
thanks

 

[SpacemanSpiff]

It is possible to use different IP schemes for the cameras (green) vs everything else (red) without the use of actual VLANS. It is not ideal, but it can be done. Your GS752 is a smart switch, and it is possible to configure a couple VLANS to achieve the more ideal network configuration. After a brief scan of the GS752 manual, the channels you refer to are for LAG ports, which are primarily for interconnecting switches.

Your current set-up will most likely suffer latency from network traffic congestion. Also, despite the green network not being set-up on the router, it will still consume processing cycles on the router while it determines it does not need to do anything with the green packets. All the more reason to truly isolate the camera (green) traffic using VLANS.

As for your second question: If you are not going to set-up the VLANs. Out of an abundance of caution for security, I would suggest adding rules to your router to ensure anything from the camera (green) network is denied access to the Internet.

 

[jmhmcse]

Need to clarify your usage of RED LAN, GREEN SUBNET, GREEN VLAN, and CHANNELS.

RED LAN is actually a VLAN which is designed to be a unique subnet.
GREEN SUBNET and GREEN VLAN are used interchangeably; actually a separate VLAN using a unique subnet.
CHANNELS ?

Create a RED VLAN and a GREEN VLAN then restrict the appropriate ports to each VLAN.

RED VLAN ports connected to router and HOUSEHOLD devices would be isolated from other VLANs. Devices on this VLAN would still be able to access internet and router services; .e.g DHCP, DNS, NTP, etc.

GREEN VLAN ports connected to cameras would be isolated from other VLANs, and would not have access to router, router’s services, or internet.

BI server, using two NICs would connect to RED VLAN and GREEN VLAN.

NTP service would need to be installed on BI server to provide time sync for to cameras.

NICs on GREEN VLAN should be statically defined IP addresses with no DNS address defined.

 

[master_tinkerer]

Thanks, I will study the VLAN . I wrote the following and decided to leave it in.

I clearly didn't/ don’t understand some things. I thought red / green was an easy way to distinguish between two subnets with no further difference.
With a few exceptions, I can’t isolate equipment by switch ports. I have TiVo and cameras on the same wire.

thanks , more research.

 

[master_tinkerer]

Summarizing for your comments:
Define web equipment on 192.168.0.x : router, switches, desk pc, (current state but may change to a less common default)
Cameras all have fixed ip address. Changed each camera to be on subnet , say 15 so ip is 192.168.15.x Remove dns ( currently 192.168.0.1)
Add switch wire to second BI port defined as 192.168.15.8
Have 6 other smaller switches, all Netgear, will these pass all subnet traffic?
Not sure I do anything to my GS752 network switch. Bought it because of the fiber feeds. My tower(100’) eagle nest cameras connect via fiber for lightning isolation.
Would recording time that BI sets continue without NTP to cameras? My system is 99% nature watch verses security.

Fred is back for his 8th year at the nest. Daisy, too, just not in this picture .

 

[jmhmcse]

Your GS752 has the ability to do VLANs. It is in this switch you will create the RED (vlan100) and GREEN (vlan200) VLANs And assign specific ports to those VLANs. Keeping with the previous convention, RED is the internet accessible and GREEN the isolated VLANs.

All ports should be removed from any/all existing VLAN. Live/active ports are only those which youhave activated and placed into the appropriate VLAN.

A device connected to an active VLAN100 port is able to communicate with all other VLAN100 devices. DEVICE is a single host or all hosts connected though a (smaller) switch to the GS752. Likewise for devices connected to VLAN200. VLAN100 and VLAN200 do not “see” one another nor able to communicate with each other.

A smaller switch can only have VLAN100 or VLAN200 devices connected to it. This may require reconfiguring how some devices are attached to your network.

To implement this, you will need to read the owners manual to learn/understand VLANs. If the cameras do not have access to a time source, their time will drift and in time become further and further out of sync to actual time.

