For a school project I'm trying to figure out how to create a safe network for IoT devices using a rpi.

To achieve that I want to use basic things that are available on raspbian like iptables and avahi. I did look into things like firewall on a bridge within the same subnet, but that didn't work out. I do think I have something possible over here but I just can't figure it out...

Here is a scheme from my current setup: https://prnt.sc/26i3vnt

Right now I have set up a raspberry-pi 3 with a bridge from wlan0 (which is connected to my home network to eth0 which has it's own IoT subnet ( Then I did connect an access point to be able to connect a chromecast to the IoT subnet.

To create that bridge I used the script from option 2: https://willhaley.com/blog/raspberry-pi-wifi-ethernet-bridge/

Now I'm able to connect devices to the IoT subnet, on which I receive DHCP and am able to surf the interwebs from.

What I did next is avahi, an mDNS service to be able to detect the Chromecast from the network, it should be as simple as setting "enable-reflector" to "yes" in the file

nano /etc/avahi/avahi-daemon.conf

But that isn't working for me.

An important detail; Right now I'm not able to ping from to or vice versa.

Been looking at this for hours and hours, any help, tips, opinions or ideas are welcome!

  • This option is fine if all you can about is connecting a bridged client to the Internet - clearly not what you want ... personally, I use VLANs and do the routing (and firewalling) on my router (openwrt) - also, since the two subnets can't ping each other, then your mDNS configuration is not going to help - you need some sort of routing between the two subnets
    – Bravo
    Commented Jan 24, 2022 at 7:24
  • @Bravo I totally agree with that. Is it possible to do some routing within the rpi? What package should I need to do so? Because this is not exactly what I need, I've ordered a managed switch which I'll use to create 3 vlans, internets, user vlan and IoT vlan. I guess that that is a better solution, but then I still need some routing right? Commented Jan 24, 2022 at 8:55
  • in your current setup, the routing would need to be done on the other devices - i.e. anything in that wants to communicate with (and vice versa) would need to use the address of your pi to do so ... along with ipv4 forwarding enabled in the pi of course
    – Bravo
    Commented Jan 24, 2022 at 12:14
  • e.g., if your pi is and, then the routing for to communicate with for example would need to be via - I think DHCP option 121 may be useful for such config - if your router allows you to set Classless Static Routes
    – Bravo
    Commented Jan 24, 2022 at 12:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.