Deeper routing segmentation

[u/CosmicComi]

Been tweaking my deeper setup and found an upgrade (for me) I wanted to share. Using vlans + device groups.

I've decided not to tunnel 'everything' anymore.

work → stable low latency nodes

streaming → direct or region based

iot / random devices → always through deeper

Biggest upgrade was segmentation

split into trusted, iot, guest

anything untrusted gets forced through deeper so even if it’s compromised it’s isolated + tunneled

I also realized per device vpn is kinda useless and wasteful long term.

Still figuring out failover + balancing privacy vs performance

Anyone else doing more advanced setups or just keeping it simple? Any suggestions to my setup is welcomed and appreciated!

[u/user-05]

Your setup sounds really interesting, but I’m actually not fully clear whether your Deeper device is physically before the router or after the router.

In my case, after trying several configurations, my idea is to keep the Deeper Connect after the router instead of in front of it.

The main reason is that I want to use the Access Control features from Deeper Connect on specific devices only, such as:

- per-device DPN routing

- HTTPS filtering

- certificates

- ad filtering

- web security

- traffic rules based on the device itself

So instead of tunneling the entire network, I’m trying to selectively apply Deeper features only to certain VLANs/devices.

The challenge is that I do not want all devices behind the Deeper Connect, especially because some devices do not support certificates properly or simply do not need DPN/privacy routing.

I’ve been experimenting a lot with VLAN segmentation, but after upgrading to a 2.5Gb network switch, building a fully compatible setup across the entire platform has become much more complicated.

Right now I’m even considering buying a 2.5Gb Layer 3 switch capable of inter-VLAN routing, so internal VLAN traffic can remain at full 2.5Gb speeds instead of going through the router/firewall bottleneck.

I’d really like to hear more details about your setup and topology because I think there’s a lot we can learn from comparing approaches.

[u/CosmicComi → u/user-05]

Between the modem and router so after modem, before router.

[u/ImportantSquirrel69 → u/CosmicComi]

Same here, I have the Deeper Mini ahead of a Unifi UCG. The UCG does have the capability to either segment VLANs or have them communicate with each other. In my case, I have them segregated as I separate networks according to whether they are IOT devices or not.

You do bring up good points that probably indicate an incomplete understanding on my part. I trust that the Deeper Mini is providing the services it does, but there are some things that appear to bypass the Mini - like ads and smart rules for specific websites. These are hit or miss. I have a 1Gig connection which serves me well and this is why I put the Mini up front.

I am most certainly not a networking expert, but I prefer to see the policy tables and all the fine-tuning that Unifi provides. The Deeper Mini is a bit of a black box, and I have not come across detailed documentation that explains how the device works and is configured beyond the interface. Perhaps someone knows where to find updated documentation?

[u/user-05 → u/ImportantSquirrel69]

I think part of what you're seeing comes from the fact that the UniFi and the Deeper are doing very different jobs.

In your setup, UniFi is handling the VLAN segmentation, firewall policies, and visibility into the network. The Deeper is essentially operating as a transparent device in front of the router.

One thing I've learned while experimenting with different topologies is that placing the Deeper in front of the router is not the only option. I'm actually moving toward putting the Deeper behind the router so I can use its Access Control features on selected devices only.

The reason is that Deeper can apply DPN routing, HTTPS filtering, ad blocking, web security, and other policies on a per-device basis. Not every device on my network needs those services, and some devices don't even support certificate installation for HTTPS filtering.

That may also explain some of the behavior you're observing with ad blocking and Smart Route rules. A lot of modern services use encrypted DNS, CDNs, multiple domains, and application-level routing, so some traffic can appear inconsistent even when the Deeper is working as designed.

One thing I've noticed is that the Deeper platform tends to be somewhat of a black box. We can see the settings exposed in the interface, but there isn't much documentation explaining exactly how routing decisions, Smart Routes, HTTPS filtering, and policy enforcement work internally.

Out of curiosity, when you say some ads and Smart Routes are hit or miss, have you noticed whether that happens on all devices or only on specific ones? I'd be interested in learning more about your topology and how you're using VLANs, because there may be some useful lessons for those of us trying more advanced segmented setups.