A very simplified diagram of your network, showing possible connections between devices and switches and their devices.
VLAN100 (RED) would have ports 1, 2, 4, and 5
VLAN200 (GREEN) would have ports 3, 6, and 7
Switch 1 and 2 must have only HouseHold devices attached to them
Switch 3 must have only cameras attached to it.
The one exception is your BI server which is attached to Switch 1 (or Switch 2) and Switch 3




This is about as far as we can go in describing a VLAN configuration. The remaining steps of configuring and implementing is up to you to perform.

If you decide to venture forward, back up the current configuration of the switch prior to making any changes. Depending on the number of ports in use on the GS switch you may be able to create the ‘new’ environment along with maintaining the current environment. VLAN ports do not need to be consecutive, only defined into the appropriate VLAN.

 

[master_tinkerer]

jmhmcse :
Thank you soo much. I found the 752 VLAN tab and was testing the dual path from switch to BI server. and just down loaded the switch 500+ page user manual. Your details are a big start. I have households on switch 3 with cameras but I may be able to go WiFi for the households via mesh and have only cameras on remote switches.

Can you recommend a good thorough Network book?

Thanks again.

 

[jmhmcse]

Unfortunately most books will be specific to a particular vendor. How-to for one vendor will differ from another; concept is the same but commands will likely be different.

I don’t have any NETGEAR experience, my limited background is from Cisco.

A quick search for basic VLAN instructions I found the following links which might be helpful.

​

VLAN Basic Concepts Explained with Examples

This tutorial explains the basic concepts and fundamentals of VLANs. Learn what VLANs are and how they work in an Ethernet LAN network.

www.computernetworkingnotes.com

​

​

​

The first is an explanation, with pictures, of basic to more advanced capabilities. The next two are a part 1 and 2 of VLANs with the presenter using a Netgear switch creating a couple of VLANs. Part 2 does get into advanced features that you probably won’t need.

Your most valuable resource material will be the manual you’ve already downloaded. After reading the VLAN chapter(s) in the manual use your favorite search engine to find more examples and demonstrations of configuring Netgear switches.

 

[master_tinkerer]

jmhmcse :
Thanks, Iv'e turned off my 30 cameras and BI server as I think two cameras have been hacked. Before shutdown, BI can see the camera data( views) and uses the passwords and usernames from my records. Trying from a browser, I get rejected. With a pin reset , it askes for password and accepts it. First log in and the date comes up in red just below the login and reject from then on. Repeatable. power down makes no difference. Both are TZ5M from Nelly'sSecurity , 5MP Varifocal Turret Dome IP POE Security Camera W/ Motorized 2.7-13.5mm Lens | IP66 Weatherproof | 130' Night Vision | M5ZT with non Hikvision login. Not sure who made them. I will post to the forum after I talk with Nelly incase it is some weird normal reset.
BI is using ONVIF on port 554 and continues to "see" data.
I am deep in updating passwords. Long overdue. This all started with a call from the FBI about my ip address showing up..... and I HAD port forwarding functional and cameras showing activity in port Forwarding logging by the router.

I'll be back to this later and the outlook looks like split the cameras and wires on one VLAN and most house stuff on WIfi and second VLAN for the printers and local wires.

 

[wittaj]

jmhmcse :
Thanks, Iv'e turned off my 30 cameras and BI server as I think two cameras have been hacked. Before shutdown, BI can see the camera data( views) and uses the passwords and usernames from my records. Trying from a browser, I get rejected. With a pin reset , it askes for password and accepts it. First log in and the date comes up in red just below the login and reject from then on. Repeatable. power down makes no difference. Both are TZ5M from Nelly'sSecurity , 5MP Varifocal Turret Dome IP POE Security Camera W/ Motorized 2.7-13.5mm Lens | IP66 Weatherproof | 130' Night Vision | M5ZT with non Hikvision login. Not sure who made them. I will post to the forum after I talk with Nelly incase it is some weird normal reset.
BI is using ONVIF on port 554 and continues to "see" data.
I am deep in updating passwords. Long overdue. This all started with a call from the FBI about my ip address showing up..... and I HAD port forwarding functional and cameras showing activity in port Forwarding logging by the router.

