Setting up VPN/VLAN and Dual NIC

Joined
Oct 31, 2022
Messages
82
Reaction score
41
Location
Lower Alabama
I have installed an additional gigabit NIC, but I have not set it up yet. It's working with the defaults at present.

I am trying to wrap my head around the proper way to run the cameras thru the network. Below is my current network diagram.

There are TWO cameras coming in thru the fiber that is run to the service pole at the gate. Will be adding a third PTZ camera soon. I plan on replacing the TP-Link SS108GP switch at the service pole with a managed switch simply to have control over the switch.

There will be several more cameras with Ethernet cables already running from their location to the office/room where the Blue Iris computer is located. I have dual NIC in this computer and two Ethernet cables ran from the utility room.


Looking for advice on how to set it up and run it all. Do I need to run any new wires, add any other switches or is it all done with software?

1720727775723.png
 

The Automation Guy

Known around here
Joined
Feb 7, 2019
Messages
1,440
Reaction score
2,871
Location
USA
If you expect to segregate the data coming over the fiber link into two VLANs - one for camera use and another for the devices connected on the WiFI AP, then you'll definitely need a switch that supports VLANs (usually some sort of managed switch) at the driveway gate (I didn't research to know if the current switch has that capability or not). Once the switch tags the different traffic with the applicable VLAN number, traffic it will be segregated, but sent over the same fiber bridge to the main house.

That being said, since these cameras are going to have to use VLANs and not be on a completely separate network, there is really no reason to add the second network card in the BI machine. People typically add a second card when they can put all of their cameras on a separate network (physically) and one port goes to that camera network and the other port goes to the regular home network. You'll effectively accomplish the same thing over VLANs, but the requirement to have two network cards in the BI doesn't exist when you use VLANs. Therefore I would remove the nic/direct connection to the router and just hook the BI machine up to the switch.

So, you'll need to create a VLAN for camera use only, and at least one more VLAN for all the other traffic on your network. You'll need to set the VLANs up in your router/firewall device as well as the individual switches. (This assumes your firewall/router is going to handle all of the routing tasks on the network. If you are going to set up the switches to act as a true layer 3 devices, you set everything up in the switches and you won't even have a separate router/firewall. This is NOT what most people do unless they are trained IT professionals and deal with layer 3 switches regularly).

I would also connect the switches directly to each other and not solely through the router. Any traffic between VLANs is going to have to pass through the router, but all traffic passing on the same VLAN could be handled at the switch level. But if you have only connected the switches to the router and not to each other, you are forcing all of the traffic to go through the router which could potentially create a bottleneck. I don't think these TP-lInk switches can "stack" but higher end enterprise switches can generally be linked together via "stacking". This creates just a single user interface vs three different ones (so example if all of your switches had 24 ports, you would have a single 72 port switch with regard to the GUI/management interface. These stacking ports area also generally rated for higher data transfers. 10gb or higher stacking ports are very common and the ports are SFP+ a lot of times which means you wouldn't even need a fiber converter because you could use SFP+ fiber connectors to directly link the switches together - including the gate and hose. Now as I type this, I realize you probably need a fairly small switch at the gate location, but there are a lot of smaller 4, 6,and 8 port managed switches that have one or two 10gb SFP+ ports on them to link to other devices/switches. Now even if you can't stack your switches together (which is completely just for management purposes), you might consider switches with a couple 10gb SFP+ ports so that you can connect the switches together to help prevent any bottlenecks. Even better would be if your router supported a faster LAN port (2.5gb or 10gb, etc) so that you could use a fast connection between the router and the switches.

Hopefully that's not too much information thrown at you. You can skip all of the SFP+ information if you want, I just thought it might be something to consider because you wouldn't need the fiber converters if your switches already supported a fiber connection via a SFP+ port.
 
Joined
Oct 31, 2022
Messages
82
Reaction score
41
Location
Lower Alabama
To clarify, if it makes a difference, the switch at the gate that is running back thru fiber is separate from my ISP (Internet) fiber. That fiber only carries the two cameras. I do have an AP out there, but it does not need Internet... it's will be used (if even needed) to communicate with the gate camera in the gate keypad. He said we may use a mobile app or Bluetooth, but it won't need Internet. So... I could come in with that fiber to a separate switch that goes directly to my camera switch in the office, and it would never see the router.

