pfSense Gold Subscription

Author Topic: TP-Link Easy Smart Switch security question  (Read 8269 times)

0 Members and 2 Guests are viewing this topic.

Offline warheat1990

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
TP-Link Easy Smart Switch security question
« on: December 31, 2016, 10:14:22 pm »
Hello,

I'm planning to buy TP-Link Easy Smart lineup (TL-SG1016DE and TL-SG108E) so I can separate my LAN. Here's the current setup in my house.

modem -> pfSense -> unmanaged switch (will replace this with easy smart switch) -> patch panel -> keystone jack / wall plate across several rooms in the house -> devices

So what I'm trying to achieve is devices from other room won't be able to access the devices in my room. For example my sister laptop won't be able to access my NAS or PC.

However I look around the internet and found this post on reddit about the easy smart switch lineup.

Quote
I have one of these and it's a huge hassle to get it working just so you can change the default password at minimum.
And more importantly the VLAN stuff, while obstensibly working, doesn't do network separation; an attacker on VLAN1 can spoof the ARP table for other VLANs. So it works but not for security, so it's useless.

source: https://www.reddit.com/r/homelab/comments/4tym2z/best_cheap_gigabit_switch_4060/d7pvtxc/

Is this true?

I read the whole 14 pages I found in this forum : https://forum.pfsense.org/index.php?topic=76022.0 but I can't seem to find anyone mention it.

Is there better alternative beside these easy smart lineup with similar price range?

Any help will be appreciated and apologize for bad english

Online stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11882
  • Karma: +461/-15
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #1 on: January 01, 2017, 11:21:42 am »
I have an SG1016DE and have had no issues with it. I've never really tested VLAN isolation to any depth, I have a hard time believing it's not isolated if configured correctly. I've never seen any stray traffic on the wrong VLAN/Port. I could probably run a test if you need me to.

It's perhaps not the most intuitive GUI in the world but hard to argue with the price and I love that it's fanless. It will do what you need there.

Steve

Offline jusjay

  • Newbie
  • *
  • Posts: 12
  • Karma: +3/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #2 on: January 01, 2017, 05:18:34 pm »
I suggest you also read this: http://www.aredn.org/content/tp-link-tl-sg108e-vlan-setup

I considered getting either a TP-Link TL-SG108E or a Netgear GS108E https://www.netgear.com/business/products/switches/web-managed/GS108E.aspx

I went with the Netgear GS108E and am happy with it.

Online stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11882
  • Karma: +461/-15
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #3 on: January 01, 2017, 08:09:59 pm »
You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though...  ;)

Steve

Offline jusjay

  • Newbie
  • *
  • Posts: 12
  • Karma: +3/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #4 on: January 01, 2017, 09:37:34 pm »
Quote
You mean specifically the VLAN1 restriction?
Yes, just in case it might be an issue.

Offline warheat1990

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #5 on: January 01, 2017, 10:15:14 pm »
You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though...  ;)

Steve

So it should be fine as long as I stay away from the default VLAN1?

Offline Taiidan

  • Jr. Member
  • **
  • Posts: 37
  • Karma: +3/-5
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #6 on: January 01, 2017, 10:39:02 pm »
You mean specifically the VLAN1 restriction?

You should not ever use VLAN 1 for exactly these sorts of reasons. Switches often use VLAN 1 internally for untagged traffic and the results of trying to use it externally can be unpredictable.

I haven't found it a restriction myself. Of course I'm not using VLAN1 though...  ;)

Steve

So it should be fine as long as I stay away from the default VLAN1?
No.

Crappy fly-by-nite chinese company networking hardware is almost always full of security problems, you would be better off purchasing a used switch off ebay from a more reputable OEM.

Offline warheat1990

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #7 on: January 01, 2017, 10:48:59 pm »
I've never really tested VLAN isolation to any depth, I have a hard time believing it's not isolated if configured correctly. I've never seen any stray traffic on the wrong VLAN/Port. I could probably run a test if you need me to.

I'd appreciate if you can run a simple test to check if it's isolated correctly.

Online johnpoz

  • Hero Member
  • *****
  • Posts: 14293
  • Karma: +1330/-193
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #8 on: January 02, 2017, 06:35:47 am »
Are we talking installation in a DOD facility or your house?? ;)

Pretty sure it does vlan isolation, kind of useless of them to state its a smart switch with vlan support if it doesn't actually isolate the vlans..  It might be very limited in what "vlan" its managment IP is on - most likely its going to be default vlan 1 with no way to change it..  And will have to be untagged.

I really don't see how that is an issue in a "home" setup.. Are you worried about someone coming into your house plugging into one of your switch ports and doing a vlan hop attack on you?  Really??? ;)

While I agree in enterprise setup you always remove vlan 1, do not use vlan 1 etc.. Your management vlan is not vlan 1, etc etc etc..  But pretty sure your setting this up in you house right??  Your looking at very LOW END smart switches.. To expect the bells and whistles of a fully managed switch??  If you want the ability to change your management vlan away from an untagged vlan 1 setup then your going to have to spend a few more $'s

But for quick and dirty hey I need to have vlan support on my home budget that is really low or the wife will kill me.. Then sure the tplink or negear low end less than $40 smart switches are fine.. I have a netgear 108ev3 in my av cabinet.  It does what it needs to do.. Not worried about someone plugging into my av cab switch and doing a vlan hop attack on me ;)  And yeah I run vlan 1 on my "home" network - its just easier!!

