[SOLVED] Need advice for planning network map, VLAN vs separate network?

[LetThatSinkIn]

Hello,

I'm hoping to get some advice about how to approach this network.

I don't want the IP Cam's to have access to the internet, or any devices on the main network since the termination point of the Cat6 is on the exterior of the house (aside from the Win10 machine with BI, obviously).

The Win10 machine with Blue Iris does have two NIC's, so I wondering how feasible it would be to just create a separate network entirely with a router/gateway inbetween the Win10 machine and the IP Camera network segment. I was thinking that this would allow me to periodically bridge the networks to perform firmware updates on the cam's and/or switches, and the one Win 10 machine on that segment, while keeping all those devices off the internet at all other times. I would be using the upstairs Win10 machine to facilitate firmware upgrades during any time the networks are bridged, fwiw.

Alternatively I was thinking about possibly picking up an Edgerouter 4 at some point in the future and maybe setting everything up with VLAN's, but this seems a little complicated.

Any advice for me? I realize creating a separate network will require some thoughtful planning, but I think this is my preferred option as long as it's feasible.

Below is a photo of the network map, with the red part being the part I'm trying to decide on. Thanks in advance for any advice you might be able to offer before I get started with this.

LTSI

 

[SamirD]

I think you have a great idea. You can simply assign static IPs to all the cameras, with no gateway so that keeps them from accessing the Internet (even though they can't because there's no physical gateway or router) and a static IP on the blue iris system on that segment that's different from the rest of the network on the other nic. From the blue iris system you can access both networks without an issue. Even for updates I would just manually download camera updates to the blueiris and upload to the cameras, keeping the cameras completely off-grid (and safe). And you still have full access to everything since you can access the blue iris from your main network.

Physical lan separation like this is far better than a vlan as there are certain malware that can break vlans. And when it comes to security, you want maximum isolation from 'paydirt' for the dirtbags out there.

 

[bill001g]

That is how I have my camera system setup. There is no way to get to the cameras directly from the internet and the dvr box running blueiris I even leave the second nic disabled unless I have some need to access it when I am not at home. I never would trust the camera software to not have backdoor password and such.