Printing Across VLANs: A Secure and Scalable Solution

In my previous configuration, I used a CUPS server with multiple network interfaces to enable printing from computers on restricted networks onto the printer located in the admin network. However, after some research and exploration, I discovered a more efficient way to achieve this goal by utilizing VLANs for network segmentation.

Creating a Dedicated Printer VLAN

To start, I created a dedicated "printer" VLAN that can only communicate with the internet but is isolated from other VLANs. Networks from which I want to enable printing, are configured to allow creating connections to the printer VLAN. This ensures that printing traffic within the restricted networks cannot accidentally traverse to other parts of the network, while computers can print to the printer. The printer VLAN is now the primary focus for setting up the UDP proxy container.

Configuring the UDP Proxy Container

To enable printing across multiple networks, I created a Linux container, for a UDP proxy, with network interfaces on both the printer VLAN and any additional VLANs that need to support printing. In this setup, the UDP proxy container acts enable notifications of the printers on the printer VLAN to computers.

Here's an example of how to configure the UDP proxy relay using the udpbroadcastrelay command:

# Configure the first relay for NetBIOS
./udpbroadcastrelay --id 1 --port 137 --dev printer-vlan-interface --dev computer-vlan-interface -f
# Configure the second relay for NetBIOS
./udpbroadcastrelay --id 2 --port 138 --dev printer-vlan-interface --dev computer-vlan-interface -f
# Configure the third relay for SSDP
./udpbroadcastrelay --id 3 --port 1900 --dev printer-vlan-interface --dev computer-vlan-interface --multicast 239.255.255.250 -f

Unlock Seamless Remote Access: The Power of Split DNS with Tailscale

 As a remote worker or someone who frequently collaborates with others on different networks, you're likely familiar with the challenges of maintaining seamless communication and connectivity across various environments. One innovative solution to this problem is split DNS combined with Tailscale, a powerful tool for creating secure, managed tunnels between devices.

What is Split DNS?

Split DNS refers to a configuration approach where your device uses different DNS servers depending on whether you're connected to your local network or an external network (such as the internet). This allows your device to resolve names and access resources locally without relying on the DNS servers associated with the external network, which can be slower and less secure.

How Tailscale Works

Tailscale is a popular tool for creating managed VPN tunnels between devices. It provides a simple and secure way to connect to remote networks while ensuring your data remains encrypted and private. When you install Tailscale on multiple devices, it creates a network of encrypted connections that allow you to access each other's computers as if they were directly connected to the same local network.

Mastering Matter: Seamless Smart Home Integration with Network Segmentation

I’ve been intrigued by the idea of integrating devices with Matter for some time. My smart home setup includes a pair of SwitchBot Hubs, some Govee lights, and an air purifier. Each of these devices comes with its own dedicated app, and while some offer integration with Home Assistant, the process often comes with limitations—such as requiring devices to be connected to the main network.

The primary reason I hadn’t yet migrated these devices to Matter was my desire to maintain network separation for IoT devices, even when using Matter.

Network Segmentation Challenges

Previously, I set up an IoT VLAN where devices on this virtual network are isolated from the main network. Devices like my phone, computer, and Home Assistant server, which are on the main network, can still access the IoT VLAN. However, this setup presented a few hurdles for Matter integration:

1. IPv6 Requirement: I hadn’t enabled IPv6 on the IoT VLAN to reduce the attack surface for potential network threats. Unfortunately, Matter requires IPv6 for communication, so enabling it became a necessity.

2. Local Network Limitation: Home Assistant’s Matter implementation only scans the local network for devices. Since my Home Assistant server resides on the main network, it couldn’t detect Matter devices located on the IoT VLAN.

First Attempt and Challenges

I explored solutions, including this guide on setting up Home Assistant across multiple VLANs. While I managed to connect Matter devices to Home Assistant, this configuration caused my non-Matter devices to become unavailable. Upon inspection, I realized that Home Assistant had designated the IoT VLAN as its default network. This occurred because Home Assistant appears to sort networks by IP subnet, and my IoT VLAN (10.0.15.0/24) was prioritized over my main network (172.16.1.1/24).

