0

For a school project I'm trying to figure out how to create a safe network for IoT devices using a rpi.

To achieve that I want to use basic things that are available on raspbian like iptables and avahi. I did look into things like firewall on a bridge within the same subnet, but that didn't work out. I do think I have something possible over here but I just can't figure it out...

Here is a scheme from my current setup: https://prnt.sc/26i3vnt

Right now I have set up a raspberry-pi 3 with a bridge from wlan0 (which is connected to my home network 192.168.1.0/24) to eth0 which has it's own IoT subnet (10.1.1.0/24). Then I did connect an access point to be able to connect a chromecast to the IoT subnet.

To create that bridge I used the script from option 2: https://willhaley.com/blog/raspberry-pi-wifi-ethernet-bridge/

Now I'm able to connect devices to the IoT subnet, on which I receive DHCP and am able to surf the interwebs from.

What I did next is avahi, an mDNS service to be able to detect the Chromecast from the 192.168.1.0/24 network, it should be as simple as setting "enable-reflector" to "yes" in the file

nano /etc/avahi/avahi-daemon.conf

But that isn't working for me.

An important detail; Right now I'm not able to ping from 192.168.1.0/24 to 10.1.1.0/24 or vice versa.

Been looking at this for hours and hours, any help, tips, opinions or ideas are welcome!

4
  • This option is fine if all you can about is connecting a bridged client to the Internet - clearly not what you want ... personally, I use VLANs and do the routing (and firewalling) on my router (openwrt) - also, since the two subnets can't ping each other, then your mDNS configuration is not going to help - you need some sort of routing between the two subnets
    – Bravo
    Jan 24 at 7:24
  • @Bravo I totally agree with that. Is it possible to do some routing within the rpi? What package should I need to do so? Because this is not exactly what I need, I've ordered a managed switch which I'll use to create 3 vlans, internets, user vlan and IoT vlan. I guess that that is a better solution, but then I still need some routing right? Jan 24 at 8:55
  • in your current setup, the routing would need to be done on the other devices - i.e. anything in 192.168.1.0/24 that wants to communicate with 10.1.1.0/24 (and vice versa) would need to use the address of your pi to do so ... along with ipv4 forwarding enabled in the pi of course
    – Bravo
    Jan 24 at 12:14
  • e.g., if your pi is 192.168.1.2 and 10.1.1.2, then the routing for 192.168.1.3 to communicate with 10.1.1.3 for example would need to be via 192.168.1.2 - I think DHCP option 121 may be useful for such config - if your router allows you to set Classless Static Routes
    – Bravo
    Jan 24 at 12:21

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.