I’m planning to build a new OpenWRT-based network. I know they have a list of recommended switches, but not all are readily available in some parts of the world.
In general, can Omada switches be trusted? They have great specs and features.
Are all unmanaged switches safe to use, regardless of the brand?
What about managed switches and what to look out for? Privacy and security are very important to me.
You should figure out if you need a managed switch or not. If all you need is an unmanaged switch you don’t need to worry about having OpenWrt on it.
It would also benefit you more to ask this on the OpenWrt forum unless there is a specific privacy concern you want to address here. Their community is very friendly and knowledgable.
Are all unmanaged switches private and secure by default, regardless of the brand?
Managed switches can be useful when you’re planning to do network segmentation i.e. VLAN’s, and have the necessary knowhow. You would typically use it to put untrusted devices like smart TV’s, tvtop boxes, IoT devices, WiFi-connected vacuum cleaners, etc. on a separate isolated network that doesn’t have access to your primary LAN. There have been a number of cases where these devices have been caught snooping on the customer’s LAN and doing other shady stuff (SuperBox comes to mind).
As for security, it can be said that all devices may be vulnerable to some sort of undiscovered exploits. You would typically do a threat model and decide how big of an attack surface is acceptable to you. Even unmanaged switches can be theoretically backdoored to reply to some specific layer-2 packet sequence (since they typically don’t have an IP address), but that’s going into advanced territory. Personally, I have a special rule - that I always replace default firmware on a networking device with a custom one (OpenWRT for WiFi routers, OPNsense for gateways and switches). If you’re going to plan your segmentation, remember to create and put any management interfaces (where the device admin web pages can be accessed) on a separate and isolated VLAN that doesn’t have internet access (on-site access only).
I did some research on this topic a few months ago.
At the low end you’ve got the TL-SG108E which is the one I have. Lawrence systems did a video on this, it is vulnerable to VLAN hopping and the admin interface isn’t all that secure. When I was doing research, I was trying to find one that was at least better than this for security, without going over the top and buying some corporate level hardware. Netgear have an equivalent model but with all the same issues as this one.
Well what I concluded was that there is very little in between. Those cloud switches weren’t to my taste. But there are some MikroTik switches that are fairly low cost but have good security features. There are two operating systems, SwOS and RouterOS, the latter being more advanced.
Here are some models I bookmarked, I didn’t up buying one, yet.
E60iUGS
E50UG
CSS610-8G-2S+IN
hEX S
The reason why my search has been so difficult is because, like you, I don’t trust the OEM’s firmware. Which switch allows the use of OPNsense? I want my entire network to use either OPNsense or OpenWRT. Worst case scenario, I’ll just import a switch to flash to OpenWRT, but it’s not my first choice.
I’m confused. Are you saying those switches can be flashed to OpenWRT?
I wouldn’t reccommend just buying the cheapest random chinese brand you find. It’s mostly irrelevant in this case anyway as I doubt openwrt even has much support for unmanaged switches. Since they don’t usually have a configurable management interface.
Its that unmanaged switches just do less and therefore have less attack surface. They route packets on what is available, and are kinda dumb outside of that. They don’t have an IP address because its not a device on the network requesting network access. Its basically the equivalent of adding more ports to your router and nothing else.
Managed switches offer routing configuration functionality that merits more control over the switch, but also comes with more of a surface to manage correctly. These have an IP address as managed switch requests a spot on the network so you can access the configuration plane. You can better lock down the switch, manage traffic shaping, and several other things.
If this is just for a home network (assuming you don’t have an extensive home lab), OpenWRT primary router + unmanaged switch seems fine to me.
Unmanaged switchds have no routing functionality to flash, it does not have the capability to be a router. You’d just manage the connections on your primary router and the switch is dumb.
Managed switches may be able to flash OpenWRT depending the model. If you aren’t sure, check OpenWRT hardware page.
To be fair, this can be done largely with VLANs on a primary OpenWRT router based on MAC. Or simpler, connect those devices to a guest WiFi like situation is isolated that way.
You can’t effectively isolate devices connected to the same switch using the router they use as their gateway because they can all still talk to each other without some isolation being done on the switch. The switch will forward packets between them directly without ever involving the router if there is no L2 segmentation of any kind.
I wasn’t aware you were dead-set on OpenWRT, sorry. I don’t know if you can flash that on them.
Makes sense, I was thinking of my personal setup where effectively my untrusted devices connect to my router directly for management.
I always replace default firmware on a networking device with a custom one
I’m curious about this. Can most switches firmware be replaced? Take a TL-SG108E for example?