Given that the IoT VLAN blocks connections to other networks, this default setting broke many of my integrations. Frustrated, I reset the virtual machine to its previous state and decided to revisit the problem later.

Seamless Local Control: Integrating WeatherFlow with Home Assistant Across VLANs

I've been pleased with my Home Assistant setup for some time now. One of my main focuses has been achieving local control. This ensures reduced latency for device commands and maintains functionality for state updates and commands even without an internet connection.

I've successfully transitioned many devices to local control using Zigbee, Z-Wave, and ESPHome, but not all integrations have been straightforward. A notable exception has been the WeatherFlow integration for my Tempest weather station.

WeatherFlow offers two types of integrations. The first relies on the cloud, where the weather station sends data to the Tempest cloud service, and the WeatherFlow cloud integration then pulls this data into Home Assistant at intervals.

The second method utilizes the fact that the Tempest weather station broadcasts weather state changes via UDP on the local network. The local WeatherFlow integration in Home Assistant listens for these broadcasts. However, my setup had the Tempest weather station on a different network VLAN than my Home Assistant server. Since UDP broadcasts typically don’t cross VLAN boundaries, this local integration wasn’t working.

I had multiple reasons for placing the Tempest weather station on a separate VLAN. Primarily, the default behavior of sending frequent UDP broadcasts can lead to significant network traffic, especially impacting wireless networks. Additionally, I segment my network for security purposes, preventing devices on the Tempest's VLAN from scanning or connecting to computers on more secure VLANs.

Unlocking Raspberry Pi Potential: Navigating Network Booting Challenges for Enhanced Performance and Reliability

I've set up several Raspberry Pis around our house for various projects, but one recurring challenge is the potential for SD card failure due to heavy file system writes. To mitigate this, I've transitioned some of my Raspberry Pi 4s to boot from USB drives, but this limits compatible cases.

Backing up these SD cards or USB drives can be cumbersome, yet essential in case of failure. Recognizing that Raspberry Pis since the 3 B model can boot from the network, I decided to utilize my Proxmox server to host the boot server.

Initially, I explored Piserver, the official solution from the Raspberry Pi Foundation. Setting it up involved creating a VM and booting from the Raspbian distribution iso. While it provided a straightforward interface for booting devices from the network and selecting distributions, it fell short of my needs.

Empowering Your Home's Power Protection: A Deep Dive into UPS Monitoring and Integration

Our household relies on several Uninterruptible Power Supplies (UPSs) to safeguard our network equipment and computers. A crucial aspect of maintaining these UPSs is monitoring their batteries to determine if they need replacement.

For UPSs located near desktop PCs, monitoring battery status is straightforward. These UPSs can typically be connected via USB, allowing us to use monitoring software to check battery health.

However, monitoring UPSs situated in network racks is more complex. Some UPSs only offer serial or USB ports, requiring a computer to directly connect and retrieve battery status. Alternatively, certain UPSs feature a network port and cloud connectivity, enabling them to upload status data to the cloud for remote viewing.

We have an APC UPS with cloud connectivity, which facilitates notifications for significant status changes through their Smart Connect service. Despite its benefits, this solution has drawbacks for our specific needs. Firstly, there's no integration with Home Assistant, preventing us from automating devices based on UPS status, such as shutting down devices during power outages when battery levels drop below a certain threshold. Secondly, reliance on a cloud connection means that if our internet goes down, the automations wouldn't function.

Empowering Family Legacy: How I Transitioned to Self-Hosting with Gramps Web

For several years now, I've been maintaining a genealogy website containing information from both my and my wife's family history. One of my main objectives has been to ensure this wealth of information is readily accessible not just for our extended family, but also for our children whenever they want to look into their roots.

 Initially, I hosted this website through a paid hosting service, utilizing TNG. While this setup served its purpose adequately, my recent acquisition of a Proxmox server prompted me to explore the possibility of self-hosting. Given this shift, I decided to transition to open-source software, as it would grant me greater flexibility in making adjustments as needed.

