separation of IP cameras

B

brunoschwartz

Hello All,
I would like to ask more experienced users how to conceptually approach the following task.

I have a subnet 192.168.1.0/24 running a file server and backup machine in iocage jails (jails' IPs are on the same subnet).
I would like to install IP cameras with zoneminder again running in an iocage jail.

How can I separate the IP cameras form the traffic on the 192.168.1 subnet? Also, I don't want any of the cameras to be able to access the wan, but the zoneminder jail should be able to do that.

From reading around there are two options
1) Make network alias, say 192.168.2.0/24, on the LAN interface and set up all the cameras to be on that subnet.
Then make iocage jails with zoneminder on the same subnet
Within the zoneminder jail set the route to the wan gateway.
But no route will be set up for the 192.168.2 subnet on the host so nothing on that subnet will be able to connect to the internet

2) Use VLAN on the LAN interface.
This seems much more elegant but I find the documentation to be too sparse to make sense of how to deploy this.

Please tell me your thoughts,
BW,
T
 
But no route will be set up for the 192.168.2 subnet on the host so nothing on that subnet will be able to connect to the internet
Click to expand...
You mean default route. IMHO the 1st approach is the most straightforward and should be fairly easy to set up. If your host has sysrc -v gateway_enable (and NAT), you'll have to insert a ipfw(8) rule to exclude the 192.168.2/24 subnet from beeing forwarded/NAT'ed. Beware IPV6 may intervene w/ your intentions.
 
I mean if you forbid/set s/th for IPv4 you should not forget to also do that for IPv6. Else you'll have nasty surprises.
Good luck!
 
Just put them in their own, isolated VLAN and no routing to any other network and attach the jail to both VLANs.
Put the cameras on access ports at the switch and use tagged VLAN for the jail.
 
You must log in or register to reply here.
Back
Top