I wish it did more, has not snmp support, etc.  again its a LOW END smart switch - you get what you pay for..   Now if you bump your budget to say closer to 200 then sure you can get some really feature rich switches..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Online stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11882
  • Karma: +461/-15
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #9 on: January 02, 2017, 09:37:40 am »
If someone wants to suggest a test I can probably run it.

I've never had any issues with it. I have different DHCP servers on different VLANs and clients always pull from the expected subnet.

Yes the management interface is always on the default vlan, effectively untagged. I'm using it at home, that's not a problem.

Steve

Online johnpoz

  • Hero Member
  • *****
  • Posts: 14293
  • Karma: +1330/-193
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #10 on: January 03, 2017, 05:21:43 am »
Well per the link he gave says

"attacker on VLAN1 can spoof the ARP table for other VLANs."

So on vlan 1 can you arp for other devices on other vlans?  If you are connected to a vlan 1 port, can you spoof a mac that is on different vlan and then gain access to that vlan device?  I find it highly unlikely to be honest..  But then again this is a HOME setup.. Who exactly is going to have access to your vlan 1 in the first place?  And they are going to be doing a vlan hop attack?

As you mentioned already if there was no actual layer 2 isolation then you would have issues with your multiple dhcp servers.  There are many switches that are open to vlan hoping attacks.. not just the cheap ones.. Especially if they are not configured secure..

Either way I don't see how any of that really matters for a "home" setup.. It does what you need it to do right - which is isolate your traffic at layer 2.  It clearly does that ;)  Or Stephenw10 for example would have all kinds of issues with his dhcp servers and other vlans getting the wrong IP..

You could use any of the vlan hopping pentesting tools, frogger comes to mind.
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline jahonix

  • Hero Member
  • *****
  • Posts: 2404
  • Karma: +144/-14
  • volunteer since 2006
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #11 on: January 03, 2017, 07:07:03 am »
... my sister laptop won't be able to access my NAS or PC...
Unless your sister is a hardcore hacker this is totally over the top!
Even if she was then there are different ways to solve this "problem" in the family - get her involved in testing the network security for example. But if she was she'd taken care of it already and not you...
So you worry about problems you don't have.
Chris

The issue with IPv6 jokes is that almost no one understands them and no one is using them yet.

Offline warheat1990

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #12 on: January 03, 2017, 11:10:36 am »
I don't want to sound offensive, but my question is simple if this have proper isolation before I drop $150 on it. I don't see any relevance on "this is home switch, you better not to expect anything", well yeah if it doesn't do anything that I want it, I'd rather invest in a better switch because $150 is not cheap for me.

And I don't see any relevance in "your sister is probably not a hacker" or "this is highly unlikely someone's going to come to your house and plug something into the port". Well it's also very highly unlikely that someone will get your modem or router password especially if you turn your wifi off so why not just leave the default admin/admin or it's also very highly unlikely someone will get into your email account especially if you have 2 way auth so don't bother with password manager.

I mean what's the point of the discussion then? That being said, I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.
« Last Edit: January 03, 2017, 11:14:07 am by warheat1990 »

Offline KOM

  • Hero Member
  • *****
  • Posts: 5370
  • Karma: +667/-19
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #13 on: January 03, 2017, 11:36:57 am »
Quote
I'm new here so I don't know how things work around here and I don't mean disrespect, but these responses are definitely not what I expected.

We get a fair amount of people (usually with little networking knowledge) who think they're trying to secure their family photos from nefarious Russian super-hackzors.  This usually leads to overly-complex configurations that nobody can decipher.  Gauging your users & their abilities will help you to determine how tightly to wind the tinfoil around your head.  I run networks at the office and at home.  At the office, everything is locked down.  At home, things are much looser since my family wouldn't know a network if they tripped over the Ethernet cable.

For what it's worth, I just bought the 105E over the holidays for $40, but I haven't had much time to play with it or its VLAN support.

Offline jahonix

  • Hero Member
  • *****
  • Posts: 2404
  • Karma: +144/-14
  • volunteer since 2006
    • View Profile
Re: TP-Link Easy Smart Switch security question
« Reply #14 on: January 03, 2017, 05:00:21 pm »
No offense taken.

before I drop $150 on it.
What do you want to buy for $150?
A TL-SG108E is something like 25 Euros which should be $30 max, double that for a TL-SG1016DE


Personally, I don't like Esay Smart Switches and prefer one step up. Have a look at the TL-SG3210 of which I use multiple myself at home.

Don't use VLAN1 for anything and you should be fine and have proper isolation.
Chris

The issue with IPv6 jokes is that almost no one understands them and no one is using them yet.