In my search for suitable open-source genealogy software, I came across Gramps Web. Its user-friendly interface and compatibility with the Gramps genealogy desktop software caught my attention.

Mastering NAS Storage: Unveiling Hidden Challenges and Solutions

Today, I'm diving into a little adventure I recently had with our trusty 6-drive Synology NAS, boasting a whopping 73TB of storage space. Now, who wouldn't be excited about that, right? But there are some challenges.

I couldn't help but notice that our storage space was getting full. Curious, I delved deeper into the matter. One of the primary functions of our NAS is serving as storage for our Plex DVR. However, despite our occasional recordings, the storage was filling up faster than I expected.

So, I decided to do some spring cleaning, starting with deleting some recordings. But here's the kicker - the space wasn't budging. I decided to peek into the file system, and there it was: a bunch of files in the #recycle folder within our shares.

Turns out, there wasn't a default schedule for emptying the recycle bin on our Synology NAS. This meant all those recordings, along with any other files, were being kept indefinitely.

Unlocking Seamless Integration: Navigating Unexpected Hubitat Device Queries and VLAN Challenges for a Smoother Home Automation Experience

During my network debugging efforts, I came across an intriguing observation related to the two Hubitat devices on our network. The logs below illustrate the unexpected mDNS queries they generated:

1. Query for Airplay Devices

12 0.788177995 192.168.55.11 → 224.0.0.251 MDNS 130 Standard query 0x0000 PTR _airplay._tcp.local, "QM" question PTR Hubitat._hubitat._tcp.local

2. Query for web servers:

14 0.791018733 192.168.55.11 → 224.0.0.251  MDNS 127 Standard query 0x0000 PTR _http._tcp.local, "QM" question PTR Hubitat._hubitat._tcp.local

Surprisingly, the Hubitat devices were seeking Airplay and web server devices, even though I only utilized them for Z-Wave and Zigbee devices, and have not installed the Airplay application. This behavior caused issues, as the queries and responses were transmitted across VLANs, leading to a flood of broadcast packets during high query volumes.

Dazzling DIY Hexagonal LED Accent: A Budget-Friendly Alternative to Nanoleaf Lights with WLED Magic!

I recently completed a wood hexagonal accent piece with LED backlighting for my office. My inspiration was the Nanoleaf hex lights, but I aimed to achieve a similar look without incurring the high cost associated with Nanoleaf lights. Additionally, I saw this as an opportunity to explore and learn about WLED.

To start, I sourced hexagonal wood panels in multiple tones. I deliberately chose multiple-tone panels to ensure the accent piece looked appealing even when the lights were off.

Unlike Nanoleaf panels, my wooden panels don't allow light to shine through. Therefore, I planned to position the LEDs to shine out the top, bottom, and sides of the panels. This necessitated offsetting the panels from the wall to provide space for mounting the LED strips behind the hex panels.

Empowering Privacy: Unveiling the World of Affordable VPNs through Shared Bandwidth Projects and Proxmox Efficiency

In an era where digital privacy is a growing concern, Virtual Private Networks (VPNs) have become indispensable tools for safeguarding online activities. However, the cost of premium VPN services can be a deterrent for many users. Fortunately, a new wave of projects that leverage shared user bandwidth has emerged, offering a cost-effective alternative to traditional VPNs. In this blog post, we'll explore the benefits of such projects and discuss how setting them up as Linux containers on a Proxmox server can be a resource-efficient solution. 

Shared Bandwidth VPN Projects:

Mysterium

Mysterium is a decentralized VPN network that operates on a peer-to-peer model. Users can share their excess bandwidth in exchange for MYST tokens. By becoming a node in the Mysterium network, users contribute to the overall infrastructure and, in return, gain access to affordable VPN services. Setting up Mysterium nodes as Proxmox Linux containers ensures efficient resource utilization and easy management.  I set this up following the instructions for Linux nodes.

Mysterium setup

EarnApp

EarnApp takes a unique approach by allowing users to earn money by sharing their internet bandwidth. Users can convert their earned tokens into VPN services, creating an innovative system where the community contributes to the network's growth. Proxmox's virtualization capabilities make it straightforward to deploy and manage EarnApp nodes, making it an attractive option for those seeking a low-cost VPN solution.

