Can this device do everything I need it to do?

Hey Everyone

So I had to do a capture on one of my home machines the other day to troubleshoot something. Shortly into this capture I saw one of our Sony devices (either a ps4 or sony tv) appeared to be running a rogue dhcpv6 server on our network trying to get my machine to accept a lease. This seems like a pretty sneaky way do some network recon which I’m sure they sell to the highest bidder. Because of this little discovery as well as my significant other’s desire to get some cameras on the perimeter of the house, I’ve decided that it’s time to do some serious network segmentation in the home network.

For the past few months i’ve been on a quest to redo my home network. After a ton of research I think I’m just about sold on the Turris Omnia. It sounds like it has quite the feature set, as well as having the ability to flash to openwrt if this can gain some additional functionality.

Before I buy it, I wanted to ask some of you whether or not the router can do everything needed for the following setup:

I will be creating a router on a stick configuration which provides routing for roughly 20 vlans connected to an 802.1Q trunk on a netgear GS116E switch. If possible I’m going to try to portchannel 2 of the LAN ports on the Omnia and connect them to a 2 port LAG on the Netgear Switch in order to have 2Gbps of logical capacity (with no single traffic flow exceeding 1Gbps). This port channel will be a trunk which will pass all 20 VLANs to the Omnia router. I’ll need to apply acl’s/firewalling between these inside vlans at the Omnia router. Most of them will need to be completely firewalled off from each other, but some of the vlans will need a port or 2 allowed for things like printing. I’ll need the Omnia to act as a DHCP server for multiple scopes for some vlans. Connectivity to the internet will be using PAT with the same single IPV4 address for all VLANs. Additional downstream switches will uplink to the other ports on the netgear switch which connect to other switches throughout the house that support 802.1Q tagging so that vlans can stretch all around the house. I’d also like to hang some Openwrt Access Points off of these switches with multiple SSIDs in different VLANs. I will also need to put an acl in place on one vlan to only allow outbound to the internet to one IP address and port and block everything else in and out (just for that VLAN). This would need to be a stateful connection and allow the return traffic.

Does anyone see anything wrong with this scenario and could someone confirm that the Omnia would be able to do everything it would need to in this scenario? Will this work or do I need to be looking into an enterprise solution at this point? If anyone has any suggestions I’m open to hearing them.

Thanks

You’re describing a rather complex configuration. A query this long is not common . It would also be good to write what you really want to achieve with what devices. Someone may suggest a simpler solution

Hey JardaB

Thank you for the reply. I’ll try to list the functionality out below which might make it easier:

-Can this device support NIC teaming two of the LAN ports to connect to a LAG?
-Can the device do 802.1Q vlan tagging (encapsulation may be the term i’m looking for here) and allow the NIC Teamed link listed above to act as a trunk receiving the traffic of multiple vlans from the switch? This is often referred to as a router on a stick configuration if anyone is familiar with that?
-Can this device serve as the default gateway (router) for multiple internal subnets (roughly 20) so they can communicate with each other?
-Can the device block traffic between the multiple internal private subnets?
-Can the device block traffic outbound to the internet from one internal LAN to just a single external IP address and port while not blocking this traffic from the other internal LANs?
-Can the device PAT internet bound traffic to a single public IPv4 address from all of the internal subnets?
-Can multiple SSIDs be created and vlan tagged on this device?

Thanks