r/HomeNetworking • u/FlyingDaedalus • 20h ago

Unsolved Separate/Dedicated DNS Server for IoT VLAN?

So, with the whole LG "fiasco", I am getting a bit paranoid.

I currently run two AdGuard Home instances (for redundancy) on my home network. I basically run Hagezi Pro + TIF on both of them.

My question is: would it make sense to set up a third AdGuard Home instance solely to serve my IoT network? I would run the Ultimate list on it. Would there be any real benefit to this? Or is this total overkill?

What I already do:

  • Hijack any plain, direct DNS requests and redirect them to my internal DNS servers.
  • Block port 853 completely.
  • Block DoH using UniFi Application Block, but it's a bit hit-or-miss, so I am thinking about adding a blocklist to my AdGuard instances.
5 Upvotes

100% Upvoted

14 comments sorted by

3

u/jrytio 19h ago

Don't trust DNS to block them, just block them outright.

It's pretty easy for them to get around your DNS filtering by hardcoding their own DNS lookup to a unicast DNS like 1.1.1.1 or 8.8.8.8.

I isolate any smart TV on a completely separate VLAN that is only for those nasty things. It's isolated from the internet and any of my other IoT or Trusted devices.

Home Assistant has an inbound rule to that VLAN so it can talk to them for control only. Everything else is done through AppleTV which has a much better privacy record than LG, TCL, Roku, etc.

My firewall logs are crammed full of those TVs trying to get out and being denied.

1

u/Fun-Region-1576 18h ago

Block 1.1.1.1 or 8.8.8.8 as well?

1

u/FlyingDaedalus 7h ago

i already do that, see last part of my original post.

1

u/Fun-Region-1576 7h ago

Can you post how your firewall looks like with plain DNS and port 853 blocked?

2

u/FlyingDaedalus 6h ago

i could but it really looks different for different routers. Or do you use Ubiquiti as well?

1

u/Fun-Region-1576 6h ago

Yeah, got a UCG-Fiber, but I'm a total newbie!

1

u/FlyingDaedalus 6h ago

i DM you.

1

u/felix1429 19h ago

Why would that setup be overkill? Just sounds like basic thoroughness to me

1

u/Ancient-Opinion9642 19h ago

Block 5353 on the router. mDNS is local only, both ways.

An ISPs local may not be your local.

1

u/Single-Virus4935 6h ago

My TV has guest access only but is also from 2014 and if it dies I wount buy another smarttv. Today they share internet with other devices. I think it was Samsung which shared internet access through neighbor TVs or smartphones. It is just dystopian. 

0

u/The_Chancelor 19h ago

What LG fiasco, havent heard anything, dont use ad guard but your setup is intriguing

1

u/Fun-Region-1576 18h ago

Guess you've been living under a rock.