EarnApp setup

Cracking the Code: Navigating Network Nightmares with Home Assistant, LibreNMS, and Wireshark

Introduction:

Hey there! Ever found yourself scratching your head over a quirky network issue that just won't quit? I recently had my fair share of head-scratching moments when network broadcast storms started causing serious disruptions in our switches and wireless access points. In this post, I'm breaking down the steps I took to unravel this persistent, network mystery.

Setting the Scene:

Picture this – network switches and access points dropping off the radar every few nights. To get to the bottom of it, I needed to gather some intel without losing sleep, especially as these problems seemed to occur in the middle of the night.  First move? Configuring Home Assistant to ping, with the Ping integration, a crucial switch and give me a notification on my phone when things go south. It became my silent night watchman, marking the time when the broadcast storm kicked in.

The Quest for Network Clarity:

LibreNMS, a network monitoring system, was my next stop. Although it did show spikes in network bandwidth, the specifics were elusive. SNMP logs lacked the juicy details needed for a deep investigation.

Enter rsyslogd:

To beef up my data game, I brought in rsyslogd on a Proxmox server. This Linux container was configured to capture logs from the admin VLAN, where switches and access points were. This did capture a lot of data, however, drowning in logs was not my idea of fun.  It was too hard to find the root cause of these issues.

Mastering Home Network Security: A Step-by-Step Guide to Fortify Your DNS with Pi-Hole and Raspberry Pi Across Multiple VLANs

Recently, I delved into the realm of setting up secure DNS for our home network, aiming to encrypt DNS requests en route to the name server. Unfortunately, Unifi lacks support for secure DNS (neither DoH nor DoT). To address this, I decided to explore the installation of Pi-hole on a Raspberry Pi at home.

However, the standard Pi-Hole install for Raspberry Pi required additional setup steps on my network. Firstly, Pi-hole lacks built-in support for secure DNS, necessitating an additional configuration. Secondly, the default Raspberry Pi lacked VLAN support, prompting me to configure it to function seamlessly within our network.

Raspberry Pi and Pi-hole Setup

I began by installing the Raspberry Pi OS Lite 64-bit on the Raspberry Pi, intending to use it as a headless device on the network. Once the operating system was installed and updated, I proceeded to install Pi-hole. This was a straightforward process, thanks to Pi-hole's automated installation script.

curl -sSL https://install.pi-hole.net | bash

Setting up DNS over HTTPS for Pi-hole

To ensure secure DNS, I followed the instructions on the Pi-hole site to configure cloudflared, allowing DNS requests to be made over HTTPS. Once configured, Pi-hole forwards requests to cloudflared, which handles DNS requests securely.

Enabling Support for Multiple VLANs

While Pi-hole successfully handled requests for the native network, extending its support to other VLANs posed a challenge. Instead of opting for solutions involving firewall rule modifications to permit VLAN requests to the native network, I chose to ensure the Raspberry Pi could seamlessly join the VLAN networks I intended to use Pi-hole on.

Following the instructions on this page for enabling VLAN support on the Raspberry Pi, I configured an interface for each VLAN I wanted the Pi-hole to respond on.

Revolutionizing Air Quality Monitoring: How I Upgraded Our System with Mila Integration for Smart Home Automation

In this blog post, I explained how I set up an air quality monitoring system for our neighborhood. With this setup, we can keep an eye on the air quality outside our home. However, this monitoring system is somewhat passive because I need to manually check the air quality and take actions accordingly, such as turning on the HVAC fan to filter and circulate the indoor air.

I considered using the standard Home Assistant integration for Purple Air, but it shares the same drawback as the Magic Mirror integration in terms of API usage limitations. I wanted to avoid an integration that might eventually become unreliable due to API quota limits.

Recently, we purchased Mila connected air filters. These filters not only measure the air quality in the rooms where they're installed but also allow you to select a sensor for neighborhood air quality in the Mila application. Within a month of setting up our Purple Air monitor, I was able to choose it as the neighborhood air quality sensor in the Mila application. This feature enables the Mila filters to determine the relative differences in air quality between the indoors and outdoors.