I'll be back to this later and the outlook looks like split the cameras and wires on one VLAN and most house stuff on WIfi and second VLAN for the printers and local wires.

Whoa you had the FBI call you about what was happening on your system - who hacked you and what were they doing?

 

[master_tinkerer]

I believe my cameras were used in a data hop or bounce to hide the source. Not much more to say but my system was open thru port forwarding and cameras are on all the time. They are investigating a case.
My camera addresses were repeatedly establishing connection in my router Port Forward message log. I don't know what was going on, but it was over months and no symptoms to me, locally.
Stopped now, if there isn't software bombs left behind.

 

[jmhmcse]

If not already, disable UPnP on all cameras and router. Create firewall rules to block (in and out) on all of the IPs assigned to cameras.

 

[master_tinkerer]

Making Progress!. Some of my equipment supports VLAN Q802... protocol. and Several switches need to be replaced if I understand correctly.
I understand that VLAN lowers the wasted time in a switch by directing the data to the defined ports.
BUT, for a simple test, My main system is 192.168.0.x so I set a camera to 192.168.1.68 and a dual port computer to 192.168.1.200 ( arbitrary) and successfully logged into that camera. Another computer can't log into camera without extra nic set to ..1.x

So My question is:
Can I get isolation from the internet with a separate subnet (Different from the Router) for cameras and using a dual port on the BI server? And if so, does that mean the cameras can't phone home?

On VLANS, Netgear's smallest Trunk link switch is 24 ports ( I think required to encode the vlans id's with the source data to then be sent over the trunk line) so mixing Internet and cameras on different vlans connected with single cable requires GS324tp (smallest) at the sending end. I suspect the subnet and VLAN are on different layers of the packets.

 

[SpacemanSpiff]

So My question is:
Can I get isolation from the internet with a separate subnet (Different from the Router) for cameras and using a dual port on the BI server? And if so, does that mean the cameras can't phone home?

... If you are not going to set-up the VLANs. Out of an abundance of caution for security, I would suggest adding rules to your router to ensure anything from the camera network is denied access to the Internet.

 

[master_tinkerer]

I am going to setup the VLANS where i can with an existing gs724 (supports trunkline) One example: 5 cameras and a Kohler generator on remote switch with one line coming to VLAN switch. Kohler needs to see the internet to report its status. I can add a ~$400 router and get a trunk line and setup two PVIDs etc. I am looking for a way to isolate and keep functionality. Moving generator to wireless is possible but WiFi signal is bad there and yet improving signal is another possible option. I need 3 more Trunkline routers to keep existing functionality. So looking at next best options for the other locations.

Rules seem ok too, But understanding example below?
Rules Like using the deny list with camera ip(175) and router or access list with camera and BI server? Seems right but allow only one port ? 554? port range seems to only take one number??

Thanks for your patience!

 

[newfoundlandplucky]

I did some IP wire-shark snooping a while back and found that my cameras had unexpected behavior that included vendor specific IP signaling, address assignment, and spoofing the gateway IP address. No concerns with the vendor, was for ease of configuration including IP address assignment, but it represents an attack vector.

Can't think of how to implement protection without port isolation rules via VLAN tagging or port level access control. Anything else can be spoofed by the camera. Maintenance requires that I switch the camera port to a maintenance policy that loosens restrictions temporarily and then reverts back.

 

[jmhmcse]

I am going to setup the VLANS where i can with an existing gs724 (supports trunkline) One example: 5 cameras and a Kohler generator on remote switch with one line coming to VLAN switch. Kohler needs to see the internet to report its status. I can add a ~$400 router and get a trunk line and setup two PVIDs etc. I am looking for a way to isolate and keep functionality. Moving generator to wireless is possible but WiFi signal is bad there and yet improving signal is another possible option. I need 3 more Trunkline routers to keep existing functionality. So looking at next best options for the other locations.

