Ask HN: What's a simple setup for creating an offline LAN? | Hacker News Reader

Ask HN: What's a simple setup for creating an offline LAN?

7 pointslancesells13 comments

I'm looking to have a LAN that has some storage and IOT devices connected to each other but can't access the internet (or vice versa). Is there a simple way to do this while still having my computer connect to my internet connection?

View on HN

I'd suggest an isolated LAN (network switch and all) for the interior stuff, with your system hooked to that LAN as well as your normal, internet connected one.

The isolated network should have its own root DNS server that returns "no" for all queries outside that LAN: that'll save a lot of time and misery with DNS timeouts.

This.

A dedicated offline switch is so much simpler than VLANs, both to configure, use and understand.

I'd use the same software stack on either a linux machine that's on that LAN, or just use a raspberry pi. I'd basically run the entire network part with dnsmasq.. You don't need anything else for DHCP and DNS. You don't even need to mess with iptables since you don't want packets leaving that LAN.

If you use VLANs in the simplest form, it shouldn't be too hard to configure. Basically, this means: 1) each port is only on a single VLAN 2) no tagging, all ports are in access mode 3) no trunking 4) no layer 3 / routing between VLANs on the switch

If someone else is runnignthe physical wires and plugging them in, then VLANs and managed switches are a godsend; I'm sure.

If you're running the wires (and how many wires are we talking here? 24 or less i bet) ... then the simplicity is worth much more IMO.

Indeed.. Having a box that I know is the offline LAN is just mentally simpler for me, and it does not hurt that dumb access switches are dirt cheap.

True! Networking is fun to play with and learn about though.

I have a "storage" network that uses a separate VLAN. If you don't have a VLAN capable switch you could just get a second switch and dedicate it to that purpose, then add a second NIC to your system.

There are lot of approaches, how to do this. For me simplest solution, to use computer with opensource unix as gateway, with 3 lan cards.

- 1 connect to internet, with real ip; - 2 connect to first lan, with grey ip numbers (192.168. , 172. ), which have nat; - 3 connect to second lan, other grey ip network, which NOT have nat, and all packets going from it to 0/0 silently dropped by firewall.

All nets use dhcp, and have dns and ntpd for convenience, because it is much easier to change few tables at gateway, than change properties of all devices, when happen some difficulty.

Example of difficulty, I few times had troubles with my home lan, because my provider use grey ips in their network and my home net addresses conflicts with providers. So I changed networks of my home lan for some range which is not used by my provider.

BTW, this is really big trouble for some cheap hardware routers, because they have limited IP functionality, and for example one of my own such device only work with 192.168. grey ip range, they don't added 172. network range.

Here's a good walkthrough: https://www.wikihow.com/Create-a-Local-Area-Network-(LAN)

Is your goal isolation or just having the devices not access the internet?

If your goal is only to prevent them from accessing the internet, the simplest solution is to hardcode the IP addresses on your devices, but leave the gateway settings blank (or use a dummy address if needed)

Asked and answered[0], counselor.

[0] https://serverfault.com/questions/218080/is-a-managed-switch...

step 1) mass email announcing lan party

step 2) sit back while everyone sets it up

step 3(optional)) provide mountain dews baby

step 4) have a lan party

step 5) realize that OP asked about an offline lan, not an office lan.

Add a 2nd eth port to your computer, attach a switch/router that the offline devices connect to, using same class C network the 2nd port uses (different from the one on 1st port that connects to broadband router/network). Unless you bridge your ports, the other devices can talk to you and each other, but not the internet. Semi-educated guess :)

Reply on news.ycombinator.com