Silencing the Breeze: Upgrading Legion Network Racks for Whisper-Quiet Performance

In our home, we utilize a couple of Legion 18 network racks. These particular 18U network racks are designed to be compact, making them suitable for placement in closets or offices. Additionally, they come equipped with built-in cooling features, specifically two 120mm fans located at the top of the rack.

However, while the built-in cooling is a valuable feature, I couldn't help but notice that the noise generated by the fans can be quite noticeable, particularly in quieter environments. One of the main reasons for this is that the fan speed is fixed; there's only an on/off switch available. Consequently, you can either turn the fans off entirely or run them at their default, relatively loud speed. This limitation led me to seek out replacement fans for the rack.

Stock fans from the Legion 18 network rack

After conducting some research, I decided to opt for the AC Infinity Rack ROOF Fan Kit. This kit includes two 120mm fans that can be connected to a provided fan controller, which, in turn, connects to a power source. The fan controller offers precise control over the fan speed, allowing for quieter operation.

Unveiling the Air We Breathe: A Journey through Air Quality Monitoring and Insights

In light of the California wildfires over the past few years and our recent move to the Midwest, I've developed a strong interest in monitoring the air quality at our home. The same curiosity was sparked by the presence of smoke from the Canadian wildfires. To fulfill this interest, I've been utilizing PurpleAir, a platform that provides insight into the current air quality around our residence. One of the notable features of PurpleAir is its ability for community air quality monitors to share their data with a broader audience.

Upon relocating to this new area and wanting to stay informed about the air quality in our neighborhood, I delved into the data offered by PurpleAir. Unfortunately, the nearest sensor is situated more than a mile away and operates within a different micro-climate, which could influence the accuracy of the air quality measurements.

Unleashing Home Automation Magic: From Zigzagging with SkyConnect to Soaring with Hubitat

In a previous blog entry, I delved into the fascinating realm of leveraging SkyConnect to interconnect my Zigbee devices with my home automation system. While it seemed like a walk in the park to incorporate Zigbee devices into my Home Assistant setup, I'm here to shed light on some rather unfortunate downsides that cropped up during this experiment.

The crux of the issue lay in the somewhat petite antenna housed within the SkyConnect. This pint-sized component led to a rather finicky connection experience with my Zigbee devices. You wouldn't believe the number of times my sensors and switches decided to take an impromptu leave of absence from the Zigbee network. The result? Automation hiccupped, leaving me high and dry without the expected triggers. And on those rare occasions when triggers managed to sneak through, the devices decided to play hard to control.

Now, let's talk about compatibility woes. The SkyConnect supports just Zigbee and Thread protocols. That might not be a deal-breaker, but here's the rub: I've got a fair share of Z-Wave devices I'm not ready to part with. The grand plan was to simplify my smart home's intricate web, and adding yet another system into the mix for handling the Z-Wave network just didn't tickle my fancy. One system to connect the low-powered wireless devices—that was the dream.

But wait, there's more! Compatibility gremlins struck again. A number of devices I attempted to pair with the SkyConnect ended up being flaky, where they periodically dropped off the network. It's like the functionalities were playing a game of hide and seek. Here's the kicker—I yearned for a system where either the company had its act together or a thriving community would come to the rescue, waving magic wands in the form of drivers to unlock those missing functions.

Introducing Hubitat

Now, hold onto your seats, because after some serious deep diving, I stumbled upon a hero in the home automation arena—Hubitat. Picture this: an automation hub that flaunts wireless radios tuned in to not just Zigbee, but also Z-Wave and a bunch of other protocols. Say adios to the single-protocol constraint; Hubitat had my attention.

Unveiling the Journey: From Tempest Weather Station to Magic Mirror - A Triumph in Weather Data Integration

Some time back, I shared my experience with the Tempest Weather Station, a fantastic tool that keeps us informed about the weather conditions at our home. This has been remarkably invaluable during the more extreme weather events this summer.