Rules seem ok too, But understanding example below?
Rules Like using the deny list with camera ip(175) and router or access list with camera and BI server? Seems right but allow only one port ? 554? port range seems to only take one number??

Thanks for your patience!
View attachment 181757

A detailed networking diagram of all devices (router, switches, hosts, cameras, etc) is in order. If you don't have one, make one; you'll need it to create and maintain the VLAN network you're working towards implementing.

I'd highly recommend NOT to use Wi-Fi for anything other than a tablet or phone.

To minimize additional purchases, attempt to consolidate "like" devices onto single switches. If not possible, then it may require (re) stringing network cable or perhaps additional costs (switches) is inevitable. That does not mean that L2 (VLAN) switches are required. A port on the current GS752 can be assigned to a VLAN as UNTAGGED. A switch connected to that particular port will be servicing that VLAN to all devices connected to it. (this is where a picture is worth a thousand words, also helps in network re-design of current environment)

An ASUS router (as by the attachment) you can block outbound devices, up to 32 entries. First ensure you have enabled this feature



Using the Filter Table, one IP at a time enter

Source IP <camera IP>​

Port Range <leave blank>​

Destination IP <leave blank>​

Port Range <leave blank>​

Protocol <BOTH> ( i think this is an option )​

Click the + to ADD the entry​

​

Repeat for all camera IPs. Leaving the field blank is a "wildcard" blocking this IP from exiting the local LAN; i.e. no internet access. Access to the device (camera or other) is still available on the local Network.

Another method and actually simpler, when the IP is already in use on the LAN, is to block internet access with a single click.

From the login page; NETWORK MAP

​

Click on VIEW LIST and the following screen will appear



The Globe Icon is a toggle on/off for internet access. Click once will disable internet access for that device. Click again and it will allow internet access.

---

Side-note/Off-topic​

​

If you haven't already looked into ASUS-Merlin, it's worth a few minutes to do so. It is a replacement firmware for most ASUS routers and if you have a supported router I'd recommend downloading and installing it. It has the same look-feel as stock firmware with MANY additional features and functions. There are many articles on the author who has ties to ASUS as they share improvements/upgrades between the Vendor firmware version and ASUS-Merlin.​

​

Asuswrt-Merlin

Use this forum for posts about all versions of this alternative firmware for ASUS wireless routers

www.snbforums.com

 

[jmhmcse]

I did some IP wire-shark snooping a while back and found that my cameras had unexpected behavior that included vendor specific IP signaling, address assignment, and spoofing the gateway IP address. No concerns with the vendor, was for ease of configuration including IP address assignment, but it represents an attack vector.

Can't think of how to implement protection without port isolation rules via VLAN tagging or port level access control. Anything else can be spoofed by the camera. Maintenance requires that I switch the camera port to a maintenance policy that loosens restrictions temporarily and then reverts back.

The end goal for master_tinkerer is to get all of the cameras onto a separate VLAN with a separate isolated Network; stopping any remote BOT/Malware infection/access as well as any Phone-Home attempts by the camera's OS.

In the mean time establishing firewall rules to block internet, disabling UPnP, not filling in DNS addresses, and if possible not filling in Gateway addresses will be a good start in the right direction.

 

[master_tinkerer]

jmhmcse
Asuswrt-Merlin doesn't support my RT=AX92U router. I was going to try it on my older RT-n56U but they don't support that either. Great feature to have that globe switch. Must have been a future for the factory, cause mine has no function.

 

[master_tinkerer]

Here is my attempt at documenting my overall setup. Three buildings and house expansion was mostly connected with coax. I am planning to VLAN at least two locations. VLANs require data tables perhaps best done in excel.