The TP-Link Jetstream switches have 10 ports... 8 x PoE+ and 2 x SFP+. It will fit in the weather-proof box where the current switch is now, and it is fully managed. Right now, I'm managing all the switches thru the Omada OC300 Controller, but it sounds like I shouldn't use it once I get all the cameras on the same switch and instead use the switches for management?
 
Joined
Oct 31, 2022
Messages
82
Reaction score
41
Location
Lower Alabama
Should I create my VLAN or VPN first... or does it matter?

Also, should I release any device that has its IP reserved/fixed in the Omada Controller before creating a VLAN or VPN?
 

tech_junkie

Getting comfortable
Joined
Sep 2, 2022
Messages
468
Reaction score
460
Location
South Dakota
That is what I was thinking, however, I need Internet on the computer, so I'd need to connect one of the NICs to the WAN/LAN port on the ER605 router... like this.

View attachment 198295
shouldn't have to.
Wan/Lan ports on those routers is a configurable port where its either a LAN port behind the firewall or a WAN port that is an outside connection with its own firewall as a redundant WAN connection .
 

MTL4

Getting the hang of it
Joined
Mar 8, 2019
Messages
116
Reaction score
89
Location
Canada
Like tech_junkie said, you really don’t even need any VLANs as long as you can isolate all your cameras behind the Blue Iris machine. Then you configure the main Ethernet port on the PC to be connected to your main network switch (the side that is connected to the internet) and the additional NIC you added gets connected to the any switches with cameras. I thought the fiber needed to pass both networks through for your EAP225 access point (in that case you would need VlANs) but if it’s only using POE power and not data that simplifies things alot.
 
Last edited:

MTL4

Getting the hang of it
Joined
Mar 8, 2019
Messages
116
Reaction score
89
Location
Canada
That is what I was thinking, however, I need Internet on the computer, so I'd need to connect one of the NICs to the WAN/LAN port on the ER605 router... like this.

View attachment 198295
You could either do that or what I would do is just plug the PC right into your managed switch (TL-SG2016P) which is also carrying your main network (connected to the internet). That way if you do want to add VLANs for say VOIP or Guest networks on wireless access points then it’s all ready to go.

This is how I would do it with what you have so far.

1720727775723.png
 
Last edited:
Joined
Oct 31, 2022
Messages
82
Reaction score
41
Location
Lower Alabama
Sounds like a good diagram plan... thanks!

Still curious how everything is going to obtain IP addresses, and if I need to release IP addresses for switches and item on the Omada Controller that have reserved/fixed IP addresses.
 

MTL4

Getting the hang of it
Joined
Mar 8, 2019
Messages
116
Reaction score
89
Location
Canada
Sounds like a good diagram plan... thanks!

Still curious how everything is going to obtain IP addresses, and if I need to release IP addresses for switches and item on the Omada Controller that have reserved/fixed IP addresses.
The camera IPs are usually static on the network and then the gateway is the NIC card on your BI PC. The Omada controller would only see what's on your main network that has internet access. Once you start setting everything up and doing the configuation it will all make sense.
 
Joined
Oct 31, 2022
Messages
82
Reaction score
41
Location
Lower Alabama
Yes... but the Omada Controller has the camera IP addresses reserved/fixed to 192.168.0.xxx ... shouldn't they be released, and probably have the AP and switches used for the camera system "unadopted" from the Omada Controller.
 

MTL4

Getting the hang of it
Joined
Mar 8, 2019
Messages
116
Reaction score
89
Location
Canada
Yes... but the Omada Controller has the camera IP addresses reserved/fixed to 192.168.0.xxx ... shouldn't they be released, and probably have the AP and switches used for the camera system "unadopted" from the Omada Controller.
Yes, no need to have them in there since the Omada controller won't be able to see anything on the camera network at all.
Any managed switches on the camera network can be managed via the BI PC since it has access to both networks at once.
 
Top