However, it's important to note that having the weather station installed is only half the battle; making the data accessible is what truly enhances its usefulness. A while ago, I implemented a solution in the form of a Magic Mirror – a project I undertook to display various helpful information for our household. The base software for the Magic Mirror incorporates weather data display capabilities, with OpenWeatherMap as the primary weather provider. Nonetheless, we encountered an issue with the data accuracy from this provider, as its temperature readings consistently skewed higher than the actual temperatures at our location.

The built-in weather module does allow for alternative weather providers, leading me on a quest to figure out how to funnel the weather data from our Tempest Weather station to one of these providers for display on the mirror. The Tempest Weather station supports data export to Weather Underground in the stock setup. However, the built-in weather module lacked the capability to interpret data from Weather Underground.

Discovering WeeWX

Since the stock weather module already integrated support for OpenWeatherMap, I decided to send the Tempest's weather data to OpenWeatherMap. However, given that this functionality wasn't native to the Tempest, I stumbled upon WeeWX – a project designed to collect data from various weather stations and present it on a customizable dashboard. Additionally, WeeWx offered the functionality to export data to local and cloud-based weather providers.

Despite WeeWx's broad compatibility with different weather stations, it didn't inherently support the Tempest Weather Station. But, taking advantage of WeeWX's plugin architecture, a solution emerged through the creation of the weatherflow-udp plugin. This clever plugin intercepted the UDP packets transmitted by the Tempest, effectively capturing and recording the data.

Once I successfully integrated the Tempest data into WeeWx, the next challenge was to export this data to OpenWeatherMap. Given that direct support wasn't available, my search led me to the weewx-owm plugin, facilitating weather data export to OpenWeatherMap. After setting up the plugin, I was able to transfer the weather data to OpenWeatherMap.

Mastering the Upgrade: Overcoming Challenges in Replacing Light Switches in Our Century-Old Home

Over the past few days, I've been immersed in the task of replacing the light switches in our century-old house with Lutron light switches and dimmers. As mentioned in a previous post, this endeavor has not been without its hurdles due to the house's age and multiple previous owners. In this article, I will outline the problems I encountered during the installation process and share the solutions I discovered.

Dealing with 3-Way Lights

In certain areas of our home, such as stairways or hallways, we have light switches located at both ends to provide convenience and ensure visibility while moving about. Although Lutron supports 3-way switch setups, there are a few important considerations to keep in mind.

Load-Managing Switch

Lutron's instructions for configuring 3-way switches assume a direct connection between the Lutron switch or dimmer and the load. When working on an installation where the circuit's wiring is uncertain, it becomes crucial to test the wiring during the installation process.

To tackle this, I removed the switches from the wall and used a voltage tester to determine which switch was linked to the power source and which one was directly connected to the load. Armed with this knowledge, I followed Lutron's instructions and replaced the switch that was directly connected to the load, successfully following the provided directions.

Lighting the Way: Discover the Reliability and Versatility of Lutron Caseta for Your Smart Home Ambiance

Today, we're shining a light on Lutron Caseta, an exceptional lighting control system that combines reliability and versatility to elevate your home's ambiance. In this post, we'll delve into the benefits of using Lutron Caseta, with a particular focus on its rock-solid performance and seamless integration capabilities.

Reliability Redefined

When it comes to lighting control, reliability is non-negotiable. That's where Lutron Caseta takes center stage, wowing users with its unwavering dependability. Lutron achieves this feat through its ingenious use of the Clear Connect RF wireless protocol, operating at a frequency of 434 MHz. This well-thought-out frequency selection ensures a robust connection that remains impervious to interference from pesky Wi-Fi routers or temperamental microwaves, granting you uninterrupted command over your lights.

However, like any superhero, Lutron Caseta does have its limitations. The Clear Connect RF wireless protocol lacks mesh functionality, resulting in a range that extends up to a modest 30 feet. Fear not, though, for Lutron has your back! They offer a handy repeater that works wonders in doubling the range of your wireless protocol. So, should you ever encounter connectivity conundrums, simply deploy this repeater to expand the reach of your Caseta system.